Analysis
- max time kernel
47s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
17/09/2024, 03:59
General
- Target 2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
- Size 58.2MB
- Sample240917-ekfx2atcrb
- SHA256 85b9128c0f0e79af0a37b838ab8d97bd8d2cb11a2362c22b694bc1c9ba27ca66
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
webmaster
-
Email to
Extracted
Family
-
raccoon
Botnet
-
2ca5558c9ec8037d24a611513d7bd076
C2
-
https://192.153.57.177:80
Attributes
-
user_agent
MrBidenNeverKnow
xor.plain
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 2 IoCs
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- ModiLoader Second Stage 2 IoCs
- XMRig Miner payload 21 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 9 IoCs
- UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 5 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 64 IoCs
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 27 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\!m.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\stopwatch.exestopwatch.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\anti.exeanti.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\screenscrew.exescreenscrew.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K fence.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shutdown.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im werfault.exe4⤵
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\timeout.exetimeout 303⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\PurchaseOrder.exePurchaseOrder.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\PurchaseOrder.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TESAYt.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TESAYt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp10F3.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cipher.execipher /k /h /e C:\Users\Admin\Desktop\*3⤵
-
-
C:\Windows\SysWOW64\cipher.execipher C:\Users\Admin\Desktop\*3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\doc.html3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd076446f8,0x7ffd07644708,0x7ffd076447184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,6490235603523734379,10347293732392244260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,6490235603523734379,10347293732392244260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\infected.html3⤵
- Manipulates Digital Signatures
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd076446f8,0x7ffd07644708,0x7ffd076447184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14616981213333545954,10951507062041195841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:14⤵
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\butdes.exebutdes.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-N5EEC.tmp\butdes.tmp"C:\Users\Admin\AppData\Local\Temp\is-N5EEC.tmp\butdes.tmp" /SL5="$20190,2719719,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\butdes.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\flydes.exeflydes.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-N5EED.tmp\flydes.tmp"C:\Users\Admin\AppData\Local\Temp\is-N5EED.tmp\flydes.tmp" /SL5="$20180,595662,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\flydes.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\i.exei.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\gx.exegx.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43D4AB08\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS43D4AB08\setup.exe --server-tracking-blob=MzY5Njg4ZTc1OTE1MjcyMTMxZmYwZTk4ODU3ZWE4Mjk0NjQ0Nzc5MjcxMWY4OGZhOThlNTU5YmNlNzA1NmJiOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9OTF9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD0wNTgwYWM0YWUyOTA0ZDA3ODNkOTQxNWE0NWRhZGFkYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRnJ1JTJGZ3glM0ZlZGl0aW9uJTNEc3RkLTIlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fTkxfVVZSXzM3MzYlMjZ1dG1fY29udGVudCUzRDM3MzZfJTI2dXRtX2lkJTNEMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9MDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmZGxfdG9rZW49NzAwOTYzNzgiLCJ0aW1lc3RhbXAiOiIxNzI1ODAyMjIzLjgwMDQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyOC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9VVlJfMzczNiIsImNvbnRlbnQiOiIzNzM2XyIsImlkIjoiMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0ODkyOGFmMC1jZDc3LTQ0NDctYTQyNy1kNzY5ODRmOGQ5NGMifQ==4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43D4AB08\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS43D4AB08\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x6e271b54,0x6e271b60,0x6e271b6c5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170400521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xbe4f48,0xbe4f58,0xbe4f646⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\bundle.exebundle.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\rckdck.exerckdck.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BCGL9.tmp\is-E3MH3.tmp"C:\Users\Admin\AppData\Local\Temp\is-BCGL9.tmp\is-E3MH3.tmp" /SL4 $30280 "C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\rckdck.exe" 6123423 527364⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\avg.exeavg.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\aj417C.exe"C:\Users\Admin\AppData\Local\Temp\aj417C.exe" /relaunch=8 /was_elevated=1 /tagdata4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\telamon.exetelamon.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B263M.tmp\telamon.tmp"C:\Users\Admin\AppData\Local\Temp\is-B263M.tmp\telamon.tmp" /SL5="$40208,1520969,918016,C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\telamon.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\~execwithresult.txt""5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe"C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe" --getuid6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\telamon.exe > "C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\~execwithresult.txt""5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe"C:\Users\Admin\AppData\Local\Temp\is-U5VU4.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\telamon.exe6⤵
-
-
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\gadget.msi"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K des.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\g_.exeg_.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\t.exet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\g.exeg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\e.exee.exe3⤵
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\GAB3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\Bootstraper.exeBootstraper.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SalaNses'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\SalaNses\soles.exe"C:\SalaNses\soles.exe"4⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\dng.html3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffd076446f8,0x7ffd07644708,0x7ffd076447184⤵
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K proxy.bat3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
-
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" "C:\GAB\5341.CompositeFont"3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\GAB\5341.ini3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\System32\fontview.exe" C:\GAB\5341.ttc3⤵
-
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\System32\fontview.exe" C:\GAB\5341.TTF3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\cobstrk.execobstrk.exe3⤵
-
C:\Windows\System\kyKbdwC.exeC:\Windows\System\kyKbdwC.exe4⤵
-
-
C:\Windows\System\HExiWLv.exeC:\Windows\System\HExiWLv.exe4⤵
-
-
C:\Windows\System\xYULzhJ.exeC:\Windows\System\xYULzhJ.exe4⤵
-
-
C:\Windows\System\TBXffzN.exeC:\Windows\System\TBXffzN.exe4⤵
-
-
C:\Windows\System\HRCUEGV.exeC:\Windows\System\HRCUEGV.exe4⤵
-
-
C:\Windows\System\vTRZgNy.exeC:\Windows\System\vTRZgNy.exe4⤵
-
-
C:\Windows\System\dFZIDLV.exeC:\Windows\System\dFZIDLV.exe4⤵
-
-
C:\Windows\System\WMtsTIn.exeC:\Windows\System\WMtsTIn.exe4⤵
-
-
C:\Windows\System\idrvIOe.exeC:\Windows\System\idrvIOe.exe4⤵
-
-
C:\Windows\System\zZbmjyg.exeC:\Windows\System\zZbmjyg.exe4⤵
-
-
C:\Windows\System\PZKjspf.exeC:\Windows\System\PZKjspf.exe4⤵
-
-
C:\Windows\System\TJmnsym.exeC:\Windows\System\TJmnsym.exe4⤵
-
-
C:\Windows\System\UXDnxCY.exeC:\Windows\System\UXDnxCY.exe4⤵
-
-
C:\Windows\System\RAUUDKE.exeC:\Windows\System\RAUUDKE.exe4⤵
-
-
C:\Windows\System\SxHSNYm.exeC:\Windows\System\SxHSNYm.exe4⤵
-
-
C:\Windows\System\jcAFavo.exeC:\Windows\System\jcAFavo.exe4⤵
-
-
C:\Windows\System\SphpHXa.exeC:\Windows\System\SphpHXa.exe4⤵
-
-
C:\Windows\System\lUdHbTQ.exeC:\Windows\System\lUdHbTQ.exe4⤵
-
-
C:\Windows\System\DShqCku.exeC:\Windows\System\DShqCku.exe4⤵
-
-
C:\Windows\System\ryfmKnC.exeC:\Windows\System\ryfmKnC.exe4⤵
-
-
C:\Windows\System\rdlqQeq.exeC:\Windows\System\rdlqQeq.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\jaf.exejaf.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_80be5927fd12a2f3b00f8d66b0fb91b7_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_dd7d90ca-b2ac-44db-8555-4013d9ea4aee\file.exefile.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
-
C:\Windows\system32\efsui.exeefsui.exe /efs /keybackup1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x1501⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
5341.CompositeFont
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.TTF
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.fon
5341.ttc
5341.ttc
5341.ttc
soles.exe
070E0202839D9D67350CD2613E78E416
070E0202839D9D67350CD2613E78E416
powershell.exe.log
settings.dat
settings.dat
the-real-index
Network Persistent State
Preferences
Preferences
Preferences
CURRENT
Local State
Local State
Local State
Local State
StartupProfileData-NonInteractive
additional_file0.tmp
setup.exe
!m.bat
PurchaseOrder.exe
anti.exe
avg.exe
bundle.exe
butdes.exe
code.js
doc.html
download.jpg
favicon.ico
fence.bat
flydes.exe
fries.jpg
gx.exe
i.exe
images.jpg
infected.html
nuggets.webp
rckdck.exe
screenscrew.exe
stopwatch.exe
Opera_installer_2409170400521915448.dll
__PSScriptPolicyTest_2gjp2jd2.qer.ps1
is-E3MH3.tmp
butdes.tmp
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
Midex.dll
StdUtils.dll
jsis.dll
nsJSON.dll
thirdparty.dll
tmp10F3.tmp
49C9F4ED921B64155E77B3A77C940518B9338E5B
kyKbdwC.exe
memory/336-345-0x0000000000400000-0x0000000000414000-memory.dmp
memory/336-471-0x0000000000400000-0x0000000000414000-memory.dmp
memory/928-69-0x0000000074570000-0x0000000074D20000-memory.dmp
memory/928-73-0x0000000005530000-0x00000000055CC000-memory.dmp
memory/928-81-0x0000000074570000-0x0000000074D20000-memory.dmp
memory/928-72-0x0000000000B00000-0x0000000000CF2000-memory.dmp
memory/928-75-0x0000000005670000-0x0000000005702000-memory.dmp
memory/928-77-0x0000000005860000-0x00000000058B6000-memory.dmp
memory/928-76-0x0000000005650000-0x000000000565A000-memory.dmp
memory/1336-612-0x00007FF730FD0000-0x00007FF730FF7000-memory.dmp
memory/1580-347-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1580-472-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1768-2449-0x00007FF77ACF0000-0x00007FF77B041000-memory.dmp
memory/1776-2400-0x00007FF77A430000-0x00007FF77A781000-memory.dmp
memory/1776-2493-0x00007FF77A430000-0x00007FF77A781000-memory.dmp
memory/2504-458-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2504-1071-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2700-2446-0x00007FF795C60000-0x00007FF795FB1000-memory.dmp
memory/2860-469-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/3224-625-0x00007FF6C7590000-0x00007FF6C75B6000-memory.dmp
memory/3420-374-0x00000000065A0000-0x0000000006622000-memory.dmp
memory/3420-88-0x0000000000280000-0x000000000036A000-memory.dmp
memory/3420-92-0x0000000006570000-0x0000000006580000-memory.dmp
memory/3476-2424-0x00007FF767860000-0x00007FF767BB1000-memory.dmp
memory/3532-83-0x0000000002060000-0x0000000002061000-memory.dmp
memory/3532-82-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3532-74-0x0000000002060000-0x0000000002061000-memory.dmp
memory/3628-613-0x00007FF7F4040000-0x00007FF7F4066000-memory.dmp
memory/3772-2441-0x00007FF651480000-0x00007FF6517D1000-memory.dmp
memory/3796-610-0x00007FF7A9D50000-0x00007FF7A9D79000-memory.dmp
memory/3796-1097-0x00007FF7A9D50000-0x00007FF7A9D79000-memory.dmp
memory/4012-2421-0x00007FF742490000-0x00007FF7427E1000-memory.dmp
memory/4148-2496-0x00007FF75CE80000-0x00007FF75D1D1000-memory.dmp
memory/4148-2430-0x00007FF75CE80000-0x00007FF75D1D1000-memory.dmp
memory/4200-2490-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4200-2348-0x0000000000400000-0x0000000000451000-memory.dmp
memory/4228-473-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/4276-2419-0x00007FF7378A0000-0x00007FF737BF1000-memory.dmp
memory/4276-2492-0x00007FF7378A0000-0x00007FF737BF1000-memory.dmp
memory/4308-474-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/4388-2447-0x00007FF6DCC90000-0x00007FF6DCFE1000-memory.dmp
memory/4540-2448-0x00007FF717590000-0x00007FF7178E1000-memory.dmp
memory/4604-1-0x00000000008A0000-0x00000000008EA000-memory.dmp
memory/4604-79-0x000000007457E000-0x000000007457F000-memory.dmp
memory/4604-4-0x0000000005940000-0x0000000005EE4000-memory.dmp
memory/4604-2-0x0000000005240000-0x0000000005264000-memory.dmp
memory/4604-80-0x0000000074570000-0x0000000074D20000-memory.dmp
memory/4604-0-0x000000007457E000-0x000000007457F000-memory.dmp
memory/4604-3-0x0000000074570000-0x0000000074D20000-memory.dmp
memory/4604-2362-0x0000000074570000-0x0000000074D20000-memory.dmp
memory/4872-1346-0x0000000000EF0000-0x00000000012AB000-memory.dmp
memory/4872-1201-0x0000000000EF0000-0x00000000012AB000-memory.dmp
memory/5392-438-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/5392-435-0x0000000007170000-0x0000000007181000-memory.dmp
memory/5392-407-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/5392-419-0x0000000006DD0000-0x0000000006DEE000-memory.dmp
memory/5392-408-0x0000000006DF0000-0x0000000006E22000-memory.dmp
memory/5392-409-0x0000000070850000-0x000000007089C000-memory.dmp
memory/5392-406-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/5392-436-0x00000000071A0000-0x00000000071AE000-memory.dmp
memory/5392-420-0x0000000006E40000-0x0000000006EE3000-memory.dmp
memory/5392-439-0x0000000007290000-0x0000000007298000-memory.dmp
memory/5468-2367-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/5660-636-0x0000000000450000-0x000000000046C000-memory.dmp
memory/5660-842-0x00000000094F0000-0x0000000009528000-memory.dmp
memory/5660-843-0x00000000094B0000-0x00000000094BE000-memory.dmp
memory/5660-841-0x0000000005A50000-0x0000000005A58000-memory.dmp
memory/5816-431-0x00000000073D0000-0x0000000007A4A000-memory.dmp
memory/5816-379-0x0000000000CD0000-0x0000000000D06000-memory.dmp
memory/5816-433-0x0000000006E00000-0x0000000006E0A000-memory.dmp
memory/5816-396-0x0000000005440000-0x0000000005794000-memory.dmp
memory/5816-432-0x0000000006D90000-0x0000000006DAA000-memory.dmp
memory/5816-437-0x0000000006FD0000-0x0000000006FE4000-memory.dmp
memory/5816-384-0x0000000004AA0000-0x0000000004AC2000-memory.dmp
memory/5816-385-0x0000000004B40000-0x0000000004BA6000-memory.dmp
memory/5816-386-0x0000000004BB0000-0x0000000004C16000-memory.dmp
memory/5816-381-0x0000000004C50000-0x0000000005278000-memory.dmp
memory/5816-421-0x0000000070850000-0x000000007089C000-memory.dmp
memory/5816-434-0x0000000007010000-0x00000000070A6000-memory.dmp
memory/5900-382-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5900-447-0x0000000006A20000-0x0000000006A70000-memory.dmp
memory/5924-2451-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp
memory/6116-2444-0x00007FF7EBC30000-0x00007FF7EBF81000-memory.dmp
memory/6252-2357-0x0000000004AB0000-0x0000000004B92000-memory.dmp
memory/6252-2350-0x0000000000020000-0x00000000001C2000-memory.dmp
memory/6252-2358-0x0000000004B90000-0x0000000004BB2000-memory.dmp
memory/6300-2442-0x00007FF6933C0000-0x00007FF693711000-memory.dmp
memory/6376-2491-0x00007FF67CC80000-0x00007FF67CFD1000-memory.dmp
memory/6376-2382-0x00007FF67CC80000-0x00007FF67CFD1000-memory.dmp
memory/6428-2440-0x00007FF766030000-0x00007FF766381000-memory.dmp
memory/6448-2428-0x00007FF607BD0000-0x00007FF607F21000-memory.dmp
memory/6448-2495-0x00007FF607BD0000-0x00007FF607F21000-memory.dmp
memory/6488-2443-0x00007FF693BE0000-0x00007FF693F31000-memory.dmp
memory/6632-2494-0x00007FF69BE30000-0x00007FF69C181000-memory.dmp
memory/6632-2414-0x00007FF69BE30000-0x00007FF69C181000-memory.dmp
memory/6692-2445-0x00007FF6C2F70000-0x00007FF6C32C1000-memory.dmp
memory/6860-2427-0x00007FF77C2E0000-0x00007FF77C631000-memory.dmp
memory/6948-2363-0x0000026D462B0000-0x0000026D462C0000-memory.dmp
memory/6948-2489-0x00007FF7714B0000-0x00007FF771801000-memory.dmp
memory/6948-2347-0x00007FF7714B0000-0x00007FF771801000-memory.dmp
memory/6952-1158-0x0000000065E70000-0x0000000065EBC000-memory.dmp
memory/6960-1187-0x0000000065E70000-0x0000000065EBC000-memory.dmp
memory/6968-1268-0x0000000007C70000-0x0000000007C84000-memory.dmp
memory/6968-862-0x0000000006080000-0x00000000063D4000-memory.dmp
memory/6968-1148-0x0000000065E70000-0x0000000065EBC000-memory.dmp
memory/6968-1159-0x0000000007980000-0x0000000007A23000-memory.dmp
memory/6968-1219-0x0000000007C30000-0x0000000007C41000-memory.dmp
memory/6968-1084-0x0000000006720000-0x000000000676C000-memory.dmp
memory/6992-2361-0x0000000000400000-0x0000000000416000-memory.dmp
memory/6992-2359-0x0000000000400000-0x0000000000416000-memory.dmp
memory/7060-2450-0x00007FF751050000-0x00007FF7513A1000-memory.dmp