Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
94s -
max time network
1819s -
platform
windows11_x64 -
resource
win11 -
submitted
31-08-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (21).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral14/memory/704-280-0x0000000004300000-0x0000000004C26000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5436 4788 rundll32.exe 8 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 4788 rUNdlL32.eXe 8 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 14 IoCs
resource yara_rule behavioral14/memory/2160-339-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5060-338-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5868-399-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5832-389-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/560-422-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5396-440-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/4116-478-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/2808-466-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5212-496-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/4176-484-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/5272-532-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/6072-540-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/4000-539-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/6072-640-0x0000000005490000-0x0000000005A36000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
description pid Process procid_target PID 3432 created 3868 3432 WerFault.exe 93 PID 2052 created 704 2052 WerFault.exe 116 PID 5316 created 4188 5316 WerFault.exe 90 PID 6012 created 1176 6012 WerFault.exe 98 PID 4608 created 1560 4608 WerFault.exe 130 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral14/memory/1176-363-0x0000000000750000-0x0000000000823000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 42 IoCs
pid Process 1996 DT2N78GRPMYmpvRDVTDMBS5Q.exe 1664 UJS_iMyuAHGbHFhhG_DlNeoi.exe 2144 gWQqppHLsOQV85c5Xl04juaF.exe 620 CaELVTyyFpyxEjZHsflpNabb.exe 2800 YqJl8x5kXBwXkWk8q3k65b7H.exe 2208 snBSaKm_6tIx5t_LaayUULFs.exe 2352 gVY5H0NzgRTmPuX2Ut3vrUGs.exe 1176 RIxJtlI1mO4KtdHbutw_oFYl.exe 4156 17zzi9W4ymEyJlvDrtXGDHje.exe 4188 byyFFZOuN7cm4zCw_aPKqqLS.exe 4152 tV_N3V2_013AsHAQEoCFdIpL.exe 2936 vfzo2KwaEv9RHBjTRtn4E7Q3.exe 1172 RgFUtFx1yNdR4gWansvo97P8.exe 2476 mxiMvFDuyoLbtStAyuz4eSQc.exe 2416 _BgJnth8xDgWKdpmBlLZ3BYu.exe 3868 9XBL1FVV2CAACHLPncLZjIL6.exe 2516 BJBO4CcpkBkLYCEe3KTqj8xs.exe 2580 yDpw4mhO5F5IFboarBQOFBc1.exe 4704 K_Mp9BmHKL9_6gwIsSY2GOoY.exe 2908 Ej1cl83_jbQrfVt2pVdiFQsy.exe 1700 iV_PxzwG1qF7YrtlZuaH8HeQ.exe 704 KfprlbKV5Q9eLzenNGCwAiVA.exe 4332 xn5oBRgFjQPwJqowVrgmzdde.exe 4636 xn5oBRgFjQPwJqowVrgmzdde.tmp 848 LsPiwlMgqCMPvIQyLkWoXdJ8.exe 3052 inst001.exe 4320 cutm3.exe 3936 md8_8eus.exe 3120 svchost.exe 1560 KBAvfsr.exe 5336 tV_N3V2_013AsHAQEoCFdIpL.exe 3148 DT2N78GRPMYmpvRDVTDMBS5Q.exe 5060 BJBO4CcpkBkLYCEe3KTqj8xs.exe 2160 YqJl8x5kXBwXkWk8q3k65b7H.exe 5768 DT2N78GRPMYmpvRDVTDMBS5Q.exe 5832 BJBO4CcpkBkLYCEe3KTqj8xs.exe 3204 3540841.exe 2136 IQ0V_Fe_.eXE 5320 WerFault.exe 5868 YqJl8x5kXBwXkWk8q3k65b7H.exe 1928 7754986.exe 560 DT2N78GRPMYmpvRDVTDMBS5Q.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion snBSaKm_6tIx5t_LaayUULFs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vfzo2KwaEv9RHBjTRtn4E7Q3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vfzo2KwaEv9RHBjTRtn4E7Q3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gWQqppHLsOQV85c5Xl04juaF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gWQqppHLsOQV85c5Xl04juaF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion snBSaKm_6tIx5t_LaayUULFs.exe -
Loads dropped DLL 3 IoCs
pid Process 4636 xn5oBRgFjQPwJqowVrgmzdde.tmp 4636 xn5oBRgFjQPwJqowVrgmzdde.tmp 4156 Spadille.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral14/files/0x000200000002b1b7-184.dat themida behavioral14/files/0x000200000002b1aa-173.dat themida behavioral14/files/0x000200000002b1a8-169.dat themida behavioral14/files/0x000200000002b1a8-230.dat themida behavioral14/files/0x000200000002b1b7-236.dat themida behavioral14/files/0x000200000002b1aa-235.dat themida behavioral14/memory/2936-293-0x0000000000F50000-0x0000000000F51000-memory.dmp themida behavioral14/memory/2144-297-0x00000000003C0000-0x00000000003C1000-memory.dmp themida behavioral14/memory/2208-299-0x0000000000CB0000-0x0000000000CB1000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vfzo2KwaEv9RHBjTRtn4E7Q3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA snBSaKm_6tIx5t_LaayUULFs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gWQqppHLsOQV85c5Xl04juaF.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 512 ipinfo.io 536 ipinfo.io 3 ipinfo.io 107 ipinfo.io 199 ipinfo.io 215 ipinfo.io 103 ipinfo.io 149 ipinfo.io 1014 ipinfo.io 13 ipinfo.io 39 ipinfo.io 68 ip-api.com 68 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2208 snBSaKm_6tIx5t_LaayUULFs.exe 2936 vfzo2KwaEv9RHBjTRtn4E7Q3.exe 2144 gWQqppHLsOQV85c5Xl04juaF.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4152 set thread context of 5336 4152 tV_N3V2_013AsHAQEoCFdIpL.exe 140 PID 2516 set thread context of 5060 2516 BJBO4CcpkBkLYCEe3KTqj8xs.exe 133 PID 2800 set thread context of 2160 2800 YqJl8x5kXBwXkWk8q3k65b7H.exe 134 PID 2516 set thread context of 5832 2516 BJBO4CcpkBkLYCEe3KTqj8xs.exe 160 PID 2800 set thread context of 5868 2800 YqJl8x5kXBwXkWk8q3k65b7H.exe 159 PID 1996 set thread context of 560 1996 DT2N78GRPMYmpvRDVTDMBS5Q.exe 153 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe yDpw4mhO5F5IFboarBQOFBc1.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe _BgJnth8xDgWKdpmBlLZ3BYu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe _BgJnth8xDgWKdpmBlLZ3BYu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe _BgJnth8xDgWKdpmBlLZ3BYu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe _BgJnth8xDgWKdpmBlLZ3BYu.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini _BgJnth8xDgWKdpmBlLZ3BYu.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe yDpw4mhO5F5IFboarBQOFBc1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
pid pid_target Process procid_target 4084 3868 WerFault.exe 93 5500 4188 WerFault.exe 90 5440 704 WerFault.exe 116 3812 1176 WerFault.exe 98 4484 1560 WerFault.exe 130 1460 2328 WerFault.exe 189 3056 4636 WerFault.exe 240 7404 6696 WerFault.exe 255 972 6696 WerFault.exe 255 4684 476 WerFault.exe 212 8728 4324 WerFault.exe 301 5320 3204 WerFault.exe 154 8668 5884 WerFault.exe 259 3856 3204 WerFault.exe 154 2140 2068 WerFault.exe 306 10340 7920 WerFault.exe 292 11124 7236 WerFault.exe 310 8224 5488 WerFault.exe 171 10848 5488 WerFault.exe 171 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tV_N3V2_013AsHAQEoCFdIpL.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tV_N3V2_013AsHAQEoCFdIpL.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tV_N3V2_013AsHAQEoCFdIpL.exe -
Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5624 schtasks.exe 5664 schtasks.exe 6560 schtasks.exe 3952 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5444 timeout.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Kills process with taskkill 2 IoCs
pid Process 3956 taskkill.exe 9740 taskkill.exe -
Modifies data under HKEY_USERS 40 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1540 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 104 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 115 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 147 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 508 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 518 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1416 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4520 Setup (21).exe 4520 Setup (21).exe 4084 WerFault.exe 4084 WerFault.exe 5336 tV_N3V2_013AsHAQEoCFdIpL.exe 5336 tV_N3V2_013AsHAQEoCFdIpL.exe 5440 WerFault.exe 5440 WerFault.exe 5500 WerFault.exe 5500 WerFault.exe 3100 Process not Found 3100 Process not Found 3812 WerFault.exe 3812 WerFault.exe 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5336 tV_N3V2_013AsHAQEoCFdIpL.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeRestorePrivilege 4084 WerFault.exe Token: SeBackupPrivilege 4084 WerFault.exe Token: SeBackupPrivilege 4084 WerFault.exe Token: SeDebugPrivilege 620 CaELVTyyFpyxEjZHsflpNabb.exe Token: SeDebugPrivilege 848 LsPiwlMgqCMPvIQyLkWoXdJ8.exe Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeDebugPrivilege 3956 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4636 UJS_iMyuAHGbHFhhG_DlNeoi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4520 wrote to memory of 1996 4520 Setup (21).exe 88 PID 4520 wrote to memory of 1996 4520 Setup (21).exe 88 PID 4520 wrote to memory of 1996 4520 Setup (21).exe 88 PID 4520 wrote to memory of 1664 4520 Setup (21).exe 105 PID 4520 wrote to memory of 1664 4520 Setup (21).exe 105 PID 4520 wrote to memory of 1664 4520 Setup (21).exe 105 PID 4520 wrote to memory of 620 4520 Setup (21).exe 104 PID 4520 wrote to memory of 620 4520 Setup (21).exe 104 PID 4520 wrote to memory of 2144 4520 Setup (21).exe 103 PID 4520 wrote to memory of 2144 4520 Setup (21).exe 103 PID 4520 wrote to memory of 2144 4520 Setup (21).exe 103 PID 4520 wrote to memory of 2800 4520 Setup (21).exe 101 PID 4520 wrote to memory of 2800 4520 Setup (21).exe 101 PID 4520 wrote to memory of 2800 4520 Setup (21).exe 101 PID 4520 wrote to memory of 2208 4520 Setup (21).exe 102 PID 4520 wrote to memory of 2208 4520 Setup (21).exe 102 PID 4520 wrote to memory of 2208 4520 Setup (21).exe 102 PID 4520 wrote to memory of 2352 4520 Setup (21).exe 100 PID 4520 wrote to memory of 2352 4520 Setup (21).exe 100 PID 4520 wrote to memory of 2352 4520 Setup (21).exe 100 PID 4520 wrote to memory of 1176 4520 Setup (21).exe 98 PID 4520 wrote to memory of 1176 4520 Setup (21).exe 98 PID 4520 wrote to memory of 1176 4520 Setup (21).exe 98 PID 4520 wrote to memory of 4156 4520 Setup (21).exe 89 PID 4520 wrote to memory of 4156 4520 Setup (21).exe 89 PID 4520 wrote to memory of 4156 4520 Setup (21).exe 89 PID 4520 wrote to memory of 4188 4520 Setup (21).exe 90 PID 4520 wrote to memory of 4188 4520 Setup (21).exe 90 PID 4520 wrote to memory of 4188 4520 Setup (21).exe 90 PID 4520 wrote to memory of 4152 4520 Setup (21).exe 91 PID 4520 wrote to memory of 4152 4520 Setup (21).exe 91 PID 4520 wrote to memory of 4152 4520 Setup (21).exe 91 PID 4520 wrote to memory of 2936 4520 Setup (21).exe 92 PID 4520 wrote to memory of 2936 4520 Setup (21).exe 92 PID 4520 wrote to memory of 2936 4520 Setup (21).exe 92 PID 4520 wrote to memory of 1172 4520 Setup (21).exe 99 PID 4520 wrote to memory of 1172 4520 Setup (21).exe 99 PID 4520 wrote to memory of 1172 4520 Setup (21).exe 99 PID 4520 wrote to memory of 2476 4520 Setup (21).exe 96 PID 4520 wrote to memory of 2476 4520 Setup (21).exe 96 PID 4520 wrote to memory of 2416 4520 Setup (21).exe 97 PID 4520 wrote to memory of 2416 4520 Setup (21).exe 97 PID 4520 wrote to memory of 2416 4520 Setup (21).exe 97 PID 4520 wrote to memory of 3868 4520 Setup (21).exe 93 PID 4520 wrote to memory of 3868 4520 Setup (21).exe 93 PID 4520 wrote to memory of 3868 4520 Setup (21).exe 93 PID 4520 wrote to memory of 2516 4520 Setup (21).exe 95 PID 4520 wrote to memory of 2516 4520 Setup (21).exe 95 PID 4520 wrote to memory of 2516 4520 Setup (21).exe 95 PID 4520 wrote to memory of 2580 4520 Setup (21).exe 94 PID 4520 wrote to memory of 2580 4520 Setup (21).exe 94 PID 4520 wrote to memory of 2580 4520 Setup (21).exe 94 PID 4520 wrote to memory of 4704 4520 Setup (21).exe 113 PID 4520 wrote to memory of 4704 4520 Setup (21).exe 113 PID 4520 wrote to memory of 4704 4520 Setup (21).exe 113 PID 4520 wrote to memory of 2908 4520 Setup (21).exe 111 PID 4520 wrote to memory of 2908 4520 Setup (21).exe 111 PID 4520 wrote to memory of 2908 4520 Setup (21).exe 111 PID 4520 wrote to memory of 1700 4520 Setup (21).exe 107 PID 4520 wrote to memory of 1700 4520 Setup (21).exe 107 PID 4520 wrote to memory of 1700 4520 Setup (21).exe 107 PID 4520 wrote to memory of 704 4520 Setup (21).exe 116 PID 4520 wrote to memory of 704 4520 Setup (21).exe 116 PID 4520 wrote to memory of 704 4520 Setup (21).exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe"C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1996 -
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵
- Executes dropped EXE
PID:3148
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵
- Executes dropped EXE
PID:5768
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵
- Executes dropped EXE
PID:560
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:2808
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:5576
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6072
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:4456
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:5376
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:3368
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6496
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6664
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7020
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:3876
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6092
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7260
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:3948
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7632
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7956
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:5680
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7884
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7292
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:8380
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6804
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:8596
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6700
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7368
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:2232
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:4228
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:9288
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:9420
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:1272
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:10328
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6064
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:3940
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:9772
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:13016
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:6236
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7620
-
-
C:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exeC:\Users\Admin\Documents\DT2N78GRPMYmpvRDVTDMBS5Q.exe3⤵PID:7672
-
-
-
C:\Users\Admin\Documents\17zzi9W4ymEyJlvDrtXGDHje.exe"C:\Users\Admin\Documents\17zzi9W4ymEyJlvDrtXGDHje.exe"2⤵
- Executes dropped EXE
PID:4156 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\17zzi9W4ymEyJlvDrtXGDHje.exe"3⤵PID:6940
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:5444
-
-
-
-
C:\Users\Admin\Documents\byyFFZOuN7cm4zCw_aPKqqLS.exe"C:\Users\Admin\Documents\byyFFZOuN7cm4zCw_aPKqqLS.exe"2⤵
- Executes dropped EXE
PID:4188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 2363⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5500
-
-
-
C:\Users\Admin\Documents\tV_N3V2_013AsHAQEoCFdIpL.exe"C:\Users\Admin\Documents\tV_N3V2_013AsHAQEoCFdIpL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4152 -
C:\Users\Admin\Documents\tV_N3V2_013AsHAQEoCFdIpL.exe"C:\Users\Admin\Documents\tV_N3V2_013AsHAQEoCFdIpL.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5336
-
-
-
C:\Users\Admin\Documents\vfzo2KwaEv9RHBjTRtn4E7Q3.exe"C:\Users\Admin\Documents\vfzo2KwaEv9RHBjTRtn4E7Q3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2936
-
-
C:\Users\Admin\Documents\9XBL1FVV2CAACHLPncLZjIL6.exe"C:\Users\Admin\Documents\9XBL1FVV2CAACHLPncLZjIL6.exe"2⤵
- Executes dropped EXE
PID:3868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 2763⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
-
C:\Users\Admin\Documents\yDpw4mhO5F5IFboarBQOFBc1.exe"C:\Users\Admin\Documents\yDpw4mhO5F5IFboarBQOFBc1.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2580 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5664
-
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe"C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2516 -
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵
- Executes dropped EXE
PID:5060
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:5396
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵
- Executes dropped EXE
PID:5832
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:4176
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:4000
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:4224
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:4304
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:6456
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:6172
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:5612
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7100
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7872
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7868
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:3056
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:8284
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:9120
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7636
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:5408
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:2152
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:10976
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:788
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:2200
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7656
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:11344
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:11708
-
-
C:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exeC:\Users\Admin\Documents\BJBO4CcpkBkLYCEe3KTqj8xs.exe3⤵PID:7332
-
-
-
C:\Users\Admin\Documents\mxiMvFDuyoLbtStAyuz4eSQc.exe"C:\Users\Admin\Documents\mxiMvFDuyoLbtStAyuz4eSQc.exe"2⤵
- Executes dropped EXE
PID:2476
-
-
C:\Users\Admin\Documents\_BgJnth8xDgWKdpmBlLZ3BYu.exe"C:\Users\Admin\Documents\_BgJnth8xDgWKdpmBlLZ3BYu.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2416 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:3052
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:3936
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4320
-
-
-
C:\Users\Admin\Documents\RIxJtlI1mO4KtdHbutw_oFYl.exe"C:\Users\Admin\Documents\RIxJtlI1mO4KtdHbutw_oFYl.exe"2⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 2443⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3812
-
-
-
C:\Users\Admin\Documents\RgFUtFx1yNdR4gWansvo97P8.exe"C:\Users\Admin\Documents\RgFUtFx1yNdR4gWansvo97P8.exe"2⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 2364⤵
- Program crash
PID:4484
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 2844⤵
- Program crash
PID:4684
-
-
-
-
C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe"C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe"2⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\gVY5H0NzgRTmPuX2Ut3vrUGs.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))6⤵PID:6068
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F7⤵PID:3776
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:7896
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "gVY5H0NzgRTmPuX2Ut3vrUGs.exe" -F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
-
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe"C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2800 -
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵
- Executes dropped EXE
PID:2160
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵
- Executes dropped EXE
PID:5868
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:5456
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6076
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:5212
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:4656
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:2352
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:5092
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6016
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6324
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7092
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6260
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6932
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:4444
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7740
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:240
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6308
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7408
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:5328
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:1652
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:948
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:3220
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:9008
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6828
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:9928
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:9520
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:9668
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7680
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7004
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:2608
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:10828
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:2364
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:656
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:9192
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:11416
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:6372
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:2272
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:13680
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:7076
-
-
C:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exeC:\Users\Admin\Documents\YqJl8x5kXBwXkWk8q3k65b7H.exe3⤵PID:12788
-
-
-
C:\Users\Admin\Documents\snBSaKm_6tIx5t_LaayUULFs.exe"C:\Users\Admin\Documents\snBSaKm_6tIx5t_LaayUULFs.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2208
-
-
C:\Users\Admin\Documents\gWQqppHLsOQV85c5Xl04juaF.exe"C:\Users\Admin\Documents\gWQqppHLsOQV85c5Xl04juaF.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2144
-
-
C:\Users\Admin\Documents\CaELVTyyFpyxEjZHsflpNabb.exe"C:\Users\Admin\Documents\CaELVTyyFpyxEjZHsflpNabb.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe"C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe"2⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:2960
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4116
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:5272
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4120
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:1812
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:2588
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:6420
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:6188
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵
- Suspicious use of FindShellTrayWindow
PID:4636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 284⤵
- Program crash
PID:3056
-
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4144
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4924
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:7848
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:7720
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:5152
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:2920
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:5672
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:8832
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:6612
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4748
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:6888
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:9592
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:9300
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:8648
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:8008
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:6220
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:9864
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:12264
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:12084
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:8556
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:7676
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:4916
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:9480
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:12108
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:9884
-
-
C:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exeC:\Users\Admin\Documents\UJS_iMyuAHGbHFhhG_DlNeoi.exe3⤵PID:5316
-
-
-
C:\Users\Admin\Documents\iV_PxzwG1qF7YrtlZuaH8HeQ.exe"C:\Users\Admin\Documents\iV_PxzwG1qF7YrtlZuaH8HeQ.exe"2⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\Documents\iV_PxzwG1qF7YrtlZuaH8HeQ.exe"C:\Users\Admin\Documents\iV_PxzwG1qF7YrtlZuaH8HeQ.exe" -u3⤵PID:3120
-
-
-
C:\Users\Admin\Documents\Ej1cl83_jbQrfVt2pVdiFQsy.exe"C:\Users\Admin\Documents\Ej1cl83_jbQrfVt2pVdiFQsy.exe"2⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\Documents\Ej1cl83_jbQrfVt2pVdiFQsy.exe"C:\Users\Admin\Documents\Ej1cl83_jbQrfVt2pVdiFQsy.exe"3⤵PID:1460
-
-
-
C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"2⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"3⤵PID:1940
-
-
C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"C:\Users\Admin\Documents\K_Mp9BmHKL9_6gwIsSY2GOoY.exe"3⤵PID:7920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 18124⤵
- Program crash
PID:10340
-
-
-
-
C:\Users\Admin\Documents\KfprlbKV5Q9eLzenNGCwAiVA.exe"C:\Users\Admin\Documents\KfprlbKV5Q9eLzenNGCwAiVA.exe"2⤵
- Executes dropped EXE
PID:704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5440
-
-
-
C:\Users\Admin\Documents\xn5oBRgFjQPwJqowVrgmzdde.exe"C:\Users\Admin\Documents\xn5oBRgFjQPwJqowVrgmzdde.exe"2⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\is-9G5JC.tmp\xn5oBRgFjQPwJqowVrgmzdde.tmp"C:\Users\Admin\AppData\Local\Temp\is-9G5JC.tmp\xn5oBRgFjQPwJqowVrgmzdde.tmp" /SL5="$1023E,138429,56832,C:\Users\Admin\Documents\xn5oBRgFjQPwJqowVrgmzdde.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\is-CTLSL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-CTLSL.tmp\Setup.exe" /Verysilent4⤵PID:3276
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:4520
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1552
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4724
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6240
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6944
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6468
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5964
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵
- Loads dropped DLL
PID:4156
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7608
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7628
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7852
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8128
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8208
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8760
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8984
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6552
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9540
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6040
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9924
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11208
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8912
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12252
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10680
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9176
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13472
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7108
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3944
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:1700
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:2824
-
C:\Users\Admin\AppData\Roaming\1599410.exe"C:\Users\Admin\AppData\Roaming\1599410.exe"6⤵PID:6264
-
-
C:\Users\Admin\AppData\Roaming\7121890.exe"C:\Users\Admin\AppData\Roaming\7121890.exe"6⤵PID:6632
-
-
C:\Users\Admin\AppData\Roaming\7366080.exe"C:\Users\Admin\AppData\Roaming\7366080.exe"6⤵PID:3732
-
-
C:\Users\Admin\AppData\Roaming\1372057.exe"C:\Users\Admin\AppData\Roaming\1372057.exe"6⤵PID:6896
-
-
C:\Users\Admin\AppData\Roaming\6745807.exe"C:\Users\Admin\AppData\Roaming\6745807.exe"6⤵PID:6820
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:3056
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6744
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\tmpAC10_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAC10_tmp.exe"6⤵PID:6684
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:6168
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:4640
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:7252
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:7304
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:8132
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:9172
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:10420
-
-
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\is-UMDET.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-UMDET.tmp\stats.tmp" /SL5="$30336,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\is-CR937.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-CR937.tmp\Setup.exe" /Verysilent7⤵PID:5816
-
C:\Users\Admin\Documents\Q6sGqoIS8hIQCBVcWzshWh6C.exe"C:\Users\Admin\Documents\Q6sGqoIS8hIQCBVcWzshWh6C.exe"8⤵PID:7172
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:6560
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:3952
-
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe"C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe"8⤵PID:5904
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:7288
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:5724
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:5376
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:1196
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:9312
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:8332
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:2868
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:1356
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:10104
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:3968
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:10008
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:9804
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:12032
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:9468
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:9428
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:12020
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:244
-
-
C:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exeC:\Users\Admin\Documents\cG10YzPh7Dtjl1NlVD8rgly6.exe9⤵PID:2256
-
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe"C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe"8⤵PID:5020
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:824
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:7860
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:4056
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:9456
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:10136
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:3788
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:10988
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:10152
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:10688
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:1228
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:9016
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:11800
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:12964
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:12936
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:10608
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:6780
-
-
C:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exeC:\Users\Admin\Documents\Xsxbjryth2SEI5uPQRpxKqSJ.exe9⤵PID:6744
-
-
-
C:\Users\Admin\Documents\dN6Y_1iVHfzoHCJ5pO9H3MqV.exe"C:\Users\Admin\Documents\dN6Y_1iVHfzoHCJ5pO9H3MqV.exe"8⤵PID:7568
-
-
C:\Users\Admin\Documents\ZjxKtCsnnF0rb9Bb9EScjTvN.exe"C:\Users\Admin\Documents\ZjxKtCsnnF0rb9Bb9EScjTvN.exe"8⤵PID:3340
-
-
C:\Users\Admin\Documents\4Tz3z18jD49H89kjxQtDDDSr.exe"C:\Users\Admin\Documents\4Tz3z18jD49H89kjxQtDDDSr.exe"8⤵PID:5200
-
-
C:\Users\Admin\Documents\1f61a72ASbFhdZyJrrIQ42UR.exe"C:\Users\Admin\Documents\1f61a72ASbFhdZyJrrIQ42UR.exe"8⤵PID:664
-
-
C:\Users\Admin\Documents\2_uNZPDBJps7NEBeViGoq12Q.exe"C:\Users\Admin\Documents\2_uNZPDBJps7NEBeViGoq12Q.exe"8⤵PID:4324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2769⤵
- Program crash
PID:8728
-
-
-
C:\Users\Admin\Documents\vGfTcr4zT4GzX3c1KZ51TN5V.exe"C:\Users\Admin\Documents\vGfTcr4zT4GzX3c1KZ51TN5V.exe"8⤵PID:4232
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\vGfTcr4zT4GzX3c1KZ51TN5V.exe"9⤵PID:6416
-
-
-
C:\Users\Admin\Documents\u8zt5ACrfv68y2mM0Ct2tKUH.exe"C:\Users\Admin\Documents\u8zt5ACrfv68y2mM0Ct2tKUH.exe"8⤵PID:5924
-
-
C:\Users\Admin\Documents\HatdEawZR64QTcJ0B5D4oDUN.exe"C:\Users\Admin\Documents\HatdEawZR64QTcJ0B5D4oDUN.exe"8⤵PID:3280
-
-
C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe"C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe"8⤵PID:7648
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:8740
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\ASF1Km1AAd0fPGb0ymKciSOx.exe" ) do taskkill /iM "%~NXm" -F10⤵PID:6156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "ASF1Km1AAd0fPGb0ymKciSOx.exe" -F11⤵
- Kills process with taskkill
PID:9740
-
-
-
-
-
C:\Users\Admin\Documents\uranRngNuGGc71VwGHAlrHuH.exe"C:\Users\Admin\Documents\uranRngNuGGc71VwGHAlrHuH.exe"8⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 2369⤵
- Program crash
PID:2140
-
-
-
C:\Users\Admin\Documents\PkeLRffTgHjC92kwo8_vApvE.exe"C:\Users\Admin\Documents\PkeLRffTgHjC92kwo8_vApvE.exe"8⤵PID:7460
-
C:\Users\Admin\Documents\PkeLRffTgHjC92kwo8_vApvE.exe"C:\Users\Admin\Documents\PkeLRffTgHjC92kwo8_vApvE.exe"9⤵PID:14192
-
-
-
C:\Users\Admin\Documents\mFosw6XSlbV7GaEmxYKFmn1i.exe"C:\Users\Admin\Documents\mFosw6XSlbV7GaEmxYKFmn1i.exe"8⤵PID:7072
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe"C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe"8⤵PID:7148
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:8748
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:6672
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:8136
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:5548
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:10888
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:2504
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:7420
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:2796
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:6024
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:9508
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:13892
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:9724
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:13652
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:14044
-
-
C:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exeC:\Users\Admin\Documents\sFBx6M39FegPj6ZfSpXLvrs5.exe9⤵PID:12420
-
-
-
C:\Users\Admin\Documents\hr63AsrdGHVWJyOGRkqaoSP1.exe"C:\Users\Admin\Documents\hr63AsrdGHVWJyOGRkqaoSP1.exe"8⤵PID:7236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 2409⤵
- Program crash
PID:11124
-
-
-
C:\Users\Admin\Documents\BZd18AbjFfZbxB0F77nvhkRq.exe"C:\Users\Admin\Documents\BZd18AbjFfZbxB0F77nvhkRq.exe"8⤵PID:7424
-
C:\Users\Admin\Documents\BZd18AbjFfZbxB0F77nvhkRq.exe"C:\Users\Admin\Documents\BZd18AbjFfZbxB0F77nvhkRq.exe"9⤵PID:8780
-
-
-
C:\Users\Admin\Documents\CPldRqJXE_NqUikGnEG_lYKg.exe"C:\Users\Admin\Documents\CPldRqJXE_NqUikGnEG_lYKg.exe"8⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:9124
-
-
-
C:\Users\Admin\Documents\kCd4_o58VL5TSpB8d14GZLLU.exe"C:\Users\Admin\Documents\kCd4_o58VL5TSpB8d14GZLLU.exe"8⤵PID:6656
-
C:\Users\Admin\AppData\Roaming\2800332.exe"C:\Users\Admin\AppData\Roaming\2800332.exe"9⤵PID:14000
-
-
-
C:\Users\Admin\Documents\4xA0aCoh8UY5lRomheUrY0l6.exe"C:\Users\Admin\Documents\4xA0aCoh8UY5lRomheUrY0l6.exe"8⤵PID:5240
-
-
C:\Users\Admin\Documents\VM5YXE2zdiQJJK1Tal3cIZ86.exe"C:\Users\Admin\Documents\VM5YXE2zdiQJJK1Tal3cIZ86.exe"8⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\is-AFS5S.tmp\VM5YXE2zdiQJJK1Tal3cIZ86.tmp"C:\Users\Admin\AppData\Local\Temp\is-AFS5S.tmp\VM5YXE2zdiQJJK1Tal3cIZ86.tmp" /SL5="$40320,138429,56832,C:\Users\Admin\Documents\VM5YXE2zdiQJJK1Tal3cIZ86.exe"9⤵PID:8672
-
C:\Users\Admin\AppData\Local\Temp\is-L9G1C.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-L9G1C.tmp\Setup.exe" /Verysilent10⤵PID:2576
-
-
-
-
C:\Users\Admin\Documents\YIf4EiMOcPMlHUUdaptKhCN2.exe"C:\Users\Admin\Documents\YIf4EiMOcPMlHUUdaptKhCN2.exe"8⤵PID:3724
-
C:\Users\Admin\Documents\YIf4EiMOcPMlHUUdaptKhCN2.exe"C:\Users\Admin\Documents\YIf4EiMOcPMlHUUdaptKhCN2.exe" -u9⤵PID:8720
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:5624
-
-
-
-
-
C:\Users\Admin\Documents\LsPiwlMgqCMPvIQyLkWoXdJ8.exe"C:\Users\Admin\Documents\LsPiwlMgqCMPvIQyLkWoXdJ8.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Users\Admin\AppData\Roaming\3540841.exe"C:\Users\Admin\AppData\Roaming\3540841.exe"3⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3204 -s 23644⤵
- Executes dropped EXE
- Program crash
PID:5320
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3204 -s 23644⤵
- Program crash
PID:3856
-
-
-
C:\Users\Admin\AppData\Roaming\3043510.exe"C:\Users\Admin\AppData\Roaming\3043510.exe"3⤵PID:5320
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:6352
-
-
-
C:\Users\Admin\AppData\Roaming\7754986.exe"C:\Users\Admin\AppData\Roaming\7754986.exe"3⤵
- Executes dropped EXE
PID:1928
-
-
C:\Users\Admin\AppData\Roaming\2738789.exe"C:\Users\Admin\AppData\Roaming\2738789.exe"3⤵PID:5812
-
-
C:\Users\Admin\AppData\Roaming\8121491.exe"C:\Users\Admin\AppData\Roaming\8121491.exe"3⤵PID:5488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 32404⤵
- Program crash
PID:8224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 32404⤵
- Program crash
PID:10848
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv R3q930x020WnyfI9gsy3Ow.0.21⤵
- Modifies data under HKEY_USERS
PID:4920
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:3044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3868 -ip 38681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 704 -ip 7041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4188 -ip 41881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1176 -ip 11761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1560 -ip 15601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4608
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 4603⤵
- Program crash
PID:1460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2328 -ip 23281⤵PID:6016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Executes dropped EXE
PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6420 -ip 64201⤵PID:5692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4636 -ip 46361⤵PID:2008
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:1200 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:6696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 4483⤵
- Program crash
PID:7404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 4483⤵
- Program crash
PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\54B.exeC:\Users\Admin\AppData\Local\Temp\54B.exe1⤵PID:5884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 2402⤵
- Program crash
PID:8668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6696 -ip 66961⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 476 -ip 4761⤵PID:3092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4324 -ip 43241⤵PID:3232
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 3204 -ip 32041⤵PID:8572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5884 -ip 58841⤵PID:9168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7292 -ip 72921⤵PID:6252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5200 -ip 52001⤵PID:6044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2068 -ip 20681⤵PID:6100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7236 -ip 72361⤵PID:10468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5488 -ip 54881⤵PID:8180
-
C:\Users\Admin\AppData\Local\Temp\8A41.exeC:\Users\Admin\AppData\Local\Temp\8A41.exe1⤵PID:11984
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7100
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:13364
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6276
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:6128
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:10456
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:13348
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:13404
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:13428
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:12436