Analysis
-
max time kernel
104s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 02:45
Static task
static1
Behavioral task
behavioral1
Sample
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe
Resource
win10v2004-20221111-en
General
-
Target
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe
-
Size
273KB
-
MD5
8e3a84fe51240b2f9a1e981e153b9c57
-
SHA1
b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
-
SHA256
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
-
SHA512
8f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
SSDEEP
6144:CpGJ8Lk3B3oSvcjS4e0nCX4V7r/mezTyZM:CpGyo3B37Tw75z
Malware Config
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Extracted
redline
france
193.233.20.5:4136
-
auth_value
827023aa27bcc1cc2382e4d111feec6f
Signatures
-
Detect rhadamanthys stealer shellcode 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1928-207-0x0000000000550000-0x000000000056D000-memory.dmp family_rhadamanthys behavioral1/memory/2604-208-0x0000000000580000-0x000000000059D000-memory.dmp family_rhadamanthys behavioral1/memory/3984-209-0x00000000005C0000-0x00000000005DD000-memory.dmp family_rhadamanthys behavioral1/memory/2604-210-0x0000000002300000-0x0000000003300000-memory.dmp family_rhadamanthys behavioral1/memory/4172-215-0x00000000004C0000-0x00000000004DD000-memory.dmp family_rhadamanthys behavioral1/memory/2604-223-0x0000000000580000-0x000000000059D000-memory.dmp family_rhadamanthys -
Processes:
nika.exenika1.exelava.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
mnolyk.exenika.exelava.exenita1.exenita1.exenika1.exefranc1.exemnolyk.exemixo1.exetrebo1.exetrebo1.exetrebo1.exetrebo1.exemnolyk.exepid process 3492 mnolyk.exe 2132 nika.exe 4796 lava.exe 3380 nita1.exe 2912 nita1.exe 3704 nika1.exe 2816 franc1.exe 1792 mnolyk.exe 1224 mixo1.exe 2604 trebo1.exe 1928 trebo1.exe 3984 trebo1.exe 4172 trebo1.exe 936 mnolyk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4296 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
nika.exelava.exenika1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" lava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika1.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mnolyk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nita1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\nita1.exe" mnolyk.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
trebo1.exepid process 2604 trebo1.exe 2604 trebo1.exe 2604 trebo1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 51 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1860 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 100 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 1396 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 4796 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 1552 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 3112 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 4576 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 1160 2420 WerFault.exe 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe 1044 3492 WerFault.exe mnolyk.exe 3336 3492 WerFault.exe mnolyk.exe 1404 3492 WerFault.exe mnolyk.exe 2188 3492 WerFault.exe mnolyk.exe 4884 3492 WerFault.exe mnolyk.exe 3912 3492 WerFault.exe mnolyk.exe 4176 3492 WerFault.exe mnolyk.exe 1216 3492 WerFault.exe mnolyk.exe 2292 3492 WerFault.exe mnolyk.exe 4920 3492 WerFault.exe mnolyk.exe 2440 3492 WerFault.exe mnolyk.exe 3692 3492 WerFault.exe mnolyk.exe 3244 3492 WerFault.exe mnolyk.exe 3136 3492 WerFault.exe mnolyk.exe 3172 3492 WerFault.exe mnolyk.exe 3860 3492 WerFault.exe mnolyk.exe 4432 3492 WerFault.exe mnolyk.exe 1424 3492 WerFault.exe mnolyk.exe 1904 3492 WerFault.exe mnolyk.exe 4008 3492 WerFault.exe mnolyk.exe 2420 3492 WerFault.exe mnolyk.exe 4332 3492 WerFault.exe mnolyk.exe 4284 3492 WerFault.exe mnolyk.exe 1452 3492 WerFault.exe mnolyk.exe 3452 3492 WerFault.exe mnolyk.exe 5064 3492 WerFault.exe mnolyk.exe 5044 3492 WerFault.exe mnolyk.exe 4572 3492 WerFault.exe mnolyk.exe 4900 3492 WerFault.exe mnolyk.exe 3952 3492 WerFault.exe mnolyk.exe 2244 3492 WerFault.exe mnolyk.exe 4320 3492 WerFault.exe mnolyk.exe 2044 3492 WerFault.exe mnolyk.exe 3136 3492 WerFault.exe mnolyk.exe 2104 1792 WerFault.exe mnolyk.exe 3228 3492 WerFault.exe mnolyk.exe 1132 3492 WerFault.exe mnolyk.exe 4332 3380 WerFault.exe nita1.exe 2844 2912 WerFault.exe nita1.exe 3996 1224 WerFault.exe mixo1.exe 1556 3492 WerFault.exe mnolyk.exe 1208 936 WerFault.exe mnolyk.exe 4604 3492 WerFault.exe mnolyk.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
trebo1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 trebo1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID trebo1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
nika.exelava.exenika1.exenita1.exefranc1.exenita1.exemixo1.exepid process 2132 nika.exe 2132 nika.exe 4796 lava.exe 4796 lava.exe 3704 nika1.exe 3704 nika1.exe 2912 nita1.exe 2816 franc1.exe 2912 nita1.exe 2816 franc1.exe 3380 nita1.exe 3380 nita1.exe 1224 mixo1.exe 1224 mixo1.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
nika.exelava.exenika1.exemixo1.exenita1.exenita1.exefranc1.exetrebo1.exedescription pid process Token: SeDebugPrivilege 2132 nika.exe Token: SeDebugPrivilege 4796 lava.exe Token: SeDebugPrivilege 3704 nika1.exe Token: SeDebugPrivilege 1224 mixo1.exe Token: SeDebugPrivilege 3380 nita1.exe Token: SeDebugPrivilege 2912 nita1.exe Token: SeDebugPrivilege 2816 franc1.exe Token: SeShutdownPrivilege 2604 trebo1.exe Token: SeCreatePagefilePrivilege 2604 trebo1.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exemnolyk.execmd.exedescription pid process target process PID 2420 wrote to memory of 3492 2420 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe mnolyk.exe PID 2420 wrote to memory of 3492 2420 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe mnolyk.exe PID 2420 wrote to memory of 3492 2420 1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe mnolyk.exe PID 3492 wrote to memory of 4224 3492 mnolyk.exe schtasks.exe PID 3492 wrote to memory of 4224 3492 mnolyk.exe schtasks.exe PID 3492 wrote to memory of 4224 3492 mnolyk.exe schtasks.exe PID 3492 wrote to memory of 3736 3492 mnolyk.exe cmd.exe PID 3492 wrote to memory of 3736 3492 mnolyk.exe cmd.exe PID 3492 wrote to memory of 3736 3492 mnolyk.exe cmd.exe PID 3736 wrote to memory of 808 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 808 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 808 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 4752 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 4752 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 4752 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 2856 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 2856 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 2856 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 2356 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 2356 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 2356 3736 cmd.exe cmd.exe PID 3736 wrote to memory of 3880 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 3880 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 3880 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 1784 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 1784 3736 cmd.exe cacls.exe PID 3736 wrote to memory of 1784 3736 cmd.exe cacls.exe PID 3492 wrote to memory of 2132 3492 mnolyk.exe nika.exe PID 3492 wrote to memory of 2132 3492 mnolyk.exe nika.exe PID 3492 wrote to memory of 4796 3492 mnolyk.exe lava.exe PID 3492 wrote to memory of 4796 3492 mnolyk.exe lava.exe PID 3492 wrote to memory of 3380 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 3380 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 3380 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 2912 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 2912 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 2912 3492 mnolyk.exe nita1.exe PID 3492 wrote to memory of 3704 3492 mnolyk.exe nika1.exe PID 3492 wrote to memory of 3704 3492 mnolyk.exe nika1.exe PID 3492 wrote to memory of 2816 3492 mnolyk.exe franc1.exe PID 3492 wrote to memory of 2816 3492 mnolyk.exe franc1.exe PID 3492 wrote to memory of 2816 3492 mnolyk.exe franc1.exe PID 3492 wrote to memory of 1224 3492 mnolyk.exe mixo1.exe PID 3492 wrote to memory of 1224 3492 mnolyk.exe mixo1.exe PID 3492 wrote to memory of 1224 3492 mnolyk.exe mixo1.exe PID 3492 wrote to memory of 2604 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 2604 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 2604 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 1928 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 1928 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 1928 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 3984 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 3984 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 3984 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 4172 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 4172 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 4172 3492 mnolyk.exe trebo1.exe PID 3492 wrote to memory of 4296 3492 mnolyk.exe rundll32.exe PID 3492 wrote to memory of 4296 3492 mnolyk.exe rundll32.exe PID 3492 wrote to memory of 4296 3492 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe"C:\Users\Admin\AppData\Local\Temp\1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 8802⤵
- Program crash
PID:1860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 9402⤵
- Program crash
PID:100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 9482⤵
- Program crash
PID:1396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 10882⤵
- Program crash
PID:4796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 10922⤵
- Program crash
PID:1552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 9402⤵
- Program crash
PID:3112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 11082⤵
- Program crash
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 5843⤵
- Program crash
PID:1044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 8963⤵
- Program crash
PID:3336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 9003⤵
- Program crash
PID:1404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 8963⤵
- Program crash
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 10043⤵
- Program crash
PID:4884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 8963⤵
- Program crash
PID:3912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 9603⤵
- Program crash
PID:4176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 9643⤵
- Program crash
PID:1216 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F3⤵
- Creates scheduled task(s)
PID:4224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 8843⤵
- Program crash
PID:2292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 6603⤵
- Program crash
PID:4920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:808
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"4⤵PID:4752
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E4⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2356
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"4⤵PID:3880
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E4⤵PID:1784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 6683⤵
- Program crash
PID:2440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 7843⤵
- Program crash
PID:3692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 6483⤵
- Program crash
PID:3244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 6203⤵
- Program crash
PID:3136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 14603⤵
- Program crash
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16043⤵
- Program crash
PID:3860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 12283⤵
- Program crash
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\1000002001\lava.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\lava.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16283⤵
- Program crash
PID:1424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16083⤵
- Program crash
PID:1904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 14723⤵
- Program crash
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exe"C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 12324⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16483⤵
- Program crash
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exe"C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 12324⤵
- Program crash
PID:2844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16163⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 15923⤵
- Program crash
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17083⤵
- Program crash
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1000007051\franc1.exe"C:\Users\Admin\AppData\Local\Temp\1000007051\franc1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 14843⤵
- Program crash
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16923⤵
- Program crash
PID:5064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16003⤵
- Program crash
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\1000009001\mixo1.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\mixo1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 12324⤵
- Program crash
PID:3996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 14723⤵
- Program crash
PID:4572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16003⤵
- Program crash
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17083⤵
- Program crash
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 14763⤵
- Program crash
PID:2244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17323⤵
- Program crash
PID:4320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16003⤵
- Program crash
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
PID:3984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17003⤵
- Program crash
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 16963⤵
- Program crash
PID:3228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17323⤵
- Program crash
PID:1132 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main3⤵
- Loads dropped DLL
PID:4296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 17323⤵
- Program crash
PID:1556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 10123⤵
- Program crash
PID:4604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 11282⤵
- Program crash
PID:1160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2420 -ip 24201⤵PID:3428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2420 -ip 24201⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2420 -ip 24201⤵PID:3860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2420 -ip 24201⤵PID:4256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2420 -ip 24201⤵PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2420 -ip 24201⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2420 -ip 24201⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2420 -ip 24201⤵PID:1148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3492 -ip 34921⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3492 -ip 34921⤵PID:2452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3492 -ip 34921⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3492 -ip 34921⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3492 -ip 34921⤵PID:3200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3492 -ip 34921⤵PID:3544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3492 -ip 34921⤵PID:2688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3492 -ip 34921⤵PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3492 -ip 34921⤵PID:1468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3492 -ip 34921⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3492 -ip 34921⤵PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3492 -ip 34921⤵PID:1712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3492 -ip 34921⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3492 -ip 34921⤵PID:3340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3492 -ip 34921⤵PID:4592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3492 -ip 34921⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3492 -ip 34921⤵PID:2096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3492 -ip 34921⤵PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3492 -ip 34921⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3492 -ip 34921⤵PID:4628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3492 -ip 34921⤵PID:2884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3492 -ip 34921⤵PID:2832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3492 -ip 34921⤵PID:2532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3492 -ip 34921⤵PID:2648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3492 -ip 34921⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3492 -ip 34921⤵PID:5100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3492 -ip 34921⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 3122⤵
- Program crash
PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3492 -ip 34921⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3492 -ip 34921⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3492 -ip 34921⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3492 -ip 34921⤵PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3492 -ip 34921⤵PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3492 -ip 34921⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3492 -ip 34921⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1792 -ip 17921⤵PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3492 -ip 34921⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3492 -ip 34921⤵PID:1424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3380 -ip 33801⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2912 -ip 29121⤵PID:1404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1224 -ip 12241⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3492 -ip 34921⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 3122⤵
- Program crash
PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 936 -ip 9361⤵PID:3280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3492 -ip 34921⤵PID:5076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nita1.exe.logFilesize
2KB
MD56280633c9acfd9ed67906bada1d0b408
SHA11183fe166d8a5d047137373857e8c41980548608
SHA2563d41d4ebf421ffe0784df18be73d2b0509f71f71c1e77aae8f42c0ebacae1c1c
SHA5127eb02593a335e2be440d07109e37e6714974e3b54f48ee4865d923f3bc08d0bac3492151c11086c8e2e0823f3fa68fb74818c964a3ba5c3289416977a9ee0980
-
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000002001\lava.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000002001\lava.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exeFilesize
336KB
MD5038622c6279b62272933d5e86e1056bb
SHA1d924ada192f407478ff86a2f826783ab92598f96
SHA256303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca
SHA512c818dac7d5f41df16df20d798310287f1e815d9ddf306d9c2e84b8c20decd33a6d47ef22737882d0c607aade28cd3d1a1bf749a4069c7a01c3552abfce245946
-
C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exeFilesize
336KB
MD5038622c6279b62272933d5e86e1056bb
SHA1d924ada192f407478ff86a2f826783ab92598f96
SHA256303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca
SHA512c818dac7d5f41df16df20d798310287f1e815d9ddf306d9c2e84b8c20decd33a6d47ef22737882d0c607aade28cd3d1a1bf749a4069c7a01c3552abfce245946
-
C:\Users\Admin\AppData\Local\Temp\1000004051\nita1.exeFilesize
336KB
MD5038622c6279b62272933d5e86e1056bb
SHA1d924ada192f407478ff86a2f826783ab92598f96
SHA256303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca
SHA512c818dac7d5f41df16df20d798310287f1e815d9ddf306d9c2e84b8c20decd33a6d47ef22737882d0c607aade28cd3d1a1bf749a4069c7a01c3552abfce245946
-
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000007051\franc1.exeFilesize
175KB
MD56991818e08082c4c140db502d2aff79f
SHA1020ee1da61473dcd090805343601c1ae3d265032
SHA256aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0
SHA5123f02448363aabe7515f1225a3291fb1fa0185ca78a302d70dd611b7f73b1b317a486eef61c2a7489a0d4e43301fa20c5fa48cb62d26f3e20d87aaeceb8a82d3e
-
C:\Users\Admin\AppData\Local\Temp\1000007051\franc1.exeFilesize
175KB
MD56991818e08082c4c140db502d2aff79f
SHA1020ee1da61473dcd090805343601c1ae3d265032
SHA256aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0
SHA5123f02448363aabe7515f1225a3291fb1fa0185ca78a302d70dd611b7f73b1b317a486eef61c2a7489a0d4e43301fa20c5fa48cb62d26f3e20d87aaeceb8a82d3e
-
C:\Users\Admin\AppData\Local\Temp\1000009001\mixo1.exeFilesize
335KB
MD5b7ea5c271f635f53950ed2d48eae93c8
SHA1bf481b864f56dadd2e88477b31e1939e79c71bcd
SHA25698458a338735a67e3315be9b7f8af1328d3d9018861ad46c8d57f1106c2f4b63
SHA51201c9353d27bec102aa052de1149b72f88ab2aed999185ac8b5ff136495d03b209236dc53d02336128ee2d7a63dc3293adb0b73375a7ec3ef32f2e8144bfaab75
-
C:\Users\Admin\AppData\Local\Temp\1000009001\mixo1.exeFilesize
335KB
MD5b7ea5c271f635f53950ed2d48eae93c8
SHA1bf481b864f56dadd2e88477b31e1939e79c71bcd
SHA25698458a338735a67e3315be9b7f8af1328d3d9018861ad46c8d57f1106c2f4b63
SHA51201c9353d27bec102aa052de1149b72f88ab2aed999185ac8b5ff136495d03b209236dc53d02336128ee2d7a63dc3293adb0b73375a7ec3ef32f2e8144bfaab75
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD58c5b3a2beac24f9a4878c50ce26c4623
SHA1e223a25b65a685c5be974ab1865e03497f64bda0
SHA256c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4
SHA512b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD58c5b3a2beac24f9a4878c50ce26c4623
SHA1e223a25b65a685c5be974ab1865e03497f64bda0
SHA256c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4
SHA512b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6
-
memory/808-144-0x0000000000000000-mapping.dmp
-
memory/936-237-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/936-236-0x0000000002EFC000-0x0000000002F1B000-memory.dmpFilesize
124KB
-
memory/1224-204-0x00000000072C0000-0x00000000072FC000-memory.dmpFilesize
240KB
-
memory/1224-181-0x0000000000000000-mapping.dmp
-
memory/1224-230-0x0000000002DF8000-0x0000000002E26000-memory.dmpFilesize
184KB
-
memory/1224-192-0x0000000002DF8000-0x0000000002E26000-memory.dmpFilesize
184KB
-
memory/1224-193-0x0000000004800000-0x000000000484B000-memory.dmpFilesize
300KB
-
memory/1224-194-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/1224-231-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/1224-218-0x00000000082A0000-0x0000000008306000-memory.dmpFilesize
408KB
-
memory/1224-224-0x0000000002DF8000-0x0000000002E26000-memory.dmpFilesize
184KB
-
memory/1784-149-0x0000000000000000-mapping.dmp
-
memory/1792-201-0x0000000002F8C000-0x0000000002FAB000-memory.dmpFilesize
124KB
-
memory/1792-213-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/1792-203-0x00000000047D0000-0x000000000480C000-memory.dmpFilesize
240KB
-
memory/1792-216-0x0000000002F8C000-0x0000000002FAB000-memory.dmpFilesize
124KB
-
memory/1928-205-0x0000000000594000-0x0000000000597000-memory.dmpFilesize
12KB
-
memory/1928-207-0x0000000000550000-0x000000000056D000-memory.dmpFilesize
116KB
-
memory/1928-189-0x0000000000000000-mapping.dmp
-
memory/2132-153-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/2132-154-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB
-
memory/2132-150-0x0000000000000000-mapping.dmp
-
memory/2132-177-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB
-
memory/2356-147-0x0000000000000000-mapping.dmp
-
memory/2420-139-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/2420-133-0x00000000048E0000-0x000000000491C000-memory.dmpFilesize
240KB
-
memory/2420-134-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/2420-138-0x0000000002D59000-0x0000000002D78000-memory.dmpFilesize
124KB
-
memory/2420-132-0x0000000002D59000-0x0000000002D78000-memory.dmpFilesize
124KB
-
memory/2604-208-0x0000000000580000-0x000000000059D000-memory.dmpFilesize
116KB
-
memory/2604-185-0x0000000000000000-mapping.dmp
-
memory/2604-223-0x0000000000580000-0x000000000059D000-memory.dmpFilesize
116KB
-
memory/2604-210-0x0000000002300000-0x0000000003300000-memory.dmpFilesize
16.0MB
-
memory/2816-200-0x0000000004ED0000-0x0000000004FDA000-memory.dmpFilesize
1.0MB
-
memory/2816-170-0x0000000000000000-mapping.dmp
-
memory/2816-221-0x00000000066C0000-0x0000000006882000-memory.dmpFilesize
1.8MB
-
memory/2816-186-0x0000000000340000-0x0000000000372000-memory.dmpFilesize
200KB
-
memory/2816-219-0x0000000005E10000-0x0000000005E86000-memory.dmpFilesize
472KB
-
memory/2816-202-0x0000000004E00000-0x0000000004E12000-memory.dmpFilesize
72KB
-
memory/2816-198-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/2856-146-0x0000000000000000-mapping.dmp
-
memory/2912-164-0x0000000000000000-mapping.dmp
-
memory/2912-220-0x0000000008D40000-0x0000000008D90000-memory.dmpFilesize
320KB
-
memory/2912-199-0x0000000002EBC000-0x0000000002EEA000-memory.dmpFilesize
184KB
-
memory/2912-222-0x0000000008F80000-0x00000000094AC000-memory.dmpFilesize
5.2MB
-
memory/2912-179-0x0000000002EBC000-0x0000000002EEA000-memory.dmpFilesize
184KB
-
memory/2912-197-0x0000000007590000-0x0000000007B34000-memory.dmpFilesize
5.6MB
-
memory/2912-217-0x00000000083E0000-0x0000000008472000-memory.dmpFilesize
584KB
-
memory/2912-176-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/2912-229-0x0000000002EBC000-0x0000000002EEA000-memory.dmpFilesize
184KB
-
memory/2912-228-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/3380-227-0x0000000002EB9000-0x0000000002EE7000-memory.dmpFilesize
184KB
-
memory/3380-174-0x0000000002E10000-0x0000000002E5B000-memory.dmpFilesize
300KB
-
memory/3380-161-0x0000000000000000-mapping.dmp
-
memory/3380-175-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/3380-173-0x0000000002EB9000-0x0000000002EE7000-memory.dmpFilesize
184KB
-
memory/3380-191-0x0000000002EB9000-0x0000000002EE7000-memory.dmpFilesize
184KB
-
memory/3380-226-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/3492-158-0x0000000002CA8000-0x0000000002CC7000-memory.dmpFilesize
124KB
-
memory/3492-135-0x0000000000000000-mapping.dmp
-
memory/3492-141-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/3492-159-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/3492-140-0x0000000002CA8000-0x0000000002CC7000-memory.dmpFilesize
124KB
-
memory/3704-169-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB
-
memory/3704-184-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB
-
memory/3704-166-0x0000000000000000-mapping.dmp
-
memory/3736-143-0x0000000000000000-mapping.dmp
-
memory/3880-148-0x0000000000000000-mapping.dmp
-
memory/3984-195-0x0000000000000000-mapping.dmp
-
memory/3984-206-0x0000000000494000-0x0000000000497000-memory.dmpFilesize
12KB
-
memory/3984-209-0x00000000005C0000-0x00000000005DD000-memory.dmpFilesize
116KB
-
memory/4172-211-0x0000000000000000-mapping.dmp
-
memory/4172-214-0x0000000000594000-0x0000000000597000-memory.dmpFilesize
12KB
-
memory/4172-215-0x00000000004C0000-0x00000000004DD000-memory.dmpFilesize
116KB
-
memory/4224-142-0x0000000000000000-mapping.dmp
-
memory/4296-232-0x0000000000000000-mapping.dmp
-
memory/4752-145-0x0000000000000000-mapping.dmp
-
memory/4796-155-0x0000000000000000-mapping.dmp
-
memory/4796-160-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB
-
memory/4796-178-0x00007FF84F220000-0x00007FF84FCE1000-memory.dmpFilesize
10.8MB