Analysis
-
max time kernel
687s -
max time network
803s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250425-en -
resource tags
-
submitted
08/05/2025, 06:22
General
-
Target
http://www.blackhatfrench.com
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\pyth\Crypto\Cipher\__pycache__\PKCS1_OAEP.cpython-311.pyc
Ransom Note
�
�����
ej#�����������������������������d�dl�mZ�d�dlZd�dlmZmZ�d�dlZd�dlmZm Z m
Z
�d�dl m Z �d�dlm
Z
��G�d��d������������Zd d
�ZdS�) �����)�MGF1N)�bord� _copy_bytes)�ceil_div�
bytes_to_long�
long_to_bytes)�strxor)�Randomc��������������������0�����e�Zd�ZdZd��Zd��Zd��Zd��Zd��ZdS�)�PKCS1OAEP_CipherzXCipher object for PKCS#1 v1.5 OAEP.
Do not create directly: use :func:`new` instead.c��������������������������|��_���������|r|��_��������nt����������j��������j����������_��������|r|��_��������n
��fd���_��������t
����������dd|��������������_��������|��_��������dS�)a��Initialize this PKCS#1 OAEP cipher object.
:Parameters:
key : an RSA key object
If a private half is given, both encryption and decryption are possible.
If a public half is given, only encryption is possible.
hashAlgo : hash object
The hash function to use. This can be a module under `Crypto.Hash`
or an existing hash object created from any of such modules. If not specified,
`Crypto.Hash.SHA1` is used.
mgfunc : callable
A mask generation function that accepts two parameters: a string to
use as seed, and the lenth of the mask to generate, in bytes.
If not specified, the standard MGF1 consistent with ``hashAlgo`` is used (a safe choice).
label : bytes/bytearray/memoryview
A label to apply to this particular encryption. If not specified,
an empty string is used. Specifying a label does not improve
security.
randfunc : callable
A function that returns random bytes.
:attention: Modify the mask generation function only if you know what you are doing.
Sender and receiver must use the same one.
c������������������0������t����������|�|�j��������������������S�)N)r����_hashObj)�x�y�selfs��� ��lC:\Users\Administrator\AppData\Local\Programs\Python\Python311\Lib\site-packages\Crypto/Cipher/PKCS1_OAEP.py�<lambda>z+PKCS1OAEP_Cipher.__init__.<locals>.<lambda>G���s�������D��1�T�]�$;�$;�������N) �_keyr����Crypto�Hash�SHA1�_mgfr����_label� _randfunc)r����key�hashAlgo�mgfunc�label�randfuncs���` r����__init__zPKCS1OAEP_Cipher.__init__$���sh�������2��� � �� -� $�D�M�M� "�K� ,�D�M� �� <� �D�I�I�;�;�;�;�D�I�!�$��e�4�4�� �!����r���c������������������4�����|�j��������������������������������������������S�)zVLegacy function to check if you can call :meth:`encrypt`.
.. deprecated:: 3.0)r���� can_encrypt�r���s��� r���r$���z PKCS1OAEP_Cipher.can_encryptL������������y�$�$�&�&�&r���c������������������4�����|�j��������������������������������������������S�)zVLegacy function to check if you can call :meth:`decrypt`.
.. deprecated:: 3.0)r���� can_decryptr%���s��� r���r(���z PKCS1OAEP_Cipher.can_decryptR���r&���r���c�����������������������t�����������j��������j�����������������������������|�j��������j��������������������}t
����������|d������������}|�j��������j��������}t����������|������������}||z
��d|z��z
��dz
��}|dk�����rt����������d�������������|�j��������� ��������������������|�j ���������������������
����������������������������������}d|z��}||z���dz���t ����������dd|������������z���} |����������������������|������������}
|����������������������|
||z
��dz
��������������} t#����������| | ������������} |����������������������| |������������}
t#����������|
|
������������}d|z���| z���}t%����������|������������}|�j�����������������������������|������������}t)����������||������������}|S�) a\��Encrypt a message with PKCS#1 OAEP.
:param message:
The message to encrypt, also known as plaintext. It can be of
variable length, but not longer than the RSA modulus (in bytes)
minus 2, minus twice the hash output size.
For instance, if you use RSA 2048 and SHA-256, the longest message
you can encrypt is 190 byte long.
:type message: bytes/bytearray/memoryview
:returns: The ciphertext, as large as the RSA modulus.
:rtype: bytes
:raises ValueError:
if the message is too long.
��������r���zPlaintext is too long.���������N����)r����Util�number�sizer����nr���r���� digest_size�len�
ValueError�newr����digestr���r ���r���r ���r����_encryptr���)r����message�modBits�k�hLen�mLen�ps_len�lHash�ps�db�ros�dbMask�maskedDB�seedMask�
maskedSeed�em�em_int�m_int�cs��� r����encryptzPKCS1OAEP_Cipher.encryptX���sc�����&��+�$�)�)�$�)�+�6�6�� �W�a� � ���}�(���7�|�|����T��A��H�$�q�(�� �A�:�:� � 5�6�6� 6��
�!�!�$�+�.�.�5�5�7�7��
�v�
��
�R�Z�'�
!�K��d�G�$D�$D�
D���n�n�T�"�"�����3��$��q��)�)���"�f�%�%���9�9�X�t�,�,���C��*�*�
�
�z�
!�H�
,�� �r�"�"��� �"�"�6�*�*�� �%�� #� #���r���c����������������������t�����������j��������j�����������������������������|�j��������j��������������������}t
����������|d������������}|�j��������j��������}t����������|������������|k����s ||dz���k�����rt����������d�������������t����������|������������}|�j��������� ��������������������|������������}t����������||������������}|�j�����������������������������|�j�������������������������������������������������������}|d���������} |d|dz�������������}
||dz���d����������} |����������������������| |������������} t%����������|
| ������������}
|����������������������|
||z
��dz
��������������}t%����������| |������������}|||d�������������������������������d������������z���}|d|����������}t)����������| ������������t+����������||k�����������������z��}t%����������||������������}|D�]}|t)����������|������������z��}�|||����������D�]}|t)����������|������������z��}�|dk����rt����������d�������������||dz���d����������S�) a5��Decrypt a message with PKCS#1 OAEP.
:param ciphertext: The encrypted message.
:type ciphertext: bytes/bytearray/memoryview
:returns: The original message (plaintext).
:rtype: bytes
:raises ValueError:
if the ciphertext has the wrong length, or if decryption
fails the integrity check (in which case, the decryption
key is probably wrong).
:raises TypeError:
if the RSA key has no private half (i.e. you are trying
to decrypt using a public key).
r*���r+���z!Ciphertext with incorrect length.r���r.���Nr-���zIncorrect decryption.)r���r/���r0���r1���r���r2���r���r���r3���r4���r5���r����_decryptr���r6���r���r7���r���r ����findr����int)r����
ciphertextr:���r;���r<����ct_intrI���rG���r?���r���rF���rD���rE����seedrC���rA����one_pos�lHash1�invalid� hash_comparer���s��� r����decryptzPKCS1OAEP_Cipher.decrypt����s������&��+�$�)�)�$�)�+�6�6�� �W�Q� � ���}�(��� �z�?�?�a� � �1�T�!�V�8�8� � @�A�A� A� �z�*�*��� �"�"�6�*�*��
�5�!�
$�
$���
�!�!�$�+�.�.�5�5�7�7�� �q�E�����$�q�&��\�
��d�1�f�g�g�;���9�9�X�t�,�,���j�(�+�+�����4��4����*�*��
�H�f�
%�
%����D�E�E�� � ��0�0�0���E�T�E����q�'�'�C��$�� /� /�/�� �f�e�,�,� � �� �� �A� �t�A�w�w� �G�G��D��L�!�� �� �A� �t�A�w�w� �G�G� �a�<�<� � 4�5�5� 5��'�A�+�,�,� � r���N) �__name__�
__module__� __qualname__�__doc__r"���r$���r(���rK���rW�����r���r���r ���r ��� ���sk��������������8��8�&"��&"��&"�P'��'��'� '��'��'� 4��4��4�l< ��< ��< ��< ��< r���r ���r���c������������������D�����|� t�����������j��������}t����������|�||||������������S�)a���Return a cipher object :class:`PKCS1OAEP_Cipher` that can be used to perform PKCS#1 OAEP encryption or decryption.
:param key:
The key object to use to encrypt or decrypt the message.
Decryption is only possible with a private RSA key.
:type key: RSA key object
:param hashAlgo:
The hash function to use. This can be a module under `Crypto.Hash`
or an existing hash object created from any of such modules.
If not specified, `Crypto.Hash.SHA1` is used.
:type hashAlgo: hash object
:param mgfunc:
A mask generation function that accepts two parameters: a string to
use as seed, and the lenth of the mask to generate, in bytes.
If not specified, the standard MGF1 consistent with ``hashAlgo`` is used (a safe choice).
:type mgfunc: callable
:param label:
A label to apply to this particular encryption. If not specified,
an empty string is used. Specifying a label does not improve
security.
:type label: bytes/bytearray/memoryview
:param randfunc:
A function that returns random bytes.
The default is `Random.get_random_bytes`.
:type randfunc: callable
)r
����get_random_bytesr ���)r ���r ���r ���r ���r!���s��� r���r6���r6�������s)������@����*�� �C��6�5�(� C� C�Cr���)NNr���N)�Crypto.Signature.pssr����Crypto.Hash.SHA1r����Crypto.Util.py3compatr���r����Crypto.Util.numberr���r���r����Crypto.Util.strxorr ���r
���r ���r6���r\���r���r����<module>rd������s������.�&��%��%��%��%��%����������3��3��3��3��3��3��3��3����������G��G��G��G��G��G��G��G��G��G��'��'��'��'��'��'�������������j ��j ��j ��j ��j ��j ��j ��j �X"D��"D��"D��"D��"D��"Dr���
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\pyth\Crypto\Cipher\__pycache__\_mode_siv.cpython-311.pyc
Ransom Note
�
�����z�e!8�����������������������������d�Z�dgZddlmZmZ�ddlmZmZ�ddlm Z �ddl
m Z m Z �ddl
mZ�ddlmZ�dd lmZ��G�d
��de������������Zd ��Zd S�)
z-
Synthetic Initialization Vector (SIV) mode.
�SivMode�����)�hexlify� unhexlify)�bord� _copy_bytes)� is_buffer)�
long_to_bytes�
bytes_to_long)�_S2V)�BLAKE2s)�get_random_bytesc��������������������X�����e�Zd�ZdZd��Zd��Zd��Zd��Zd��Zd��Z d��Z
d ��Z d
��Z dd �Z
dd
�Zd S�)r���a���Synthetic Initialization Vector (SIV).
This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.
It provides both confidentiality and authenticity.
The header of the message may be left in the clear, if needed, and it will
still be subject to authentication. The decryption step tells the receiver
if the message comes from a source that really knowns the secret key.
Additionally, decryption detects if any part of the message - including the
header - has been modified or corrupted.
Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a
nonce is not catastrophic for the confidentiality of the message. The only
effect is that an attacker can tell when the same plaintext (and same
associated data) is protected with the same key.
The length of the MAC is fixed to the block size of the underlying cipher.
The key size is twice the length of the key of the underlying cipher.
This mode is only available for AES ciphers.
+--------------------+---------------+-------------------+
| Cipher | SIV MAC size | SIV key length |
| | (bytes) | (bytes) |
+====================+===============+===================+
| AES-128 | 16 | 32 |
+--------------------+---------------+-------------------+
| AES-192 | 16 | 48 |
+--------------------+---------------+-------------------+
| AES-256 | 16 | 64 |
+--------------------+---------------+-------------------+
See `RFC5297`_ and the `original paper`__.
.. _RFC5297: https://tools.ietf.org/html/rfc5297
.. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
.. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
:undocumented: __init__
c������������������0����|j���������|�_��������� �||�_��������||�_��������t����������|������������dvr t ����������dt����������|������������z���������������|�Wt ����������|������������st
����������d�������������t����������|������������dk����rt ����������d�������������t����������d�d�|������������|�_�������� �t����������|������������dz��}d�|�_ ��������t����������|d�|����������||�j���������������������|�_ ��������||d�����������|�_ ���������|j
��������|d�|����������|j��������fi�|���g�d�|�_��������d�S�) N)� ����0����@���z Incorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr���z*When provided, the nonce must be non-empty����)� ciphermod�
cipher_params��update�encrypt�decrypt�digest�verify)�
block_size�_factory�_cipher_params�len�
ValueErrorr���� TypeErrorr����nonce�_mac_tagr ����_kdf�_subkey_cipher�new�MODE_ECB�_next)�self�factory�keyr"����kwargs� subkey_sizes��� �>C:\Users\Administrator\Desktop\pyth\Crypto\Cipher\_mode_siv.py�__init__zSivMode.__init__[���s;�����!�,���@� ��
� $��� �s�8�8�<� '� '� � >��S��� I�J�J� J� � � �U�#�#��
c� � a�b�b�b��5�z�z�Q��� �!M�N�N�N�$�T�4��7�7�D�J�
���#�h�h�!�m� � ��
���\�k�\�*�#*�'+�':�<��<��<�� �� "�+�,�,� /���� �� �C� �� �%�w�'7�B�B�6�B�B�B�*��*��*��
�
�
�����c������������������������t����������|������������}|dz��}�|�j��������j��������|�j��������|�j��������j��������f|dd�|�j����������S�)z*Create a new CTR cipher from V in SIV model �������������r0���)�
initial_valuer"���)r
���r ���r&���r%����MODE_CTRr ���)r)����v�v_int�qs��� r.����_create_ctr_cipherzSivMode._create_ctr_cipher����sb������� �a� � �� �6� 6�� �t�}� ��'��M�*�+��#$� � +��+�
��)� +��+�� +r0���c������������������x�����d|�j���������vrt����������d�������������g�d�|�_���������|�j�����������������������������|������������S�)a���Protect one associated data component
For SIV, the associated data is a sequence (*vector*) of non-empty
byte strings (*components*).
This method consumes the next component. It must be called
once for each of the components that constitue the associated data.
Note that the components have clear boundaries, so that:
>>> cipher.update(b"builtin")
>>> cipher.update(b"securely")
is not equivalent to:
>>> cipher.update(b"built")
>>> cipher.update(b"insecurely")
If there is no associated data, this method must not be called.
:Parameters:
component : bytes/bytearray/memoryview
The next associated data component.
r���z<update() can only be called immediately after initializationr���)r(���r!���r$���r���)r)���� components��� r.���r���zSivMode.update����sW������4� �4�:� %� %��� D��E��E��
E�*��*��*��
���y� � � �*�*�*r0���c������������������ �����t����������d�������������)z�
For SIV, encryption and MAC authentication must take place at the same
point. This method shall not be used.
Use `encrypt_and_digest` instead.
zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.�r!���)r)���� plaintexts��� r.���r���zSivMode.encrypt��������������=��>��>�� >r0���c������������������ �����t����������d�������������)z�
For SIV, decryption and verification must take place at the same
point. This method shall not be used.
Use `decrypt_and_verify` instead.
zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.r;���)r)����
ciphertexts��� r.���r���zSivMode.decrypt����r=���r0���c������������������������d|�j���������vrt����������d�������������dg|�_���������|�j��������� |�j�������������������������������������������|�_��������|�j��������S�)z�Compute the *binary* MAC tag.
The caller invokes this function at the very end.
This method returns the MAC that shall be sent to the receiver,
together with the ciphertext.
:Return: the MAC, as a byte string.
r���zAdigest() cannot be called when decrypting or validating a message)r(���r!���r#���r$����derive�r)���s��� r.���r���zSivMode.digest����sV������� �4�:� %� %��� 7��8��8��
8� �Z��
� �=� � �I� ,� ,� .� .�D�M��}� r0���c������������������d�����d����������������������d��|������������������������������������D���������������������������S�)z�Compute the *printable* MAC tag.
This method is like `digest`.
:Return: the MAC, as a hexadecimal string.
��c������������������2�����g�|�]}d�t����������|������������z����S�)z%02x)r���)�.0�xs��� r.����
<listcomp>z%SivMode.hexdigest.<locals>.<listcomp>����s#������@�@�@�Q���a���(�@�@�@r0���)�joinr���rB���s��� r.���� hexdigestzSivMode.hexdigest����s-��������w�w�@�@�$�+�+�-�-�@�@�@�A�A�Ar0���c�����������������������d|�j���������vrt����������d�������������dg|�_���������|�j��������� |�j�������������������������������������������|�_��������t ����������d������������}t
����������j��������d||�j���������������������}t
����������j��������d||�������������}|�����������������������������������|�����������������������������������k����rt����������d�������������dS�)a(��Validate the *binary* MAC tag.
The caller invokes this function at the very end.
This method checks if the decrypted message is indeed valid
(that is, if the key is correct) and it has not been
tampered with while in transit.
:Parameters:
received_mac_tag : bytes/bytearray/memoryview
This is the *binary* MAC, as received from the sender.
:Raises ValueError:
if the MAC does not match. The message has been tampered with
or the key is incorrect.
r���z3verify() cannot be called when encrypting a messageN���������)� digest_bitsr+����datazMAC check failed)
r(���r!���r#���r$���rA���r
���r ���r&���r���r ���)r)����received_mac_tag�secret�mac1�mac2s��� r.���r���zSivMode.verify����s�������"� �4�:� %� %��� 9��:��:��
:� �Z��
� �=� � �I� ,� ,� .� .�D�M�!�"�%�%���{�s��T�]�K�K�K���{�s��=M�N�N�N�� �;�;�=�=�D�K�K�M�M� )� )� � /�0�0� 0�� *� )r0���c������������������J�����|�����������������������t����������|�������������������������dS�)aW��Validate the *printable* MAC tag.
This method is like `verify`.
:Parameters:
hex_mac_tag : string
This is the *printable* MAC, as received from the sender.
:Raises ValueError:
if the MAC does not match. The message has been tampered with
or the key is incorrect.
N)r���r���)r)���� hex_mac_tags��� r.���� hexverifyzSivMode.hexverify��s$�������
� � �I�k�*�*�+�+�+�+�+r0���Nc�����������������������d|�j���������vrt����������d�������������dg|�_���������t����������|�d������������r |�j�����������������������������|�j���������������������|�j�����������������������������|�������������|�j�������������������������������������������|�_��������|����������������������|�j��������������������}|� ��������������������||�������������|�j��������fS�)a\��Perform encrypt() and digest() in one step.
:Parameters:
plaintext : bytes/bytearray/memoryview
The piece of data to encrypt.
:Keywords:
output : bytearray/memoryview
The location where the ciphertext must be written to.
If ``None``, the ciphertext is returned.
:Return:
a tuple with two items:
- the ciphertext, as ``bytes``
- the MAC tag, as ``bytes``
The first item becomes ``None`` when the ``output`` parameter
specified a location for the result.
r���z@encrypt() can only be called after initialization or an update()r���r"�����output)
r(���r!����hasattrr$���r���r"���rA���r#���r7���r���)r)���r<���rY����ciphers��� r.����encrypt_and_digestzSivMode.encrypt_and_digest��s�������(� �D�J� &� &��� =��>��>��
>�� �Z��
�� �4�� !� !�� )� �I� � �T�Z� (� (� (� � ����#�#�#� � �(�(�*�*��
��(�(�� �7�7���~�~�i��~�7�7�� �F�Fr0���c������������������v����d|�j���������vrt����������d�������������dg|�_���������|����������������������|������������|�_��������|�j�����������������������������||�������������}t ����������|�d������������r |�j�����������������������������|�j���������������������|�j�����������������������������|�|n|�������������|�� ��������������������|�������������|S�)aP��Perform decryption and verification in one step.
A cipher object is stateful: once you have decrypted a message
you cannot decrypt (or encrypt) another message with the same
object.
You cannot reuse an object for encrypting
or decrypting other data with the same key.
This function does not remove any padding from the plaintext.
:Parameters:
ciphertext : bytes/bytearray/memoryview
The piece of data to decrypt.
It can be of any length.
mac_tag : bytes/bytearray/memoryview
This is the *binary* MAC, as received from the sender.
:Keywords:
output : bytearray/memoryview
The location where the plaintext must be written to.
If ``None``, the plaintext is returned.
:Return: the plaintext as ``bytes`` or ``None`` when the ``output``
parameter specified a location for the result.
:Raises ValueError:
if the MAC does not match. The message has been tampered with
or the key is incorrect.
r���z@decrypt() can only be called after initialization or an update()r���rX���r"���)
r(���r!���r7����_cipherr���rZ���r$���r���r"���r���)r)���r?����mac_tagrY���r<���s��� r.����decrypt_and_verifyzSivMode.decrypt_and_verify6��s�������:� �D�J� &� &��� C��D��D��
D� �Z��
�� �.�.�w�7�7�� ��L�(�(��F�(�C�C� � �4�� !� !�� )� �I� � �T�Z� (� (� (� � ���f�n���&�A�A�A� � � �G� � � ��r0���)N)�__name__�
__module__� __qualname__�__doc__r/���r7���r���r���r���r���rJ���r���rV���r\���r`�����r0���r.���r���r���1���s���������������'��'�R$*��$*��$*�L
+��
+��
+�!+��!+��!+�F >�� >�� >� >�� >�� >� �� �� �&B��B��B� 1�� 1�� 1�B
,��
,��
,� "G��"G��"G��"G�H,��,��,��,��,��,r0���c�������������� ���������� �|����������������������d������������}n1#�t����������$�r$}t����������dt����������|������������z����������������d}~ww�xY�w|����������������������dd������������}t ����������|�|||������������S�)a-��Create a new block cipher, configured in
Synthetic Initializaton Vector (SIV) mode.
:Parameters:
factory : object
A symmetric cipher module from `Crypto.Cipher`
(like `Crypto.Cipher.AES`).
:Keywords:
key : bytes/bytearray/memoryview
The secret key to use in the symmetric cipher.
It must be 32, 48 or 64 bytes long.
If AES is the chosen cipher, the variants *AES-128*,
*AES-192* and or *AES-256* will be used internally.
nonce : bytes/bytearray/memoryview
For deterministic encryption, it is not present.
Otherwise, it is a value that must never be reused
for encrypting message under this key.
There are no restrictions on its length,
but it is recommended to use at least 16 bytes.
r+���zMissing parameter: Nr"���)�pop�KeyErrorr!����strr���)r*���r,���r+����er"���s��� r.����_create_siv_cipherrk���e��s|������88��j�j�� � ���� ��8��8��8��-��A���6�7�7�7�����
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
-
Renames multiple (99) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 8 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
-
Drops desktop.ini file(s) 12 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
-
Enumerates processes with tasklist 1 TTPs 10 IoCs
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 16 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Detects Pyinstaller 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
-
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
-
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates system info in registry 2 TTPs 27 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 13 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 2 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.blackhatfrench.com1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x338,0x7ffbc2e4f208,0x7ffbc2e4f214,0x7ffbc2e4f2202⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2648,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2284,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5028,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5776,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5776,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4324,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5936,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6680,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6984,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3568,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3568,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6900,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4824,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5744,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7404,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7712,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5364,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7780,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7296,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7280,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1196,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7148,i,8177647694591808150,5467602123761957285,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d8 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\G700_v6.4\" -spe -an -ai#7zMap17032:76:7zEvent261601⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Cracking tools, Generators, Checkers, AIO, Methods\" -spe -an -ai#7zMap13501:158:7zEvent170271⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\" -spe -an -ai#7zMap9154:96:7zEvent77681⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\Password.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\" -spe -an -ai#7zMap2042:156:7zEvent248821⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\Extreme Injector v3.exe"C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\Extreme Injector v3.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\G-700RAT V6.exe"C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\G-700RAT V6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\G-700RAT V6.exe"C:\Users\Admin\Desktop\G700_v6.4\G700_v6.4\G700 v6.4\G700 v6.4\G700 v6.4\G-700RAT V6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Cracking tools, Generators, Checkers, AIO, Methods\Cracking tools, Generators, Checkers, AIO, Methods\" -spe -an -ai#7zMap10196:260:7zEvent99841⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Cracking tools, Generators, Checkers, AIO, Methods\Cracking tools, Generators, Checkers, AIO, Methods\Cracking tools, Generators, Checkers, AIO, Methods\" -spe -an -ai#7zMap10439:362:7zEvent69361⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Documents\!CC-Paypal-Checker-main\Cracked by CRAX-it v3.0.1.exe"C:\Users\Admin\Documents\!CC-Paypal-Checker-main\Cracked by CRAX-it v3.0.1.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr"C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr" /S2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr"C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr" /S3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4592"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 45925⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5952"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 59525⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2776"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 27765⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2800"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 28005⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3308"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 33085⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1376"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 13765⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4832"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 48325⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5816"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 58165⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1728"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 17285⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4636"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 46365⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2108"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 21085⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1660"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 16605⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4688"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 46885⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵
-
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵
-
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"4⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard5⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"4⤵
- Network Service Discovery
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname5⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername5⤵
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\net.exenet user5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user6⤵
-
-
-
C:\Windows\system32\query.exequery user5⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"6⤵
-
-
-
C:\Windows\system32\net.exenet localgroup5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup6⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators6⤵
-
-
-
C:\Windows\system32\net.exenet user guest5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest6⤵
-
-
-
C:\Windows\system32\net.exenet user administrator5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator6⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\tasklist.exetasklist /svc5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
-
C:\Windows\system32\ROUTE.EXEroute print5⤵
-
-
C:\Windows\system32\ARP.EXEarp -a5⤵
- Network Service Discovery
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano5⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\sc.exesc query type= service state= all5⤵
- Launches sc.exe
-
-
C:\Windows\system32\netsh.exenetsh firewall show state5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh firewall show config5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exeC:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1924,i,17381450977306690988,15787292095030878875,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,17381450977306690988,15787292095030878875,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1924,i,17381450977306690988,15787292095030878875,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Cracking tools, Generators, Checkers, AIO, Methods\Cracking tools, Generators, Checkers, AIO, Methods\Cracking tools, Generators, Checkers, AIO, Methods\Crack\" -spe -an -ai#7zMap9695:374:7zEvent280141⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Documents\!PRO Logs Card Data Parser\Cracked by CRAX-it v3.0.1.exe"C:\Users\Admin\Documents\!PRO Logs Card Data Parser\Cracked by CRAX-it v3.0.1.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr"C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr" /S2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr"C:\Users\Admin\AppData\Local\Temp\Data-Export-2024-06-10_piz.scr" /S3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exeC:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1908,i,17871330201742539249,738794239273049312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --mojo-platform-channel-handle=2124 --field-trial-handle=1908,i,17871330201742539249,738794239273049312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 --field-trial-handle=1908,i,17871330201742539249,738794239273049312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
-
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BoltAIO v2\" -spe -an -ai#7zMap2839:78:7zEvent48381⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe"C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exeC:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1932,i,11657654620700174238,8812502989734159691,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe"C:\Users\Admin\AppData\Local\Temp\2hxgf3bgGLBF91tnIY9RVGPdbsy\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\main" --mojo-platform-channel-handle=2152 --field-trial-handle=1932,i,11657654620700174238,8812502989734159691,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"5⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"9⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"10⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"11⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"12⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"14⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"16⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"18⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"20⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"20⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"21⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"22⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"22⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"23⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"24⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"25⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"26⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"26⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"27⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"28⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"28⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"29⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"30⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"30⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"31⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"31⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"32⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"32⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"33⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"33⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"34⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"35⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"35⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"36⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"36⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"37⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"38⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"38⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"39⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"39⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"40⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"40⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"41⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"41⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"42⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"42⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"43⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"43⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"44⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"44⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"45⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"45⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"46⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"46⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"47⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"47⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"48⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"48⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"49⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"49⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"50⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"50⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"51⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"51⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"51⤵
-
C:\Windows\system32\cmd.exe"cmd /c ver"52⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"51⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"52⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"52⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"53⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"53⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"54⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"54⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"55⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"55⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"56⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"56⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"57⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"57⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"58⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"58⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"59⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"59⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"60⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"60⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"61⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"61⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"62⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"62⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"63⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"63⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"64⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"64⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"65⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"65⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"66⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"66⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"67⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"67⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"68⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"68⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"69⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"69⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"70⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"70⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"71⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"71⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"72⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"72⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"73⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"73⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"74⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"74⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"75⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"75⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"76⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"74⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"76⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"77⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"75⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"77⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"78⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"78⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"79⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"77⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"79⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"80⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"78⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"80⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"81⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"79⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"81⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"82⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"82⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"83⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"81⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"83⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"84⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"83⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"85⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"86⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"86⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"87⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"88⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"88⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"89⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"87⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"89⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"90⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"88⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"90⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"91⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"89⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"91⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"92⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"90⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"92⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"93⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"91⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"93⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"94⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"94⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"95⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"93⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"95⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"96⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"96⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"97⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"97⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"98⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"98⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"99⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"99⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"100⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"100⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"101⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"101⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"102⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"102⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"103⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"103⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"104⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"104⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"105⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"105⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"106⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"106⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"107⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"107⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"108⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"108⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"109⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"109⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"110⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"110⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"111⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1112⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"111⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"112⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"112⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"113⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"113⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"114⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"114⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"115⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"115⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"116⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"116⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"117⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"117⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"118⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"118⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"119⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"119⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"120⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"120⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-