Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 13:54
General
-
Target
000000090000-0990.exe
-
Size
1.5MB
-
MD5
dca3732857d10782f68df4c3e1b757a9
-
SHA1
95a0c95fee10a8e37fb0bcabff6e4b10924285d2
-
SHA256
c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363
-
SHA512
5ada13a7e67d59e38d57fccddac36cad71d2ccfff45945cc1274d310ecf4a79f756e865526a1d9d672d6200d0ae4215e5b7754b0b29e88debb5f9db873154ea0
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"8⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"9⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"10⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"11⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"12⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"13⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"14⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"15⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"16⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"17⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"18⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"19⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"20⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"21⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"22⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"23⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"24⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"25⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"26⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"27⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"28⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"29⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"30⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"31⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"32⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"33⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"34⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"35⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"36⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"37⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"38⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"39⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"40⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"41⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"42⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"43⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"44⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"45⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"46⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"47⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"48⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"49⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"50⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"51⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"52⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"53⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"54⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"55⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"56⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"57⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"58⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"59⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"60⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"61⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"62⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"63⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"64⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"145⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xmlMD5
a035055e1c80bc652520df45650c690f
SHA137b8364ad46e17199eb5a7ee89bb506bba384adb
SHA2562b9948d34674d0fc0f9cb290da8298441b56205f6e341e3cfa1954df42c2b655
SHA512678279d1bfc8a71c27a5a2c3afa5fd266882a62610863a3e4ebc2489f17827ed4c680c89e6b8b52621320500294d2df9888259ccdc5d38def43e739c1f325fc1
-
memory/112-54-0x0000000000000000-mapping.dmp
-
memory/272-27-0x0000000000000000-mapping.dmp
-
memory/316-46-0x0000000000000000-mapping.dmp
-
memory/360-30-0x0000000000000000-mapping.dmp
-
memory/368-53-0x0000000000000000-mapping.dmp
-
memory/432-52-0x0000000000000000-mapping.dmp
-
memory/544-59-0x0000000000000000-mapping.dmp
-
memory/560-62-0x0000000000000000-mapping.dmp
-
memory/564-16-0x0000000000000000-mapping.dmp
-
memory/572-11-0x0000000000000000-mapping.dmp
-
memory/632-10-0x0000000000000000-mapping.dmp
-
memory/656-20-0x0000000000000000-mapping.dmp
-
memory/668-65-0x0000000000000000-mapping.dmp
-
memory/668-18-0x0000000000000000-mapping.dmp
-
memory/760-41-0x0000000000000000-mapping.dmp
-
memory/792-7-0x0000000000000000-mapping.dmp
-
memory/800-29-0x0000000000000000-mapping.dmp
-
memory/820-56-0x0000000000000000-mapping.dmp
-
memory/848-33-0x0000000000000000-mapping.dmp
-
memory/884-63-0x0000000000000000-mapping.dmp
-
memory/916-50-0x0000000000000000-mapping.dmp
-
memory/924-35-0x0000000000000000-mapping.dmp
-
memory/928-58-0x0000000000000000-mapping.dmp
-
memory/936-34-0x0000000000000000-mapping.dmp
-
memory/940-31-0x0000000000000000-mapping.dmp
-
memory/956-55-0x0000000000000000-mapping.dmp
-
memory/972-13-0x0000000000000000-mapping.dmp
-
memory/980-9-0x0000000000000000-mapping.dmp
-
memory/1052-61-0x0000000000000000-mapping.dmp
-
memory/1052-15-0x0000000000000000-mapping.dmp
-
memory/1080-51-0x0000000000000000-mapping.dmp
-
memory/1088-43-0x0000000000000000-mapping.dmp
-
memory/1104-38-0x0000000000000000-mapping.dmp
-
memory/1172-17-0x0000000000000000-mapping.dmp
-
memory/1172-64-0x0000000000000000-mapping.dmp
-
memory/1200-8-0x0000000000000000-mapping.dmp
-
memory/1252-37-0x0000000000000000-mapping.dmp
-
memory/1256-48-0x0000000000000000-mapping.dmp
-
memory/1356-12-0x0000000000000000-mapping.dmp
-
memory/1444-36-0x0000000000000000-mapping.dmp
-
memory/1484-32-0x0000000000000000-mapping.dmp
-
memory/1520-49-0x0000000000000000-mapping.dmp
-
memory/1536-57-0x0000000000000000-mapping.dmp
-
memory/1540-26-0x0000000000000000-mapping.dmp
-
memory/1552-45-0x0000000000000000-mapping.dmp
-
memory/1572-4-0x0000000000000000-mapping.dmp
-
memory/1584-67-0x0000000000000000-mapping.dmp
-
memory/1604-24-0x0000000000000000-mapping.dmp
-
memory/1620-14-0x0000000000000000-mapping.dmp
-
memory/1664-60-0x0000000000000000-mapping.dmp
-
memory/1672-25-0x0000000000000000-mapping.dmp
-
memory/1676-2-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1692-6-0x0000000000000000-mapping.dmp
-
memory/1704-3-0x0000000000000000-mapping.dmp
-
memory/1708-47-0x0000000000000000-mapping.dmp
-
memory/1712-22-0x0000000000000000-mapping.dmp
-
memory/1716-44-0x0000000000000000-mapping.dmp
-
memory/1740-39-0x0000000000000000-mapping.dmp
-
memory/1780-23-0x0000000000000000-mapping.dmp
-
memory/1812-28-0x0000000000000000-mapping.dmp
-
memory/1824-40-0x0000000000000000-mapping.dmp
-
memory/1848-66-0x0000000000000000-mapping.dmp
-
memory/1848-19-0x0000000000000000-mapping.dmp
-
memory/1932-21-0x0000000000000000-mapping.dmp
-
memory/1948-42-0x0000000000000000-mapping.dmp