Analysis
-
max time kernel
1799s -
max time network
1800s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20-05-2024 20:11
General
-
Target
Celex.exe
-
Size
3.1MB
-
MD5
483d0a45f61e108b7a89c6707e138d62
-
SHA1
da16e84ef741a6a82038468da5990b25e3bf751c
-
SHA256
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
-
SHA512
5c6da715cdafda98a37b6eaa455d5c12148b1048f5e038f9482d0f51f5e247cf75ff1c8439d3a75b6f674daa843a8ecd21aab23663b6bdd6bc7bac0fce606492
-
SSDEEP
49152:Wvxt62XlaSFNWPjljiFa2RoUYIiyTCD8foGdIoTHHB72eh2NT:Wv762XlaSFNWPjljiFXRoUYIiyTCc
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Beamed Celex
C2
192.168.2.102:5145
Nixon:5145
Mutex
a9d8efa6-449f-415c-bad7-c7fbd83156d2
Attributes
-
encryption_key
288C4AC276CDC9ADD45AEABDE642A8A88681F7BB
-
install_name
Celex.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
Celex
-
subdirectory
Celex
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 2 IoCs
-
Checks computer location settings 2 TTPs 52 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 53 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 52 IoCs
-
Suspicious use of AdjustPrivilegeToken 54 IoCs
-
Suspicious use of FindShellTrayWindow 53 IoCs
-
Suspicious use of SendNotifyMessage 53 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celex.exe"C:\Users\Admin\AppData\Local\Temp\Celex.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2pD8PgU4uFoE.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uT8tkBMgXJVV.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f7⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f9xyajHjF21d.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f9⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30oqtRYFz11V.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f11⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qj9zovuSevqD.bat" "11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f13⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mZS0eif0PzkR.bat" "13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f15⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hb048pTU8viV.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f17⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Krngi2Qy14AF.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f19⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3jfL4yKgvbXq.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f21⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCE1GM8IDqqM.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f23⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ebkNEelodBJM.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f25⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kcFVql4Kvldq.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f27⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sd6SNzaPsBfm.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f29⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6FHFgSlr0aNb.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f31⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jto4Tov1FOoB.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f33⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9q0bx6DmycN1.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f35⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lV0GXA5nDPB7.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f37⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hcPiycBcdUKK.bat" "37⤵
-
C:\Windows\system32\chcp.comchcp 6500138⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost38⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f39⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\olowI1h7bTDf.bat" "39⤵
-
C:\Windows\system32\chcp.comchcp 6500140⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f41⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UrLjQw7PbOtj.bat" "41⤵
-
C:\Windows\system32\chcp.comchcp 6500142⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f43⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FRqNrAv7ugOo.bat" "43⤵
-
C:\Windows\system32\chcp.comchcp 6500144⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost44⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f45⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sq2LhdisfybH.bat" "45⤵
-
C:\Windows\system32\chcp.comchcp 6500146⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost46⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f47⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2A8GiKSbxVv3.bat" "47⤵
-
C:\Windows\system32\chcp.comchcp 6500148⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f49⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kCPUzbUs40F9.bat" "49⤵
-
C:\Windows\system32\chcp.comchcp 6500150⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost50⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f51⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2xVz43aiR2wC.bat" "51⤵
-
C:\Windows\system32\chcp.comchcp 6500152⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost52⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f53⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EiHdqpdudY8J.bat" "53⤵
-
C:\Windows\system32\chcp.comchcp 6500154⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f55⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1nb8Cl6VNspv.bat" "55⤵
-
C:\Windows\system32\chcp.comchcp 6500156⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost56⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f57⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IJAs2HZRWp2O.bat" "57⤵
-
C:\Windows\system32\chcp.comchcp 6500158⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost58⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f59⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\K4Qbl0rDtpM9.bat" "59⤵
-
C:\Windows\system32\chcp.comchcp 6500160⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f61⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dQBS7C3n1I4d.bat" "61⤵
-
C:\Windows\system32\chcp.comchcp 6500162⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost62⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f63⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lmnr070Iz6WG.bat" "63⤵
-
C:\Windows\system32\chcp.comchcp 6500164⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost64⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f65⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c15E9YgaGkHU.bat" "65⤵
-
C:\Windows\system32\chcp.comchcp 6500166⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"66⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f67⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bxK55pFnNdsu.bat" "67⤵
-
C:\Windows\system32\chcp.comchcp 6500168⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost68⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"68⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f69⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\odLN7JkjEHoI.bat" "69⤵
-
C:\Windows\system32\chcp.comchcp 6500170⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost70⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"70⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f71⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XAmIH8eU8A0K.bat" "71⤵
-
C:\Windows\system32\chcp.comchcp 6500172⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost72⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"72⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f73⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rbdh50Bx7kTG.bat" "73⤵
-
C:\Windows\system32\chcp.comchcp 6500174⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"74⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f75⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2dRzzbX3ncCg.bat" "75⤵
-
C:\Windows\system32\chcp.comchcp 6500176⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost76⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"76⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f77⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pL6ByhVYEx3Z.bat" "77⤵
-
C:\Windows\system32\chcp.comchcp 6500178⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost78⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"78⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f79⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMk9xe0HNYgj.bat" "79⤵
-
C:\Windows\system32\chcp.comchcp 6500180⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"80⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f81⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7xtnx4GgEfiN.bat" "81⤵
-
C:\Windows\system32\chcp.comchcp 6500182⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"82⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f83⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9qaiGQLcVPU5.bat" "83⤵
-
C:\Windows\system32\chcp.comchcp 6500184⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost84⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"84⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f85⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oojv0npu66S3.bat" "85⤵
-
C:\Windows\system32\chcp.comchcp 6500186⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost86⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"86⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f87⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6IumkfB5fIgL.bat" "87⤵
-
C:\Windows\system32\chcp.comchcp 6500188⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost88⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"88⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f89⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PjUHOyhAs1sS.bat" "89⤵
-
C:\Windows\system32\chcp.comchcp 6500190⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost90⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"90⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f91⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pbtn9GyjJivN.bat" "91⤵
-
C:\Windows\system32\chcp.comchcp 6500192⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost92⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"92⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f93⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qXq60KO8iUjM.bat" "93⤵
-
C:\Windows\system32\chcp.comchcp 6500194⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost94⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"94⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f95⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pFUNfyfq9Wuq.bat" "95⤵
-
C:\Windows\system32\chcp.comchcp 6500196⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost96⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"96⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f97⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOOEAhfQK4fl.bat" "97⤵
-
C:\Windows\system32\chcp.comchcp 6500198⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost98⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"98⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f99⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W19ZcDJXs9LU.bat" "99⤵
-
C:\Windows\system32\chcp.comchcp 65001100⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost100⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"100⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f101⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NuoN5DPuD3Ai.bat" "101⤵
-
C:\Windows\system32\chcp.comchcp 65001102⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost102⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"102⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f103⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pTwdwunBLlKR.bat" "103⤵
-
C:\Windows\system32\chcp.comchcp 65001104⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost104⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"104⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f105⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\edozSKPyNb8Y.bat" "105⤵
-
C:\Windows\system32\chcp.comchcp 65001106⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost106⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"C:\Users\Admin\AppData\Roaming\Celex\Celex.exe"106⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Celex" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Celex\Celex.exe" /rl HIGHEST /f107⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Celex.exe.logFilesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
C:\Users\Admin\AppData\Local\Temp\1nb8Cl6VNspv.batFilesize
205B
MD59ca3582f410c90fad1d369d56cf556c5
SHA11399be7f86852597104a25f92b514971d081b16a
SHA256058533da1ee4dfdf5bb342361cf8ec2d79d6512aa59e1c1390f1a47dcee5cd34
SHA512a2bf62697a24d9dd813bbe2c12cfa29bece1e657c862fa440770ea78d21b78f2bbdd3a4a72ff1f6a9fcb6eb3ac1acc77b6fa75a67dea04567bea0d257e292fce
-
C:\Users\Admin\AppData\Local\Temp\2A8GiKSbxVv3.batFilesize
205B
MD5450293081f9e85544e785a93318d2290
SHA15768371570fb29606bdf3c2f941d2a9f940cf41e
SHA25652ed7148362e31d04a98ec0248bafe57274f81fee7d1849efbd383bea6b7c177
SHA51292fb338836288e50449ea427442315cb70dd952124526f4b4a5032b304229b461af2d4e2316b16cf9db975187f4d8d2a009f8059c6964c68a3d2b18f65afe65f
-
C:\Users\Admin\AppData\Local\Temp\2pD8PgU4uFoE.batFilesize
205B
MD529519a20b5e665bbf610648916f43a93
SHA19a9af42dc1dd00f6b33ff4aeb97d3a31b1a114e8
SHA256a68ea1917ffdaa31f45c13df99ceb39a99af63a91c43f5067071dae7a9f6fbdb
SHA512920ced7742c2100a2bba44b2785a14a8d6ad54e68f4e9a8bd695baf05d90b6a0c2bfb5b8c1df20a55e5e7aa9c0af409df35f364f540e669970b4e735a8819b50
-
C:\Users\Admin\AppData\Local\Temp\2xVz43aiR2wC.batFilesize
205B
MD5e7d1b2cf7d6042374eddd195107c6b91
SHA1b08bf6d7b2905efc024c0dc6b8a7b07dcc6f525a
SHA25690a524ef43603a120275371fc29b497027f732351ddda9f146d730f3859453e0
SHA512dd101f3b00316ab417d94b22e3223db2858a71cba580a259f681a11ecf05dbde05d59112e77055af8a0a402736aed43b918b306f38d1e04af6c63437c798d3c4
-
C:\Users\Admin\AppData\Local\Temp\30oqtRYFz11V.batFilesize
205B
MD5e99fd5a43e9aa938e166de8c946008b7
SHA1a6b0f10f9a3d04d0d61096574fcd58aed7f298e5
SHA2563f46949e792e42d38e8a1672a8b29cce830914b563aa25b54662284b15d85651
SHA5126a7b682d71d03eb3bd500a96bdfef69b2d0ee87f44fd370b994b868ac345afe1e849e3dde52a16167fa9fa834d1367e90f37dbcc43b206029084ab2367a0542b
-
C:\Users\Admin\AppData\Local\Temp\3jfL4yKgvbXq.batFilesize
205B
MD5f9f90f6ad9696b10c388c64c6fd69add
SHA10da831f51570465c1b3e01f474f623887f48b3e6
SHA256e6ae641f68f0cfedd2a01502a53f2063a3a0e0ddba9e2bde9307eef77e1dab4e
SHA51202aa24b0e9724f6ed4a99c8a350cd85ce9d400b7a95d78aa1828c8306461e1e9fb4732254a32fd44856fc6777fb8ed11988ead799a42c45f17e75b3896e145c1
-
C:\Users\Admin\AppData\Local\Temp\6FHFgSlr0aNb.batFilesize
205B
MD54f65d6331b8e07934a1cd00639ac56df
SHA1d33093b85ddaad0cecc6f8f4003631ea9cd0a218
SHA2561b6d91c6b384df1538e11865cfd87be4f76169172702a9c91bcc502c9e0669d6
SHA512b04cb7a238b099c01cfa2f610f33ec01a06bfa9f4ce707c87511e8c2c3f336e5a51ba07b2aca96381efac4d18a450e0fba2b7d13b7bd377c38c2cbf1264a06b6
-
C:\Users\Admin\AppData\Local\Temp\9q0bx6DmycN1.batFilesize
205B
MD59d3e1ba080d6b7e0e59e8a053c5498c6
SHA10d686d19e3d3cc71824d9a512bbf8200292438e1
SHA256839745d812ae6cce110076c628e3c6ce685601bf83d13560a7f0858b0c1bc93e
SHA512ca346dd20f44ad27bb36cdae9c67ed8c60a9c967c3a3bbad3c2c73ce0798398ffd6fe6ee50fc463e523b969fcd62fb8be273f7643c2c1f9e284c11c67f897b55
-
C:\Users\Admin\AppData\Local\Temp\EiHdqpdudY8J.batFilesize
205B
MD518a28ae12a013791a35134d12b13498e
SHA1de738a6303daf6da43ad27455c9603b899cedbfd
SHA256f9302d4a3eac314056fa72097daef969190f767dec60c5e3f5dfff1439c4985d
SHA51238126fd0cbd371d67debfeb9d13886a2d9a9fe7816f0aa4fd930a8895e971b13e987430742e4bef3e616ec9211e46078cb67a82e02f3d4b4c8fd5dee745595b7
-
C:\Users\Admin\AppData\Local\Temp\FRqNrAv7ugOo.batFilesize
205B
MD515e83e351b011c9a786a9c89135d4a48
SHA13c3efae0c105ed4025fc41404ac5e8a279843230
SHA256f5fdff099e26e9754fe07e1ee92a20e99ea769fc49fbb931db3beb779e7e8f01
SHA512f09e0a97a0f3e43dada30a7835a4192c04342a95fb11881d0cd127779ea4d7ea2e4287f259cd5bb5eb8e581905a4ca6737143cbb00548cbf1044c72d125422c1
-
C:\Users\Admin\AppData\Local\Temp\IJAs2HZRWp2O.batFilesize
205B
MD5541162fd8200dd98a07a0e1b98cbb187
SHA124ce495c42b214ba15461141be9ee51fe7cf4e77
SHA256317fefc3fc300b4537104ccb613e77d0ca79f199842d5a0b357baff8917a931a
SHA512d4f2b5d263c3a8240f00da45ffe9500849f321c58c37e7040f5e8feaa25ca57780d433a4448d38ab621ab8545912b6f2505e13e2010bca49a1a16fc8fabf62be
-
C:\Users\Admin\AppData\Local\Temp\Jto4Tov1FOoB.batFilesize
205B
MD542bd1a423877d1092e416c2cded700b4
SHA1f39a81acd95464a3a3744082483f4c32dfd221d5
SHA256289294b3e009b0d6d7695c830017b2e694fe93466c56c96b6986c79a33025bfe
SHA512b7a3a14575b8e9e801e42e3e8d95dcdcb91e1d068858a5247a75b7e7059d2c799f2da13bac3f7f5560612dc73ec19610fa85596709cd228ece15431cf1d9ab8d
-
C:\Users\Admin\AppData\Local\Temp\K4Qbl0rDtpM9.batFilesize
205B
MD56d430b017c9796d7873eeccb864debc1
SHA18f3722e7da1296965c70c386fade7bf288029576
SHA256c8a5f9f110b0a00f1ca49d80ad6d9b720bdb3949f6562f3117da0cc4a8feac59
SHA512d479048491e0abd09012aece1a0be5a1ccf8782eba9a3273c3ecab6423a012efaac488284c07adfc9fd8550857ed788d21b6a31891e1c09c64658b01363d8f0c
-
C:\Users\Admin\AppData\Local\Temp\Krngi2Qy14AF.batFilesize
205B
MD5136ecd6c859aa305136b2d4ff95bd87c
SHA104fbc1d63d2e163f9b17116bc18e8d92f7264f21
SHA256cb1a2971710ee86e38dec8b1b0c4bab82587560bd06367bdd60d24c51fb4933a
SHA512f4db92ec3c7f386407a739998bd8f4e517b07229f6f8bf1b4f819dd7a749bdd039a13b83afc5a985bac2c787a29ee2b54689151083c118e3438417bc4a90f845
-
C:\Users\Admin\AppData\Local\Temp\Lmnr070Iz6WG.batFilesize
205B
MD5b1d41891d360bdc7513b78295a6f652e
SHA15c32da4e22a2c5a45fe445ef0348ccdb71bd25d8
SHA2569e2dd2a00bc05a82c71bf740bb4b4f744f84969e93d5e82b2d1fea45d4a89241
SHA5123b30329fc85056e5102fd3cab076f071305e1eb9e8c3881e8b598a48cb01cc13b0295140ae14ac208f0fe0383de05e7489cee719cb4da36acd5f99603bd0011c
-
C:\Users\Admin\AppData\Local\Temp\Qj9zovuSevqD.batFilesize
205B
MD535da6597fcc7bdbbb234f57706215dae
SHA1e90723cff6343852f50e2186edee4b1659912d4d
SHA2568f17cbc495f47c2ed40f8b2647b88aeef73c41ebbf61032d2351a1a15306a579
SHA512b5e05f87e05a0b1e90ae872d583c43c79a2d9bd6601fa344f4e7cea75c91d2fe29cbe43e90fd480f1353b7a43615eb20d311c6f85126d0d108fdb604af0eb9bc
-
C:\Users\Admin\AppData\Local\Temp\Sd6SNzaPsBfm.batFilesize
205B
MD594b098ef1d6940dfdd5116ff95b86faa
SHA1cc63e7ab3a8202191d09fb0bfb1dd1eae8d681c6
SHA256fb58a9710239aedc54ce3a4a570fb0a75e44b0551fb961585915544eff6555a6
SHA512e44db6653beccca2c3b4f5c3e939949eddd3dcc944593b4740e18552b6237d1b0f0806e2a42cdc40673565c4a973852a619633fed280fca971baf4c8cb9974fe
-
C:\Users\Admin\AppData\Local\Temp\UrLjQw7PbOtj.batFilesize
205B
MD5513ec1cb418d2ad1f73404b629d0fccf
SHA1453ef6429bfc8a724bf8b3603f7a44af9340bce3
SHA256053b35aa4443bd48d546e3f2d38111e4a461a8039e79520bf122caf36fe52ae8
SHA51239a7208340c044e59dc374771d159f1fa16ccb3c6abb1ea9236dc0d5628e3c9fcb57ab9b806f747e55742f88330df028f079255b577cb846d730dd1bb1a403ed
-
C:\Users\Admin\AppData\Local\Temp\dQBS7C3n1I4d.batFilesize
205B
MD532e7913eaf235a890d61af3026a04b03
SHA1a43110e5c2cdacae1fd0585d75de9c08ab590345
SHA256d7c6f11ceef3c57ab4a657b0ed30d2deb8633f7668044d206b500fb9d1f99d85
SHA512080438cdffd79133e3722b83593fac59011e30df583f4179437288aef7e9031b228edb0da982b696ca3e53dfd7f662ffa20f5dfc1eb34eef11c995eb1f4b6bf4
-
C:\Users\Admin\AppData\Local\Temp\ebkNEelodBJM.batFilesize
205B
MD556bfdd0ded781aa4cefab31da2515c97
SHA1e690a77946f9dc14f739df2b4f002f24ab2afe5e
SHA2569f447cf9cacecf924d62472fe01b8371c2de51596f08aab458dc018edd908c1c
SHA512758d6d37d3186bd96cc54f5d83867739bfa535687f08c9562447c55352b0ed612c78f5dbb6394de06d0ca5ddd7754bbbb3aa6b7c4bdad309857c3d007afa8708
-
C:\Users\Admin\AppData\Local\Temp\f9xyajHjF21d.batFilesize
205B
MD5f517984ffe37f322585b559bd60cd753
SHA16c8a31f9beff13a8c0e2307bd0794ea875acc105
SHA2568e1ba826755efb61e766962b050d0643bbbbb296a8829ead31edd5b7078a347d
SHA5127c6f82f2d4994a6a57d91123bc7ccf16831b584a62a9e842bafab3abef4a38c876edbd5c50ad7e0d14a0af29f089333ee455ce06c0d6fda6eb881bddb8cfaded
-
C:\Users\Admin\AppData\Local\Temp\hb048pTU8viV.batFilesize
205B
MD522508aefdd505142c7ce70fff9f33cdf
SHA19a6838322c912bc98e313047b6211668182d6738
SHA256f61bf2f4be11fc5b50b83dfd3912356023717cd611da2b0f9b35da7e09463e8b
SHA512d0d932fa0f84eb6feb7d17284955dc2c4dbc26fca4d29cf58b4516d725c67c48e7c414e4ad8c662805547ee9ab80e507901aeb31fd7fa1399734578cd1b8a43e
-
C:\Users\Admin\AppData\Local\Temp\hcPiycBcdUKK.batFilesize
205B
MD5cf532b60e44898b9d73c7d4043a4e4ea
SHA131cfeabd4864d3e59e2131f4ed962bf82cf01cc1
SHA256f68e9c95914e72d28469c162ff1132741e7e9315478890775515169420e86383
SHA512f7b2096698c484e8b143cf8413c92b22d06d6797faf8f183b420a7a040f3b45dcbf16d745a125e945038cfaff07c99734d44cf5655ab3abe28ea0806023afd89
-
C:\Users\Admin\AppData\Local\Temp\kCPUzbUs40F9.batFilesize
205B
MD58dc454d94d601206272971fccd645cb9
SHA1ff1ab91b2fa7f7bff9050150a69c34e1190132d6
SHA256d9795c4a17b2c70b004d90028bd71910e23bef786037d2823b4b331f61870111
SHA512168c5ca5ace6982136186e40eddc4f0cd617659992c6687d6cd821a26cb872b45a03cfa9c4cffdd9718db6664d6925311a9e904791bd64134a61170cc7527888
-
C:\Users\Admin\AppData\Local\Temp\kcFVql4Kvldq.batFilesize
205B
MD5a5477a55bbaf2040270d20f3d4333e08
SHA11d771fb7d00e0fd99b4b0361e4a8163d24ceefdb
SHA256314a03874918c7b0fd226c3597af62ff50fd43e3f1e056d966e27ee6eb48bd43
SHA512bb0fb4827cbb123b5e29ce29b66397a2c21102275e59cf8653cdb59fb1634f957dcd66bd98e917f5519300611fd8803d556463b0bd50f9418d14ca6d70051ed8
-
C:\Users\Admin\AppData\Local\Temp\lCE1GM8IDqqM.batFilesize
205B
MD54ff3073afdddbe75d86db549a16a1409
SHA11dd0655cf820a688e93f8967fa429eede5d602a4
SHA2564433e3c85c062b38e68b05fa5caa78dd6f4e50966a45e1f0666f1a345dfdc889
SHA512e8ded99a2ccfa386c1861d9c4a001b70cc54fbcaebc84f1e068fd93f30574f7b39935458a2d8252ead5358fbfbd42ee5a71175ed419c05969ca6edfe76812529
-
C:\Users\Admin\AppData\Local\Temp\lV0GXA5nDPB7.batFilesize
205B
MD572fb8ef06e9718f31fdd6a38967e796e
SHA1a45cd6b36f99fa8d70af11ef3b69cb47e4751d89
SHA2566f7e0083da909ec6a9dd55511dc48c277f99e3ed7eb4c5ff41c85a6b5ee1a9fe
SHA512d85e3695e205f00daae0853f7883da9808185cb41caf726df1a9597f7fa9018e991c6c5544e79b3ef6d3dc64cb490d49cd9b29d9d5775b5b258d10cb184524d2
-
C:\Users\Admin\AppData\Local\Temp\mZS0eif0PzkR.batFilesize
205B
MD5da463282abb4e654e62c60a90ce9a928
SHA1de4411eff4c43ab91e317cf40017284d3b008981
SHA256a61e1c9b6af38a8eadcc651166969d1c1d16101809e9225c9fb9db21be626e9d
SHA51227e64866b8cc47bfa030b796222047c95b26f270f05c29d99c125502a6dbf34857b949c2270687106ca409490de1f6d2f1076ed1453e742e43d8123754459d38
-
C:\Users\Admin\AppData\Local\Temp\olowI1h7bTDf.batFilesize
205B
MD5cb07e1fe0c26a6382efdfc8d8cd89508
SHA135e3eee2b2278d469895fd8145f7f1267958352c
SHA2566441c918ec0b606735253e41175914f2c76b06be657721571d37f12b4274fd38
SHA512dd529726b74bf34bb42825243150bdc5383d7a671ca617910cc65cd4cd1074bc8e51185dd2f2d29aa5049e1cad92f835c5b903f067bec9fde1b0c544a96c229e
-
C:\Users\Admin\AppData\Local\Temp\sq2LhdisfybH.batFilesize
205B
MD5608cff459723bea09a0eedb85e0eceaa
SHA1b0bd33c13bf17da5e04d090ee99a9af0ef3aa016
SHA2560300416fbb78efea4b28da404c8e32f9d08f3da3e02246215aa0ded3f5691dc6
SHA512d23c6337a626238ebf3be1d83f69c8aa88a5cfb4313b27922494fe26997f44b871e0cba34ff96c6e0caeef90d42346e6c7af5f7a5fbfb98243f9a9b99c2269fc
-
C:\Users\Admin\AppData\Local\Temp\uT8tkBMgXJVV.batFilesize
205B
MD5cf58bbfb68ac2f114cfacab4f80b5b11
SHA15ebb51e0280890bcba2e9042b36efc78e765df00
SHA256fffb109b7a5fb63690dfcc45fde6d3e9a9540e4fa5a9c871d6da5b854bc07982
SHA5121cfd252e82801be78dbd3144a0aad87ac4a7329ba36486a75fc36624a38cff4238db10bb3ac79744f77f069b4600970b0e78af51400492704c037880cdea8a65
-
C:\Users\Admin\AppData\Roaming\Celex\Celex.exeFilesize
3.1MB
MD5483d0a45f61e108b7a89c6707e138d62
SHA1da16e84ef741a6a82038468da5990b25e3bf751c
SHA25634bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
SHA5125c6da715cdafda98a37b6eaa455d5c12148b1048f5e038f9482d0f51f5e247cf75ff1c8439d3a75b6f674daa843a8ecd21aab23663b6bdd6bc7bac0fce606492
-
memory/3092-12-0x000000001BF50000-0x000000001BFA0000-memory.dmpFilesize
320KB
-
memory/3092-14-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/3092-13-0x000000001C060000-0x000000001C112000-memory.dmpFilesize
712KB
-
memory/3092-11-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/3092-10-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/3092-18-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/5016-0-0x00007FFCB5943000-0x00007FFCB5945000-memory.dmpFilesize
8KB
-
memory/5016-9-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/5016-2-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmpFilesize
10.8MB
-
memory/5016-1-0x00000000003A0000-0x00000000006C4000-memory.dmpFilesize
3.1MB