Analysis
-
max time kernel
151s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 14:03
General
-
Target
INVOICE-099990.exe
-
Size
600KB
-
MD5
0a73075a58f055c2af0403ee35887b65
-
SHA1
c1b30a2d00436ff430153a80adf64b0c0005d774
-
SHA256
a8f2984d5f05f009985afc0368ed1203380b3df4676996140a57011365108aac
-
SHA512
59e8af8503822bb5ef0d04ada0a1d0b3c08f5cc74878d64e26457db2757e759dc47ff8329e2612d610ac2fc35fd6fb57435620b74733e8a565f7b20f24201cb1
Score
5/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 169 IoCs
-
Suspicious use of WriteProcessMemory 1322 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\00cff45d83b14c1088dbafa677647693.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\00cff45d83b14c1088dbafa677647693.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"8⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"9⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"10⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"11⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"12⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"13⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"14⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"15⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"16⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"17⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"18⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"19⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"20⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"21⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"22⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"23⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"24⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"25⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"26⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"27⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"28⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"29⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"30⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"31⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"32⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"33⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"34⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"35⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"36⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"37⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"38⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"39⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"40⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"41⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"42⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"43⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"44⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"45⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"46⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"47⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"48⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"49⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"50⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"51⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"52⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"53⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"54⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"64⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE-099990.exe"147⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\00cff45d83b14c1088dbafa677647693.xmlMD5
a035055e1c80bc652520df45650c690f
SHA137b8364ad46e17199eb5a7ee89bb506bba384adb
SHA2562b9948d34674d0fc0f9cb290da8298441b56205f6e341e3cfa1954df42c2b655
SHA512678279d1bfc8a71c27a5a2c3afa5fd266882a62610863a3e4ebc2489f17827ed4c680c89e6b8b52621320500294d2df9888259ccdc5d38def43e739c1f325fc1
-
memory/268-55-0x0000000000000000-mapping.dmp
-
memory/272-30-0x0000000000000000-mapping.dmp
-
memory/304-45-0x0000000000000000-mapping.dmp
-
memory/328-33-0x0000000000000000-mapping.dmp
-
memory/332-9-0x0000000000000000-mapping.dmp
-
memory/344-40-0x0000000000000000-mapping.dmp
-
memory/364-39-0x0000000000000000-mapping.dmp
-
memory/388-20-0x0000000000000000-mapping.dmp
-
memory/472-65-0x0000000000000000-mapping.dmp
-
memory/472-15-0x0000000000000000-mapping.dmp
-
memory/528-52-0x0000000000000000-mapping.dmp
-
memory/556-10-0x0000000000000000-mapping.dmp
-
memory/580-31-0x0000000000000000-mapping.dmp
-
memory/600-21-0x0000000000000000-mapping.dmp
-
memory/744-11-0x0000000000000000-mapping.dmp
-
memory/744-60-0x0000000000000000-mapping.dmp
-
memory/820-44-0x0000000000000000-mapping.dmp
-
memory/836-17-0x0000000000000000-mapping.dmp
-
memory/836-67-0x0000000000000000-mapping.dmp
-
memory/864-14-0x0000000000000000-mapping.dmp
-
memory/872-53-0x0000000000000000-mapping.dmp
-
memory/916-61-0x0000000000000000-mapping.dmp
-
memory/964-12-0x0000000000000000-mapping.dmp
-
memory/964-34-0x0000000000000000-mapping.dmp
-
memory/1012-18-0x0000000000000000-mapping.dmp
-
memory/1020-66-0x0000000000000000-mapping.dmp
-
memory/1020-16-0x0000000000000000-mapping.dmp
-
memory/1032-13-0x0000000000000000-mapping.dmp
-
memory/1032-35-0x0000000000000000-mapping.dmp
-
memory/1096-8-0x0000000000000000-mapping.dmp
-
memory/1104-43-0x0000000000000000-mapping.dmp
-
memory/1120-58-0x0000000000000000-mapping.dmp
-
memory/1196-64-0x0000000000000000-mapping.dmp
-
memory/1196-37-0x0000000000000000-mapping.dmp
-
memory/1324-57-0x0000000000000000-mapping.dmp
-
memory/1460-59-0x0000000000000000-mapping.dmp
-
memory/1460-32-0x0000000000000000-mapping.dmp
-
memory/1464-36-0x0000000000000000-mapping.dmp
-
memory/1464-63-0x0000000000000000-mapping.dmp
-
memory/1468-56-0x0000000000000000-mapping.dmp
-
memory/1500-62-0x0000000000000000-mapping.dmp
-
memory/1572-23-0x0000000000000000-mapping.dmp
-
memory/1592-22-0x0000000000000000-mapping.dmp
-
memory/1616-51-0x0000000000000000-mapping.dmp
-
memory/1632-2-0x0000000076341000-0x0000000076343000-memory.dmpFilesize
8KB
-
memory/1636-54-0x0000000000000000-mapping.dmp
-
memory/1664-7-0x0000000000000000-mapping.dmp
-
memory/1692-46-0x0000000000000000-mapping.dmp
-
memory/1700-48-0x0000000000000000-mapping.dmp
-
memory/1704-28-0x0000000000000000-mapping.dmp
-
memory/1712-26-0x0000000000000000-mapping.dmp
-
memory/1712-4-0x0000000000000000-mapping.dmp
-
memory/1756-49-0x0000000000000000-mapping.dmp
-
memory/1760-27-0x0000000000000000-mapping.dmp
-
memory/1772-3-0x0000000000000000-mapping.dmp
-
memory/1772-50-0x0000000000000000-mapping.dmp
-
memory/1776-47-0x0000000000000000-mapping.dmp
-
memory/1780-29-0x0000000000000000-mapping.dmp
-
memory/1784-24-0x0000000000000000-mapping.dmp
-
memory/1816-6-0x0000000000000000-mapping.dmp
-
memory/1820-41-0x0000000000000000-mapping.dmp
-
memory/1824-19-0x0000000000000000-mapping.dmp
-
memory/1880-25-0x0000000000000000-mapping.dmp
-
memory/1944-42-0x0000000000000000-mapping.dmp
-
memory/1984-38-0x0000000000000000-mapping.dmp