Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
86s -
max time network
1816s -
platform
windows11_x64 -
resource
win11 -
submitted
31/08/2021, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (23).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
metasploit
windows/single_exec
Extracted
redline
31.08
95.181.152.47:15089
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
NORMAN2
45.14.49.184:27587
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral16/memory/3108-283-0x0000000004360000-0x0000000004C86000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6572 6064 rundll32.exe 196 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5140 6064 rUNdlL32.eXe 196 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 24 IoCs
resource yara_rule behavioral16/memory/4960-301-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/4960-297-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/2260-327-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral16/memory/5052-341-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/1276-336-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/1276-330-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/2260-319-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5412-390-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/4960-377-0x0000000005450000-0x00000000059F6000-memory.dmp family_redline behavioral16/memory/5164-376-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/3552-365-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5052-411-0x00000000056F0000-0x0000000005D08000-memory.dmp family_redline behavioral16/memory/5600-428-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5164-431-0x0000000005120000-0x0000000005738000-memory.dmp family_redline behavioral16/memory/5808-447-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5880-449-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/1844-473-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5188-481-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/6136-469-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/4684-489-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/3536-502-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/3120-512-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/2796-510-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/3120-621-0x0000000005180000-0x0000000005798000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
description pid Process procid_target PID 1584 created 4684 1584 WerFault.exe 91 PID 1896 created 3108 1896 WerFault.exe 180 PID 5240 created 4468 5240 WerFault.exe 93 PID 5652 created 3552 5652 WerFault.exe 138 PID 5660 created 1704 5660 WerFault.exe 114 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral16/memory/1704-389-0x0000000000830000-0x0000000000903000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 39 IoCs
pid Process 4684 bp8sPtgplOVJcgIm9gwHrgR9.exe 4456 Va24Fw4UQaiCSSJBPN2pAezv.exe 4468 3uuxDQlr3POrnqbXNjH_HvvN.exe 4544 bEiEv6CCStPF44dutp6OHiEw.exe 3748 miUI5N0j8j8bal5ToJJYkFcE.exe 4736 tLyE6VMX6AdGbuKl2r6e5ypk.exe 5064 2nizc9Ig3YzzAFuMvHeBxNrT.exe 3628 JDFm1xBIUGinEmTtXDlXF5Tr.exe 3028 Tkz2tw2Ikq0ZlGqhactYkYYB.exe 3876 45ZPF7egvVfBxeAQjUFHy18p.exe 3952 rRO59SQ9UAFbloHJPj4C6wlK.exe 4812 hlUtPkvEBg2_SiL1lT8H_1D8.exe 668 3gMtdclcRyA69hMdvS_jK7PV.exe 4724 _58o95LT7pvVL7rTeIPaMzct.exe 828 Kzts6vSvUX_Za3RZSD6GZDjS.exe 3060 sKjmZqYpGghbuj3LPBcjxnkT.exe 4556 ALc49xEH0T_5GvcEm8z5H3SB.exe 1016 gK22b4bHyBcM1k71nUqTMzgZ.exe 1392 W43I0JM0dzaQqsQxQVfD8Ao3.exe 1704 xAmbN2twlC8gvk9V305H5VzL.exe 3108 DiqeUTrSs85lATSZtQKDBB5N.exe 1384 Vohv7PEOQ2eueA6uK3eiaMvQ.exe 1852 4lXhZuNg81VGf4XpJu8x9ZdA.exe 3504 4lXhZuNg81VGf4XpJu8x9ZdA.tmp 3904 inst001.exe 1308 cutm3.exe 3112 pXOAd9684UKmolRzNcjQ4WiH.exe 3056 md8_8eus.exe 4868 KBAvfsr.exe 1432 3gMtdclcRyA69hMdvS_jK7PV.exe 4960 bEiEv6CCStPF44dutp6OHiEw.exe 2260 W43I0JM0dzaQqsQxQVfD8Ao3.exe 1276 3gMtdclcRyA69hMdvS_jK7PV.exe 1528 Kzts6vSvUX_Za3RZSD6GZDjS.exe 5052 _58o95LT7pvVL7rTeIPaMzct.exe 3552 bEiEv6CCStPF44dutp6OHiEw.exe 5164 W43I0JM0dzaQqsQxQVfD8Ao3.exe 5412 _58o95LT7pvVL7rTeIPaMzct.exe 5372 3gMtdclcRyA69hMdvS_jK7PV.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2nizc9Ig3YzzAFuMvHeBxNrT.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2nizc9Ig3YzzAFuMvHeBxNrT.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 45ZPF7egvVfBxeAQjUFHy18p.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 45ZPF7egvVfBxeAQjUFHy18p.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Va24Fw4UQaiCSSJBPN2pAezv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Va24Fw4UQaiCSSJBPN2pAezv.exe -
Loads dropped DLL 2 IoCs
pid Process 3504 4lXhZuNg81VGf4XpJu8x9ZdA.tmp 3504 4lXhZuNg81VGf4XpJu8x9ZdA.tmp -
resource yara_rule behavioral16/files/0x000200000002b1e5-167.dat themida behavioral16/files/0x000200000002b200-182.dat themida behavioral16/files/0x000200000002b1f1-177.dat themida behavioral16/files/0x000200000002b1f1-235.dat themida behavioral16/files/0x000200000002b1e5-233.dat themida behavioral16/files/0x000200000002b200-219.dat themida behavioral16/memory/3876-299-0x0000000000EB0000-0x0000000000EB1000-memory.dmp themida behavioral16/memory/4456-300-0x00000000001C0000-0x00000000001C1000-memory.dmp themida behavioral16/memory/5064-307-0x0000000000A60000-0x0000000000A61000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2nizc9Ig3YzzAFuMvHeBxNrT.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 45ZPF7egvVfBxeAQjUFHy18p.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Va24Fw4UQaiCSSJBPN2pAezv.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 378 ipinfo.io 11 ipinfo.io 54 ipinfo.io 172 ipinfo.io 181 ipinfo.io 687 ipinfo.io 832 ipinfo.io 849 ipinfo.io 83 ip-api.com 119 ipinfo.io 121 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3876 45ZPF7egvVfBxeAQjUFHy18p.exe 4456 Va24Fw4UQaiCSSJBPN2pAezv.exe 5064 2nizc9Ig3YzzAFuMvHeBxNrT.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 4544 set thread context of 4960 4544 bEiEv6CCStPF44dutp6OHiEw.exe 131 PID 1392 set thread context of 2260 1392 W43I0JM0dzaQqsQxQVfD8Ao3.exe 129 PID 668 set thread context of 1276 668 3gMtdclcRyA69hMdvS_jK7PV.exe 145 PID 828 set thread context of 1528 828 Kzts6vSvUX_Za3RZSD6GZDjS.exe 139 PID 4724 set thread context of 5052 4724 _58o95LT7pvVL7rTeIPaMzct.exe 143 PID 4544 set thread context of 3552 4544 bEiEv6CCStPF44dutp6OHiEw.exe 138 PID 1392 set thread context of 5164 1392 W43I0JM0dzaQqsQxQVfD8Ao3.exe 146 PID 4724 set thread context of 5412 4724 _58o95LT7pvVL7rTeIPaMzct.exe 147 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe gK22b4bHyBcM1k71nUqTMzgZ.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe gK22b4bHyBcM1k71nUqTMzgZ.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe gK22b4bHyBcM1k71nUqTMzgZ.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini gK22b4bHyBcM1k71nUqTMzgZ.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Tkz2tw2Ikq0ZlGqhactYkYYB.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Tkz2tw2Ikq0ZlGqhactYkYYB.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe gK22b4bHyBcM1k71nUqTMzgZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 23 IoCs
pid pid_target Process procid_target 3940 4684 WerFault.exe 91 2560 3108 WerFault.exe 109 5488 4468 WerFault.exe 93 5956 1704 WerFault.exe 114 5928 3552 WerFault.exe 138 1488 6712 WerFault.exe 222 7440 6712 WerFault.exe 222 5736 7448 WerFault.exe 254 7504 1864 WerFault.exe 289 5540 1864 WerFault.exe 289 2776 5276 WerFault.exe 283 8392 8108 WerFault.exe 300 9888 1568 WerFault.exe 217 5896 10092 WerFault.exe 346 1168 3580 WerFault.exe 389 8720 6836 WerFault.exe 311 9392 7644 WerFault.exe 395 10500 1384 WerFault.exe 164 12224 4840 WerFault.exe 193 10348 3376 WerFault.exe 330 17388 7840 WerFault.exe 248 17380 6380 WerFault.exe 225 11252 6380 WerFault.exe 225 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Kzts6vSvUX_Za3RZSD6GZDjS.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Kzts6vSvUX_Za3RZSD6GZDjS.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Kzts6vSvUX_Za3RZSD6GZDjS.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2004 schtasks.exe 1192 schtasks.exe 6492 schtasks.exe 8672 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 5076 timeout.exe 10508 timeout.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
pid Process 5376 taskkill.exe 9160 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 9816 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 1072 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 118 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 120 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 179 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 311 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 847 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3068 Setup (23).exe 3068 Setup (23).exe 3940 WerFault.exe 3940 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 1528 Kzts6vSvUX_Za3RZSD6GZDjS.exe 1528 Kzts6vSvUX_Za3RZSD6GZDjS.exe 5488 WerFault.exe 5488 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1528 Kzts6vSvUX_Za3RZSD6GZDjS.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4736 tLyE6VMX6AdGbuKl2r6e5ypk.exe Token: SeRestorePrivilege 3940 WerFault.exe Token: SeBackupPrivilege 3940 WerFault.exe Token: SeDebugPrivilege 3112 pXOAd9684UKmolRzNcjQ4WiH.exe Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3504 4lXhZuNg81VGf4XpJu8x9ZdA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3952 3068 Setup (23).exe 92 PID 3068 wrote to memory of 3952 3068 Setup (23).exe 92 PID 3068 wrote to memory of 4684 3068 Setup (23).exe 91 PID 3068 wrote to memory of 4684 3068 Setup (23).exe 91 PID 3068 wrote to memory of 4684 3068 Setup (23).exe 91 PID 3068 wrote to memory of 4456 3068 Setup (23).exe 90 PID 3068 wrote to memory of 4456 3068 Setup (23).exe 90 PID 3068 wrote to memory of 4456 3068 Setup (23).exe 90 PID 3068 wrote to memory of 4468 3068 Setup (23).exe 93 PID 3068 wrote to memory of 4468 3068 Setup (23).exe 93 PID 3068 wrote to memory of 4468 3068 Setup (23).exe 93 PID 3068 wrote to memory of 4544 3068 Setup (23).exe 108 PID 3068 wrote to memory of 4544 3068 Setup (23).exe 108 PID 3068 wrote to memory of 4544 3068 Setup (23).exe 108 PID 3068 wrote to memory of 3748 3068 Setup (23).exe 107 PID 3068 wrote to memory of 3748 3068 Setup (23).exe 107 PID 3068 wrote to memory of 3748 3068 Setup (23).exe 107 PID 3068 wrote to memory of 4736 3068 Setup (23).exe 106 PID 3068 wrote to memory of 4736 3068 Setup (23).exe 106 PID 3068 wrote to memory of 5064 3068 Setup (23).exe 105 PID 3068 wrote to memory of 5064 3068 Setup (23).exe 105 PID 3068 wrote to memory of 5064 3068 Setup (23).exe 105 PID 3068 wrote to memory of 3628 3068 Setup (23).exe 104 PID 3068 wrote to memory of 3628 3068 Setup (23).exe 104 PID 3068 wrote to memory of 3628 3068 Setup (23).exe 104 PID 3068 wrote to memory of 3028 3068 Setup (23).exe 102 PID 3068 wrote to memory of 3028 3068 Setup (23).exe 102 PID 3068 wrote to memory of 3028 3068 Setup (23).exe 102 PID 3068 wrote to memory of 3876 3068 Setup (23).exe 103 PID 3068 wrote to memory of 3876 3068 Setup (23).exe 103 PID 3068 wrote to memory of 3876 3068 Setup (23).exe 103 PID 3068 wrote to memory of 4812 3068 Setup (23).exe 101 PID 3068 wrote to memory of 4812 3068 Setup (23).exe 101 PID 3068 wrote to memory of 4812 3068 Setup (23).exe 101 PID 3068 wrote to memory of 668 3068 Setup (23).exe 100 PID 3068 wrote to memory of 668 3068 Setup (23).exe 100 PID 3068 wrote to memory of 668 3068 Setup (23).exe 100 PID 3068 wrote to memory of 4724 3068 Setup (23).exe 97 PID 3068 wrote to memory of 4724 3068 Setup (23).exe 97 PID 3068 wrote to memory of 4724 3068 Setup (23).exe 97 PID 3068 wrote to memory of 828 3068 Setup (23).exe 98 PID 3068 wrote to memory of 828 3068 Setup (23).exe 98 PID 3068 wrote to memory of 828 3068 Setup (23).exe 98 PID 3068 wrote to memory of 3060 3068 Setup (23).exe 96 PID 3068 wrote to memory of 3060 3068 Setup (23).exe 96 PID 3068 wrote to memory of 3060 3068 Setup (23).exe 96 PID 3068 wrote to memory of 4556 3068 Setup (23).exe 99 PID 3068 wrote to memory of 4556 3068 Setup (23).exe 99 PID 3068 wrote to memory of 4556 3068 Setup (23).exe 99 PID 3068 wrote to memory of 1016 3068 Setup (23).exe 95 PID 3068 wrote to memory of 1016 3068 Setup (23).exe 95 PID 3068 wrote to memory of 1016 3068 Setup (23).exe 95 PID 3068 wrote to memory of 1392 3068 Setup (23).exe 115 PID 3068 wrote to memory of 1392 3068 Setup (23).exe 115 PID 3068 wrote to memory of 1392 3068 Setup (23).exe 115 PID 3068 wrote to memory of 1704 3068 Setup (23).exe 114 PID 3068 wrote to memory of 1704 3068 Setup (23).exe 114 PID 3068 wrote to memory of 1704 3068 Setup (23).exe 114 PID 3068 wrote to memory of 3108 3068 Setup (23).exe 109 PID 3068 wrote to memory of 3108 3068 Setup (23).exe 109 PID 3068 wrote to memory of 3108 3068 Setup (23).exe 109 PID 3068 wrote to memory of 1384 3068 Setup (23).exe 117 PID 3068 wrote to memory of 1384 3068 Setup (23).exe 117 PID 3068 wrote to memory of 1384 3068 Setup (23).exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (23).exe"C:\Users\Admin\AppData\Local\Temp\Setup (23).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\Documents\Va24Fw4UQaiCSSJBPN2pAezv.exe"C:\Users\Admin\Documents\Va24Fw4UQaiCSSJBPN2pAezv.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4456
-
-
C:\Users\Admin\Documents\bp8sPtgplOVJcgIm9gwHrgR9.exe"C:\Users\Admin\Documents\bp8sPtgplOVJcgIm9gwHrgR9.exe"2⤵
- Executes dropped EXE
PID:4684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
-
C:\Users\Admin\Documents\rRO59SQ9UAFbloHJPj4C6wlK.exe"C:\Users\Admin\Documents\rRO59SQ9UAFbloHJPj4C6wlK.exe"2⤵
- Executes dropped EXE
PID:3952
-
-
C:\Users\Admin\Documents\3uuxDQlr3POrnqbXNjH_HvvN.exe"C:\Users\Admin\Documents\3uuxDQlr3POrnqbXNjH_HvvN.exe"2⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 2403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:5488
-
-
-
C:\Users\Admin\Documents\gK22b4bHyBcM1k71nUqTMzgZ.exe"C:\Users\Admin\Documents\gK22b4bHyBcM1k71nUqTMzgZ.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1016 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:3904
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:1308
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:3056
-
-
-
C:\Users\Admin\Documents\sKjmZqYpGghbuj3LPBcjxnkT.exe"C:\Users\Admin\Documents\sKjmZqYpGghbuj3LPBcjxnkT.exe"2⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\Documents\sKjmZqYpGghbuj3LPBcjxnkT.exe"C:\Users\Admin\Documents\sKjmZqYpGghbuj3LPBcjxnkT.exe"3⤵PID:1568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 18284⤵
- Program crash
PID:9888
-
-
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe"C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4724 -
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵
- Executes dropped EXE
PID:5052
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵
- Executes dropped EXE
PID:5412
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:5808
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:5188
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:2796
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:5136
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:1036
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:2864
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:3232
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:3824
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6532
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:7060
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:2168
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:7800
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6180
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6672
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:4516
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6316
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:7240
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:4972
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:5972
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6104
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:10036
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:9720
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:9284
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:9316
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:2760
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:11184
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:9500
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6396
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:964
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6932
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:2976
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:7636
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:12520
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:13292
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:9340
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6404
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:5332
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:16824
-
-
C:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exeC:\Users\Admin\Documents\_58o95LT7pvVL7rTeIPaMzct.exe3⤵PID:6784
-
-
-
C:\Users\Admin\Documents\Kzts6vSvUX_Za3RZSD6GZDjS.exe"C:\Users\Admin\Documents\Kzts6vSvUX_Za3RZSD6GZDjS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:828 -
C:\Users\Admin\Documents\Kzts6vSvUX_Za3RZSD6GZDjS.exe"C:\Users\Admin\Documents\Kzts6vSvUX_Za3RZSD6GZDjS.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1528
-
-
-
C:\Users\Admin\Documents\ALc49xEH0T_5GvcEm8z5H3SB.exe"C:\Users\Admin\Documents\ALc49xEH0T_5GvcEm8z5H3SB.exe"2⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:4868
-
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe"C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:668 -
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵
- Executes dropped EXE
PID:1276
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵
- Executes dropped EXE
PID:5372
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:5772
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:1844
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:5608
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:3120
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:2228
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:2292
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:2544
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:6472
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:4408
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:7484
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:6944
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:2920
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:6320
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:8100
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵
- Executes dropped EXE
PID:1432
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:6540
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:3420
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:4152
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:4420
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:9640
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:7268
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 284⤵
- Program crash
PID:1168
-
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:7284
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:10160
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:8924
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:11244
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:10304
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:6224
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:3924
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:8756
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:10228
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:10984
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:12460
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:13212
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:5664
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:17348
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:14224
-
-
C:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exeC:\Users\Admin\Documents\3gMtdclcRyA69hMdvS_jK7PV.exe3⤵PID:23908
-
-
-
C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe"C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe"2⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\hlUtPkvEBg2_SiL1lT8H_1D8.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵PID:4900
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))6⤵PID:5636
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F7⤵PID:5676
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:6936
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "hlUtPkvEBg2_SiL1lT8H_1D8.exe" -F5⤵
- Kills process with taskkill
PID:5376
-
-
-
-
-
C:\Users\Admin\Documents\Tkz2tw2Ikq0ZlGqhactYkYYB.exe"C:\Users\Admin\Documents\Tkz2tw2Ikq0ZlGqhactYkYYB.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3028 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1192
-
-
-
C:\Users\Admin\Documents\45ZPF7egvVfBxeAQjUFHy18p.exe"C:\Users\Admin\Documents\45ZPF7egvVfBxeAQjUFHy18p.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3876
-
-
C:\Users\Admin\Documents\JDFm1xBIUGinEmTtXDlXF5Tr.exe"C:\Users\Admin\Documents\JDFm1xBIUGinEmTtXDlXF5Tr.exe"2⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\JDFm1xBIUGinEmTtXDlXF5Tr.exe"3⤵PID:3060
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:5076
-
-
-
-
C:\Users\Admin\Documents\2nizc9Ig3YzzAFuMvHeBxNrT.exe"C:\Users\Admin\Documents\2nizc9Ig3YzzAFuMvHeBxNrT.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5064
-
-
C:\Users\Admin\Documents\tLyE6VMX6AdGbuKl2r6e5ypk.exe"C:\Users\Admin\Documents\tLyE6VMX6AdGbuKl2r6e5ypk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Users\Admin\Documents\miUI5N0j8j8bal5ToJJYkFcE.exe"C:\Users\Admin\Documents\miUI5N0j8j8bal5ToJJYkFcE.exe"2⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\Documents\miUI5N0j8j8bal5ToJJYkFcE.exe"C:\Users\Admin\Documents\miUI5N0j8j8bal5ToJJYkFcE.exe"3⤵PID:5352
-
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe"C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4544 -
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵
- Executes dropped EXE
PID:4960
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵
- Executes dropped EXE
PID:3552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 284⤵
- Program crash
PID:5928
-
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:5600
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:6136
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:3536
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:5208
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:1436
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:2468
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:6720
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:7016
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:7604
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:6772
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:7984
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:4780
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:5312
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:8088
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:5748
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:8316
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:10012
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:6132
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:5040
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:8120
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:8900
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:11084
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:3480
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:6484
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:9876
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:10412
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:3488
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:10424
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:13156
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:14480
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:3688
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:12528
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:15324
-
-
C:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exeC:\Users\Admin\Documents\bEiEv6CCStPF44dutp6OHiEw.exe3⤵PID:7336
-
-
-
C:\Users\Admin\Documents\DiqeUTrSs85lATSZtQKDBB5N.exe"C:\Users\Admin\Documents\DiqeUTrSs85lATSZtQKDBB5N.exe"2⤵
- Executes dropped EXE
PID:3108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2560
-
-
-
C:\Users\Admin\Documents\xAmbN2twlC8gvk9V305H5VzL.exe"C:\Users\Admin\Documents\xAmbN2twlC8gvk9V305H5VzL.exe"2⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2403⤵
- Program crash
PID:5956
-
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe"C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1392 -
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵
- Executes dropped EXE
PID:2260
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵
- Executes dropped EXE
PID:5164
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5880
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:4684
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:3108
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5084
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5848
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:4856
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:6564
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:7352
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:7256
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:8116
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:7524
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:7312
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5232
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 284⤵
- Program crash
PID:2776
-
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:3936
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:8108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 284⤵
- Program crash
PID:8392
-
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:4384
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:9668
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:4356
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:9288
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5672
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:6876
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:6852
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:9956
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:3128
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:3760
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:4952
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:5048
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:13580
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:6240
-
-
C:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exeC:\Users\Admin\Documents\W43I0JM0dzaQqsQxQVfD8Ao3.exe3⤵PID:16032
-
-
-
C:\Users\Admin\Documents\Vohv7PEOQ2eueA6uK3eiaMvQ.exe"C:\Users\Admin\Documents\Vohv7PEOQ2eueA6uK3eiaMvQ.exe"2⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\Documents\Vohv7PEOQ2eueA6uK3eiaMvQ.exe"C:\Users\Admin\Documents\Vohv7PEOQ2eueA6uK3eiaMvQ.exe" -u3⤵PID:1432
-
-
-
C:\Users\Admin\Documents\4lXhZuNg81VGf4XpJu8x9ZdA.exe"C:\Users\Admin\Documents\4lXhZuNg81VGf4XpJu8x9ZdA.exe"2⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\is-GDKB0.tmp\4lXhZuNg81VGf4XpJu8x9ZdA.tmp"C:\Users\Admin\AppData\Local\Temp\is-GDKB0.tmp\4lXhZuNg81VGf4XpJu8x9ZdA.tmp" /SL5="$102D4,138429,56832,C:\Users\Admin\Documents\4lXhZuNg81VGf4XpJu8x9ZdA.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\is-IV8K1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-IV8K1.tmp\Setup.exe" /Verysilent4⤵PID:2052
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:3692
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3744
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2808
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7040
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7360
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7892
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7300
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4548
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7124
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6572
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7436
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7632
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5868
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5784
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9004
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10052
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8472
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5952
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6888
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4140
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6080
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5108
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8584
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9204
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11008
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6560
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3228
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10908
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11608
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9304
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:17100
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11972
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:1436
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:5764
-
C:\Users\Admin\AppData\Roaming\4646691.exe"C:\Users\Admin\AppData\Roaming\4646691.exe"6⤵PID:6380
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6380 -s 21527⤵
- Program crash
PID:17380
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6380 -s 21527⤵
- Program crash
PID:11252
-
-
-
C:\Users\Admin\AppData\Roaming\2736613.exe"C:\Users\Admin\AppData\Roaming\2736613.exe"6⤵PID:7088
-
-
C:\Users\Admin\AppData\Roaming\3661607.exe"C:\Users\Admin\AppData\Roaming\3661607.exe"6⤵PID:6644
-
-
C:\Users\Admin\AppData\Roaming\8547604.exe"C:\Users\Admin\AppData\Roaming\8547604.exe"6⤵PID:3076
-
-
C:\Users\Admin\AppData\Roaming\3900232.exe"C:\Users\Admin\AppData\Roaming\3900232.exe"6⤵PID:7840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 20727⤵
- Program crash
PID:17388
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:4736
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6228
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\tmp241E_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp241E_tmp.exe"6⤵PID:5592
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:7628
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:8124
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:7000
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:736
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:9816
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:9808
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:9412
-
-
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:5584
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\is-9CQN6.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-9CQN6.tmp\stats.tmp" /SL5="$303E0,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\is-2GQM8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2GQM8.tmp\Setup.exe" /Verysilent7⤵PID:5304
-
C:\Users\Admin\Documents\jCo383bSc_G04QcV9MABH0Rj.exe"C:\Users\Admin\Documents\jCo383bSc_G04QcV9MABH0Rj.exe"8⤵PID:8012
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:6492
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:8672
-
-
-
C:\Users\Admin\Documents\foWRW3KSjKCvz9JBDX1J0aky.exe"C:\Users\Admin\Documents\foWRW3KSjKCvz9JBDX1J0aky.exe"8⤵PID:6836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 2769⤵
- Program crash
PID:8720
-
-
-
C:\Users\Admin\Documents\JXMHF8_O1xzaY4xo45akGH1X.exe"C:\Users\Admin\Documents\JXMHF8_O1xzaY4xo45akGH1X.exe"8⤵PID:5496
-
-
C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe"C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe"8⤵PID:8008
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:9688
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\ci79RaZPOSWXdH9qrVWfh6ge.exe" ) do taskkill /iM "%~NXm" -F10⤵PID:10996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "ci79RaZPOSWXdH9qrVWfh6ge.exe" -F11⤵
- Kills process with taskkill
PID:9160
-
-
-
-
-
C:\Users\Admin\Documents\gDVYoXCVuyXP5eHYzBZtDPm2.exe"C:\Users\Admin\Documents\gDVYoXCVuyXP5eHYzBZtDPm2.exe"8⤵PID:3396
-
-
C:\Users\Admin\Documents\3qHQ9FVfPegkUiZwLjg6fuJs.exe"C:\Users\Admin\Documents\3qHQ9FVfPegkUiZwLjg6fuJs.exe"8⤵PID:6440
-
C:\Users\Admin\AppData\Roaming\2946936.exe"C:\Users\Admin\AppData\Roaming\2946936.exe"9⤵PID:5988
-
-
C:\Users\Admin\AppData\Roaming\5404519.exe"C:\Users\Admin\AppData\Roaming\5404519.exe"9⤵PID:5788
-
-
C:\Users\Admin\AppData\Roaming\7751212.exe"C:\Users\Admin\AppData\Roaming\7751212.exe"9⤵PID:4508
-
-
C:\Users\Admin\AppData\Roaming\1985168.exe"C:\Users\Admin\AppData\Roaming\1985168.exe"9⤵PID:10876
-
-
C:\Users\Admin\AppData\Roaming\6294144.exe"C:\Users\Admin\AppData\Roaming\6294144.exe"9⤵PID:8188
-
-
-
C:\Users\Admin\Documents\8jHLub8zLOf1Jj_jnVaW4pIj.exe"C:\Users\Admin\Documents\8jHLub8zLOf1Jj_jnVaW4pIj.exe"8⤵PID:8548
-
C:\Users\Admin\Documents\8jHLub8zLOf1Jj_jnVaW4pIj.exe"C:\Users\Admin\Documents\8jHLub8zLOf1Jj_jnVaW4pIj.exe" -u9⤵PID:5920
-
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe"C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe"8⤵PID:8476
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:7644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 2810⤵
- Program crash
PID:9392
-
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:5648
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:9276
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:8084
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:11148
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:10256
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:9912
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:7808
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:4760
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:8764
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:11048
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:7440
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:72
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:11068
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:12300
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:13476
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:7584
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:12688
-
-
C:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exeC:\Users\Admin\Documents\7YrX89dXqis9q4UUP1NssNyC.exe9⤵PID:17176
-
-
-
C:\Users\Admin\Documents\XSlcf6uFo8kliDhE9twxrmPl.exe"C:\Users\Admin\Documents\XSlcf6uFo8kliDhE9twxrmPl.exe"8⤵PID:8420
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\XSlcf6uFo8kliDhE9twxrmPl.exe"9⤵PID:9528
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK10⤵
- Delays execution with timeout.exe
PID:10508
-
-
-
-
C:\Users\Admin\Documents\sPwnSLIeViZqTHxmAHVsMwMS.exe"C:\Users\Admin\Documents\sPwnSLIeViZqTHxmAHVsMwMS.exe"8⤵PID:8412
-
-
C:\Users\Admin\Documents\vS48KsYBUCVZZnYA5MVRkzhO.exe"C:\Users\Admin\Documents\vS48KsYBUCVZZnYA5MVRkzhO.exe"8⤵PID:6196
-
-
C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"8⤵PID:6228
-
C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"9⤵PID:6240
-
-
C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"C:\Users\Admin\Documents\QWEFo5rUnmMoxvvAwYVorjNx.exe"9⤵PID:3580
-
-
-
C:\Users\Admin\Documents\bwBCeT_LfyPDq5skSnf0f_GX.exe"C:\Users\Admin\Documents\bwBCeT_LfyPDq5skSnf0f_GX.exe"8⤵PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 2409⤵
- Program crash
PID:10348
-
-
-
C:\Users\Admin\Documents\OS5IRdgZUyYB1mtCe8XysjQH.exe"C:\Users\Admin\Documents\OS5IRdgZUyYB1mtCe8XysjQH.exe"8⤵PID:3108
-
C:\Users\Admin\Documents\OS5IRdgZUyYB1mtCe8XysjQH.exe"C:\Users\Admin\Documents\OS5IRdgZUyYB1mtCe8XysjQH.exe"9⤵PID:13520
-
-
-
C:\Users\Admin\Documents\hoYrSw2XLASEvyGEoSv1iitp.exe"C:\Users\Admin\Documents\hoYrSw2XLASEvyGEoSv1iitp.exe"8⤵PID:7536
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe"C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe"8⤵PID:7964
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:6760
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:9504
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:6072
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:9944
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:10340
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:10928
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:12768
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:12584
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:8304
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:4480
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:12572
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:13040
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:9024
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:17132
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:5776
-
-
C:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exeC:\Users\Admin\Documents\Rdhz2oJx3htliWWKKYgL1ZGF.exe9⤵PID:15096
-
-
-
C:\Users\Admin\Documents\oU0wwaMKeAxKzblLrkdpujX8.exe"C:\Users\Admin\Documents\oU0wwaMKeAxKzblLrkdpujX8.exe"8⤵PID:3664
-
C:\Users\Admin\Documents\oU0wwaMKeAxKzblLrkdpujX8.exe"C:\Users\Admin\Documents\oU0wwaMKeAxKzblLrkdpujX8.exe"9⤵PID:10808
-
-
-
C:\Users\Admin\Documents\GWh3yckh2xiWI6LRS9BHsFeg.exe"C:\Users\Admin\Documents\GWh3yckh2xiWI6LRS9BHsFeg.exe"8⤵PID:7116
-
-
C:\Users\Admin\Documents\ssNGTDtmsCTqj66Ig3l7_hz_.exe"C:\Users\Admin\Documents\ssNGTDtmsCTqj66Ig3l7_hz_.exe"8⤵PID:8780
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:9784
-
-
-
C:\Users\Admin\Documents\xY2eqMPPYtFkJWmb2hxrugkV.exe"C:\Users\Admin\Documents\xY2eqMPPYtFkJWmb2hxrugkV.exe"8⤵PID:10092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10092 -s 2809⤵
- Program crash
PID:5896
-
-
-
C:\Users\Admin\Documents\aqu9Z5uDUQdWmear3hk9cLIz.exe"C:\Users\Admin\Documents\aqu9Z5uDUQdWmear3hk9cLIz.exe"8⤵PID:9196
-
C:\Users\Admin\AppData\Local\Temp\is-7EJ6R.tmp\aqu9Z5uDUQdWmear3hk9cLIz.tmp"C:\Users\Admin\AppData\Local\Temp\is-7EJ6R.tmp\aqu9Z5uDUQdWmear3hk9cLIz.tmp" /SL5="$603CE,138429,56832,C:\Users\Admin\Documents\aqu9Z5uDUQdWmear3hk9cLIz.exe"9⤵PID:8344
-
-
-
C:\Users\Admin\Documents\YZ_I2Pg2_ds3OEVeQdAbwZFg.exe"C:\Users\Admin\Documents\YZ_I2Pg2_ds3OEVeQdAbwZFg.exe"8⤵PID:9112
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe"C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe"8⤵PID:10084
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:3084
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:2180
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:5520
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:9812
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:10072
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:5648
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:12408
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:13364
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:4028
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:9968
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:15848
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:12600
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:11452
-
-
C:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exeC:\Users\Admin\Documents\oq_5hbXX7SFE9UutaGIhk9aD.exe9⤵PID:232
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\pXOAd9684UKmolRzNcjQ4WiH.exe"C:\Users\Admin\Documents\pXOAd9684UKmolRzNcjQ4WiH.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Users\Admin\AppData\Roaming\6035198.exe"C:\Users\Admin\AppData\Roaming\6035198.exe"3⤵PID:1384
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1384 -s 21524⤵
- Program crash
PID:10500
-
-
-
C:\Users\Admin\AppData\Roaming\1385506.exe"C:\Users\Admin\AppData\Roaming\1385506.exe"3⤵PID:5212
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:5944
-
-
-
C:\Users\Admin\AppData\Roaming\7047766.exe"C:\Users\Admin\AppData\Roaming\7047766.exe"3⤵PID:5612
-
-
C:\Users\Admin\AppData\Roaming\7739843.exe"C:\Users\Admin\AppData\Roaming\7739843.exe"3⤵PID:2036
-
-
C:\Users\Admin\AppData\Roaming\6712759.exe"C:\Users\Admin\AppData\Roaming\6712759.exe"3⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 24084⤵
- Program crash
PID:12224
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 01SknNkKREicoG0Tb0l74w.0.21⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4684 -ip 46841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3108 -ip 31081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1896
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:2296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4468 -ip 44681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1704 -ip 17041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3552 -ip 35521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5652
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 4523⤵
- Program crash
PID:1488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 4523⤵
- Program crash
PID:7440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6712 -ip 67121⤵PID:6188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7352 -ip 73521⤵PID:8108
-
C:\Users\Admin\AppData\Local\Temp\90F1.exeC:\Users\Admin\AppData\Local\Temp\90F1.exe1⤵PID:7448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 2442⤵
- Program crash
PID:5736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8100 -ip 81001⤵PID:6176
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵PID:1864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 4482⤵
- Program crash
PID:7504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 4482⤵
- Program crash
PID:5540
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5276 -ip 52761⤵PID:2132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1864 -ip 18641⤵PID:4624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7448 -ip 74481⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\CBC4.exeC:\Users\Admin\AppData\Local\Temp\CBC4.exe1⤵PID:8284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8108 -ip 81081⤵PID:3960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4384 -ip 43841⤵PID:10236
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9608
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9600
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9592
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9584
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9576
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9568
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9560
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9552
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 9544 -ip 95441⤵PID:8608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9288 -ip 92881⤵PID:4364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6836 -ip 68361⤵PID:896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 10092 -ip 100921⤵PID:7672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3580 -ip 35801⤵PID:240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 7644 -ip 76441⤵PID:7492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7536 -ip 75361⤵PID:10836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3376 -ip 33761⤵PID:7884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3760 -ip 37601⤵PID:7640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 10908 -ip 109081⤵PID:10048
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 652 -p 1384 -ip 13841⤵PID:8024
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 6380 -ip 63801⤵PID:9176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7840 -ip 78401⤵PID:14692