Analysis
- max time kernel
612s - max time network
644s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/04/2024, 17:14
General
- Target Step 0 - AVENGERS_AIO_v2.5.0.exe
- Size 378.8MB
- Sample240425-vsc44sch5y
- SHA256 1ef7a716f3edd343f583abb0a0f75357ebd789e35b11eb267098f8aacd56780d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 45 IoCs
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 64 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 9 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 10 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 6 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 39 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 10 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Step 0 - AVENGERS_AIO_v2.5.0.exe"C:\Users\Admin\AppData\Local\Temp\Step 0 - AVENGERS_AIO_v2.5.0.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\AiO-Files\WinPKG.exe"C:\AiO-Files\WinPKG.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\JRE\v8\..\systemfix.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /V ProfileImagePath /T reg_expand_sz /d "C:\Windows\syswow64\config\systemprofile" /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\JRE\v8\..\uninstall.bat 83⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic product where "Name like '%Java 8 %'" call uninstall4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\AiO-Files\Packages\JRE\v8\x86\jre.exeC:\AiO-Files\Packages\JRE\v8\x86\jre.exe /s3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240803656.tmp\jre.exe"C:\Users\Admin\AppData\Local\Temp\jds240803656.tmp\jre.exe" "/s"4⤵
- Executes dropped EXE
-
-
-
C:\AiO-Files\Packages\JRE\v8\x64\jre.exeC:\AiO-Files\Packages\JRE\v8\x64\jre.exe /s3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jds240894953.tmp\jre.exe"C:\Users\Admin\AppData\Local\Temp\jds240894953.tmp\jre.exe" "/s"4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\MSVC\2005\uninstall.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2005" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2005" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2005" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2005" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2005\x86\vcredist.msi /q transforms=2k5-x86.mst3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2005\x64\vcredist.msi /q transforms=2k5-x64.mst3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\MSVC\2008\uninstall.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2008" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2008" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /q4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2008" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2008" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /q4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 9.0" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 9.0" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 9.0" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 9.0" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2008\x86\vc_red.msi transforms=2k8-x86.mst3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2008\x64\vc_red.msi transforms=2k8-x64.mst3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\MSVC\2012\uninstall.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2012" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2012" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2012" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2012" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /q4⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /q -burn.unelevated BurnPipe.{CFE928CE-1D81-42F8-8CFD-1F31CD6E0CCA} {C5DC95EB-2F69-446F-807F-BE9E009C6B2D} 35005⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 9806⤵
- Program crash
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /q4⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /q -burn.unelevated BurnPipe.{855B30BE-B9C5-4402-B150-A6082BD314F6} {6C6AABD4-7276-4677-AD9D-00CE6E753EC9} 49165⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 11726⤵
- Program crash
-
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2012\setup\vc_runtimeminimum_x86.msi /q /norestart3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2012\setup\vc_runtimeadditional_x86.msi /q /norestart3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2012\setup\vc_runtimeminimum_x64.msi /q /norestart3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\AiO-Files\Packages\MSVC\2012\setup\vc_runtimeadditional_x64.msi /q /norestart3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\AiO-Files\Packages\MSVC\2013\uninstall.bat3⤵
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe" /uninstall /quiet4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe" /uninstall /quiet -burn.unelevated BurnPipe.{A3FB6D48-7C4A-444C-98A3-01C10CAD56D1} {6B874BE3-0A3B-41E8-A690-4C8950EBDDEF} 33325⤵
- Executes dropped EXE
-
-
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe" /uninstall /quiet4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe" /uninstall /quiet -burn.unelevated BurnPipe.{7C30FED7-2D57-4099-9030-F1CEC67BD02F} {4F27ABE8-DCC7-40E1-BD89-22C91F205950} 34205⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2013" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2013" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{CB0836EC-B072-368D-82B2-D3470BF95707} /q4⤵
- Enumerates connected drives
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2013" /D /S 2>NUL | FINDSTR /R /C:"HKEY_"4⤵
-
C:\Windows\system32\reg.exeREG Query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /F "Visual C++ 2013" /D /S5⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exeFINDSTR /R /C:"HKEY_"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /q4⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /q -burn.unelevated BurnPipe.{B3344BC5-5DE3-4724-8758-4680AEB1EB4D} {449FC665-4765-4A84-ACCD-B47FE8F12B64} 35525⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 11286⤵
- Program crash
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /F UninstallString /V /E | FIND /I " UninstallString "4⤵
-
C:\Windows\system32\reg.exeREG Query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /F UninstallString /V /E5⤵
-
-
C:\Windows\system32\find.exeFIND /I " UninstallString "5⤵
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /q4⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /q -burn.unelevated BurnPipe.{D25A5EF3-54FF-457C-A6EE-3812B84CA996} {FC1D5A1B-CDD2-4BDF-8B1A-C97CA5784B9D} 47525⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 10206⤵
- Program crash
-
-
-
-
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exeC:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe /q /norestart3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x86.exe" /q /norestart -burn.unelevated BurnPipe.{460828D0-1F8E-4673-A27A-CED1CEA01EA0} {5DF386BE-ADE7-449F-B7C8-57B6A90D1697} 12084⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 9925⤵
- Program crash
-
-
-
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exeC:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe /q /norestart3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe"C:\AiO-Files\Packages\MSVC\2013\msvc_13_x64.exe" /q /norestart -burn.unelevated BurnPipe.{6D35745C-8588-45A9-8963-9EC3CEA87411} {1C42E90E-9073-404B-9914-4F37CBC605A3} 45324⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 10805⤵
- Program crash
-
-
-
-
C:\AiO-Files\Packages\jsredist\x64\install.exeC:\AiO-Files\Packages\jsredist\x64\install.exe /q3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E95B68F0D37054DC17782D2607ED8B342⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
-
C:\Windows\Installer\MSI3BF3.tmp"C:\Windows\Installer\MSI3BF3.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0} /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" /x {4A03706F-666A-4037-7777-5F2748764D10} /qn4⤵
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 596547C9AA704C608AC1AB79E2F461D4 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9AE326401EF5053516767819F9205B9E E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EB15F476A2A5CCF412D0151322494BD12⤵
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\installer.exe"C:\Program Files (x86)\Java\jre1.8.0_251\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_251\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F32180251F0}2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Oracle\Java\installcache\240812093.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/plugin.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/plugin.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/javaws.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/javaws.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/deploy.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/deploy.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/rt.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/rt.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/jsse.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/jsse.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/charsets.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/charsets.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_251\lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jre1.8.0_251\lib/ext/localedata.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaw.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\ssvagent.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_251" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzI1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8yNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzI1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Java\jre1.8.0_251\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_251\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_251" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzI1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8yNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzI1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMjUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 39FD734909287B892037EFC38A906C5C E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CDF7706C0830EA369A535A1835C17DBC2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 500D2799B44F0DEFAA845B57F295631A E Global\MSI00002⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DF7A5F5EBFA1F849E44D5C24C93F4ACB2⤵
-
-
C:\Program Files\Java\jre1.8.0_251\installer.exe"C:\Program Files\Java\jre1.8.0_251\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_251\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180251F0}2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\ProgramData\Oracle\Java\installcache_x64\240906359.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_251\lib/plugin.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_251\lib/javaws.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_251\lib/deploy.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_251\lib/rt.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_251\lib/jsse.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_251\lib/charsets.jar"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_251\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_251\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_251\lib/ext/localedata.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files\Java\jre1.8.0_251\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_251\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_251\bin\ssvagent.exe"C:\Program Files\Java\jre1.8.0_251\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files\Java\jre1.8.0_251\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_251\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Java\jre1.8.0_251\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_251\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_251" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Java\jre1.8.0_251\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_251\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Java\jre1.8.0_251\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_251\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_251" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 35D92226ADBC375517D236CE2CC7DC37 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3046FC549EDB49DAE244304950F8D77C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 26898DEF43DFDCA4A1ED94E4898FCF332⤵
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 0C8F6D4B79C443F34B0B7E7B20765E5E2⤵
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 30B20D005CBD2B9916BA83E0FC4B5AC92⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1FBFCB92D1A1085579D6D2C0DBF5EC432⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DE1E7D2D23EC9EEBCA61E9E2FD0DE2342⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54FA54BA6D55A0D67C636E5E34BE49552⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D14DCFB16787B9B67952908AA0BB0F02⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 74927C73E49CED5A37D8514F3E4B6A7F2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0A539F7B6C7F969EB92B4248F3EA5A5F2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31EBC55C587CC71CD75EF0ADFA4B52B62⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 5CCEBD26E34C49FABDAB7FF7526FD0BE2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2044 -ip 20441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 452 -ip 4521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3508 -ip 35081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2472 -ip 24721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2832 -ip 28321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1384 -ip 13841⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
security_watermark.jpg
selectedTab_leftCorner.gif
selectedTab_rightCorner.gif
Accessibility.dll
AspNetMMCExt.dll
legacy.web_hightrust.config
legacy.web_mediumtrust.config
machine.config
web.config
web_hightrust.config
web_mediumtrust.config
Microsoft.Activities.Build.dll
Microsoft.Build.Conversion.v4.0.dll
Microsoft.Build.Engine.dll
Microsoft.Build.Framework.dll
Microsoft.Build.Tasks.v4.0.dll
Microsoft.Build.Utilities.v4.0.dll
Microsoft.Build.dll
Microsoft.CSharp.dll
Microsoft.Data.Entity.Build.Tasks.dll
Microsoft.Internal.Tasks.Dataflow.dll
Microsoft.JScript.dll
Microsoft.Transactions.Bridge.dll
Microsoft.VisualBasic.Compatibility.Data.dll
Microsoft.VisualBasic.Compatibility.dll
Microsoft.VisualBasic.dll
Microsoft.VisualC.Dll
Microsoft.VisualC.STLCLR.dll
Microsoft.Win32.Primitives.dll
Microsoft.Windows.ApplicationServer.Applications.dll
Microsoft.Workflow.Compiler.exe
SMDiagnostics.dll
System.Activities.Core.Presentation.dll
System.Activities.DurableInstancing.dll
System.Activities.Presentation.dll
System.Activities.dll
System.AddIn.Contract.dll
System.AddIn.dll
System.AppContext.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.Annotations.dll
System.ComponentModel.Composition.dll
System.ComponentModel.DataAnnotations.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Configuration.Install.dll
System.Configuration.dll
System.Console.dll
System.Core.dll
System.Data.Common.dll
System.Data.DataSetExtensions.dll
System.Data.Entity.Design.dll
System.Data.Entity.dll
System.Data.Linq.dll
System.Data.Services.Client.dll
System.Data.Services.Design.dll
System.Data.Services.dll
System.Data.SqlXml.dll
System.Deployment.dll
System.Design.dll
System.Device.dll
System.Diagnostics.Contracts.dll
System.Diagnostics.Debug.dll
System.Diagnostics.FileVersionInfo.dll
System.Diagnostics.Process.dll
System.Diagnostics.StackTrace.dll
System.Diagnostics.TextWriterTraceListener.dll
System.Diagnostics.Tools.dll
System.Diagnostics.TraceSource.dll
System.Diagnostics.Tracing.dll
System.DirectoryServices.AccountManagement.dll
System.DirectoryServices.Protocols.dll
System.DirectoryServices.dll
System.Drawing.Design.dll
System.Drawing.Primitives.dll
System.Drawing.dll
System.Dynamic.Runtime.dll
System.Dynamic.dll
System.Globalization.Calendars.dll
System.Globalization.Extensions.dll
System.Globalization.dll
System.IO.Compression.FileSystem.dll
System.IO.Compression.ZipFile.dll
System.IO.Compression.dll
System.IO.FileSystem.DriveInfo.dll
System.IO.FileSystem.Primitives.dll
System.IO.FileSystem.Watcher.dll
System.IO.FileSystem.dll
System.IO.IsolatedStorage.dll
System.IO.Log.dll
System.IO.MemoryMappedFiles.dll
System.IO.Pipes.dll
System.IO.UnmanagedMemoryStream.dll
System.IO.dll
System.IdentityModel.Selectors.dll
System.IdentityModel.Services.dll
System.IdentityModel.dll
System.Linq.Expressions.dll
System.Linq.Parallel.dll
System.Linq.Queryable.dll
System.Linq.dll
System.Management.Instrumentation.dll
System.Management.dll
System.Messaging.dll
System.Net.Http.Rtc.dll
System.Net.Http.WebRequest.dll
System.Net.Http.dll
System.Net.NameResolution.dll
System.Net.NetworkInformation.dll
System.Net.Ping.dll
System.Net.Primitives.dll
System.Net.Requests.dll
System.Net.Security.dll
System.Net.Sockets.dll
System.Net.WebHeaderCollection.dll
System.Net.WebSockets.Client.dll
System.Net.WebSockets.dll
System.Net.dll
System.Numerics.Vectors.dll
System.Numerics.dll
System.ObjectModel.dll
System.Reflection.Emit.ILGeneration.dll
System.Reflection.Emit.Lightweight.dll
System.Reflection.Emit.dll
System.Reflection.Extensions.dll
System.Reflection.Primitives.dll
System.Reflection.context.dll
System.Reflection.dll
System.Resources.Reader.dll
System.Resources.ResourceManager.dll
System.Resources.Writer.dll
System.Runtime.Caching.dll
System.Runtime.CompilerServices.VisualC.dll
System.Runtime.DurableInstancing.dll
System.Runtime.Extensions.dll
System.Runtime.Handles.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.Runtime.InteropServices.WindowsRuntime.dll
System.Runtime.InteropServices.dll
System.Runtime.Numerics.dll
System.Runtime.Remoting.dll
System.Runtime.Serialization.Formatters.Soap.dll
System.Runtime.Serialization.Formatters.dll
System.Runtime.Serialization.Json.dll
System.Runtime.Serialization.Primitives.dll
System.Runtime.Serialization.Xml.dll
System.Runtime.Serialization.dll
System.Runtime.dll
System.Security.Claims.dll
System.Security.Cryptography.Algorithms.dll
System.Security.Cryptography.Csp.dll
System.Security.Cryptography.Encoding.dll
System.Security.Cryptography.Primitives.dll
System.Security.Cryptography.X509Certificates.dll
System.Security.Principal.dll
System.Security.SecureString.dll
System.Security.dll
System.ServiceModel.Activation.dll
System.ServiceModel.Activities.dll
System.ServiceModel.Channels.dll
System.ServiceModel.Discovery.dll
System.ServiceModel.Duplex.dll
System.ServiceModel.Http.dll
System.ServiceModel.Internals.dll
System.ServiceModel.NetTcp.dll
System.ServiceModel.Primitives.dll
System.ServiceModel.Routing.dll
System.ServiceModel.Security.dll
System.ServiceModel.ServiceMoniker40.dll
System.ServiceModel.WasHosting.dll
System.ServiceModel.Web.dll
System.ServiceModel.dll
System.ServiceProcess.dll
System.Text.Encoding.Extensions.dll
System.Text.Encoding.dll
System.Text.RegularExpressions.dll
System.Threading.Overlapped.dll
System.Threading.Tasks.Parallel.dll
System.Threading.Tasks.dll
System.Threading.Thread.dll
System.Threading.ThreadPool.dll
System.Threading.Timer.dll
System.Threading.dll
System.ValueTuple.dll
System.Web.Abstractions.dll
System.Web.ApplicationServices.dll
System.Web.DataVisualization.Design.dll
System.Web.DataVisualization.dll
System.Web.DynamicData.Design.dll
System.Web.DynamicData.dll
System.Web.Entity.Design.dll
System.Web.Entity.dll
System.Web.Extensions.Design.dll
System.Web.Extensions.dll
System.Web.Mobile.dll
System.Web.RegularExpressions.dll
System.Web.Routing.dll
System.Web.Services.dll
System.Windows.Forms.DataVisualization.Design.dll
System.Windows.Forms.DataVisualization.dll
System.Windows.Forms.dll
System.Windows.dll
System.Workflow.Activities.dll
System.Workflow.ComponentModel.dll
System.Workflow.Runtime.dll
System.WorkflowServices.dll
System.XML.dll
System.Xaml.Hosting.dll
System.Xaml.dll
System.Xml.Linq.dll
System.Xml.ReaderWriter.dll
System.Xml.Serialization.dll
System.Xml.XDocument.dll
System.Xml.XPath.XDocument.dll
System.Xml.XPath.dll
System.Xml.XmlDocument.dll
System.Xml.XmlSerializer.dll
System.dll
GlobalMonospace.CompositeFont
GlobalSansSerif.CompositeFont
GlobalSerif.CompositeFont
GlobalUserInterface.CompositeFont
NlsLexicons0009.dll
PresentationBuildTasks.dll
PresentationFramework-SystemCore.dll
PresentationFramework-SystemData.dll
PresentationFramework-SystemDrawing.dll
PresentationFramework-SystemXml.dll
PresentationFramework-SystemXmlLinq.dll
PresentationFramework.Aero.dll
PresentationFramework.AeroLite.dll
PresentationFramework.Classic.dll
PresentationFramework.Luna.dll
PresentationFramework.Royale.dll
PresentationFramework.dll
PresentationUI.dll
ReachFramework.dll
System.Speech.dll
System.Windows.Controls.Ribbon.dll
System.Windows.Input.Manipulations.dll
System.Windows.Presentation.dll
UIAutomationClient.dll
UIAutomationClientsideProviders.dll
UIAutomationProvider.dll
UIAutomationTypes.dll
WindowsBase.dll
WindowsFormsIntegration.dll
XamlBuildTask.dll
XsdBuildTask.dll
_DataOracleClientPerfCounters_shared12_neutral.h
ilasm.exe.config
netstandard.dll
sysglobl.dll
system.componentmodel.composition.registration.dll
AddInUtil.exe.config
web_lowtrust.config
web_minimaltrust.config
NlsLexicons0009.dll
jsc.exe.config
normidna.nlp
normnfc.nlp
normnfd.nlp
normnfkc.nlp
normnfkd.nlp
vbc.exe.config
package.xml
package.xml
package.xml
package.xml
package.xml
SystemFix.bat
uninstall.bat
package.xml
package.xml
package.xml
2k8-x64.mst
vcredist.bmp
package.xml
vc_runtimeAdditional_x86.msi
package.xml
package.xml
package.xml
package.xml
package.xml
package.xml
eula.1046.txt
WinPKG.exe
1025.xml
1026.xml
1028.xml
1031.xml
1033.xml
1034.xml
1049.xml
3082.xml
e5a2cef.rbs
e5a2e10.rbs
e5a2e17.rbs
e5a2e1c.rbs
e5a2e21.rbs
e5a2e27.rbs
e5a2e2e.rbs
e5a2e33.rbs
e5a2e37.rbs
e5a2e3d.rbs
e5a2e43.rbs
e5a2e4f.rbs
e5a2e52.rbs
e5a2e55.rbs
e5a2e58.rbs
e5a2e5f.rbs
e5a2e70.rbs
e5a2e75.rbs
e5a2e86.rbs
e5a2e8f.rbs
e5a2e97.rbs
e5a2e9c.rbs
WindowsAccessBridge-32.dll
deploy.dll
npdeployJava1.dll
java.exe
javacpl.exe
javaw.exe
javaws.exe
wsdetect.dll
invalid32x32.gif
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
WindowsAccessBridge-64.dll
npdeployJava1.dll
java.exe
javacpl.exe
javaw.exe
javaws.exe
messages_zh_HK.properties
Reference Documentation.url
Get Help.url
Get Help.url
Visit Java.com.url
baseimagefam8
baseimagefam8
vcredist_x64.exe
vcredist_x86.exe
JavaDeployReg.log
jusched.log
jusched.log
logo.png
thm.xml
thm.wxl
license.rtf
thm.wxl
wixstdba.dll
MSI255E.tmp
MSI29C1.tmp
MSI3BF3.tmp
MSI55DF.tmp
MSI56F9.tmp
MSI57C5.tmp
MSI5F40.tmp
MSI76D3.tmp
MSIE281.tmp
MSIFC8B.tmp
e5a2e14.msi
e5a2e1e.msi
e5a2e23.msi
e5a2e2a.msi
e5a2e3e.msi
e5a2e44.msi
eula.1028.txt
eula.1031.txt
eula.1033.txt
eula.1036.txt
eula.1040.txt
eula.1041.txt
eula.1042.txt
eula.2052.txt
eula.3082.txt
jsredist.msi
memory/808-5316-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/808-5326-0x0000000004F48000-0x0000000004F50000-memory.dmp
memory/808-5297-0x0000000004F00000-0x0000000006F00000-memory.dmp
memory/808-5313-0x0000000004F00000-0x0000000006F00000-memory.dmp
memory/808-5330-0x0000000004FB0000-0x0000000004FB8000-memory.dmp
memory/808-5317-0x0000000004F00000-0x0000000006F00000-memory.dmp
memory/808-5329-0x0000000004FA8000-0x0000000004FB0000-memory.dmp
memory/808-5323-0x0000000004F00000-0x0000000006F00000-memory.dmp
memory/808-5327-0x0000000004F38000-0x0000000004F40000-memory.dmp
memory/808-5328-0x0000000004F00000-0x0000000006F00000-memory.dmp
memory/832-6536-0x0000000005670000-0x0000000006670000-memory.dmp
memory/832-6433-0x0000000005670000-0x0000000006670000-memory.dmp
memory/832-6472-0x0000000005670000-0x0000000006670000-memory.dmp
memory/832-6470-0x0000000005900000-0x0000000005910000-memory.dmp
memory/832-6471-0x00000000058F0000-0x0000000005900000-memory.dmp
memory/2084-4509-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2084-4511-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2084-4513-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2548-6382-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6378-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6388-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6397-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6405-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6416-0x0000000002A90000-0x0000000003A90000-memory.dmp
memory/2548-6427-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2548-6534-0x0000000002A90000-0x0000000003A90000-memory.dmp
memory/2548-6376-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6362-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6369-0x0000000002270000-0x0000000002271000-memory.dmp
memory/2548-6351-0x0000000002A90000-0x0000000003A90000-memory.dmp
memory/3496-5959-0x0000000003100000-0x0000000003101000-memory.dmp
memory/3496-5958-0x0000000003220000-0x0000000004220000-memory.dmp
memory/3916-4029-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-5420-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-4416-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-4005-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/3916-4231-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-5167-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-4030-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-4031-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/3916-4032-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/3916-4037-0x0000000000400000-0x00000000005ED000-memory.dmp
memory/4204-5286-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5261-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5285-0x0000000002DE8000-0x0000000002DF0000-memory.dmp
memory/4204-5284-0x0000000002DE0000-0x0000000002DE8000-memory.dmp
memory/4204-5282-0x0000000002DC8000-0x0000000002DD0000-memory.dmp
memory/4204-5283-0x0000000002DD0000-0x0000000002DD8000-memory.dmp
memory/4204-5281-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5280-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5279-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5273-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5267-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5234-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5213-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5219-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5225-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5263-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5262-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5231-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5201-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5259-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5265-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5657-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5254-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5253-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5252-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5246-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5245-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4204-5238-0x0000000002CF0000-0x0000000004CF0000-memory.dmp
memory/4204-5237-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4268-4815-0x0000000002B80000-0x0000000004B80000-memory.dmp
memory/4268-4817-0x0000000001180000-0x0000000001181000-memory.dmp
memory/4912-5660-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4912-5662-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4912-5658-0x0000000000400000-0x0000000000417000-memory.dmp