Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
100s -
max time network
1813s -
platform
windows11_x64 -
resource
win11 -
submitted
31-08-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (24).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
metasploit
windows/single_exec
Extracted
redline
NORMAN2
45.14.49.184:27587
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral17/memory/4632-290-0x00000000042F0000-0x0000000004C16000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7068 5016 rundll32.exe 13 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 22 IoCs
resource yara_rule behavioral17/memory/792-342-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/4784-339-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral17/memory/1888-350-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5100-345-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/4784-334-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5200-424-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5160-429-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/4800-421-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/816-425-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/6076-486-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5916-495-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5792-493-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5876-492-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5852-540-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/3068-550-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/5696-553-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/6076-583-0x0000000005690000-0x0000000005CA8000-memory.dmp family_redline behavioral17/memory/3724-579-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/1608-597-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/1284-612-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/6088-610-0x0000000000000000-mapping.dmp family_redline behavioral17/memory/1068-609-0x0000000000000000-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
description pid Process procid_target PID 1624 created 4044 1624 WerFault.exe 93 PID 4520 created 1900 4520 WerFault.exe 100 PID 1712 created 4632 1712 WerFault.exe 114 PID 5508 created 2384 5508 WerFault.exe 98 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral17/memory/2384-394-0x0000000000780000-0x0000000000853000-memory.dmp family_vidar behavioral17/memory/5100-426-0x0000000004ED0000-0x0000000005476000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 45 IoCs
pid Process 4672 7CiJZaVe6j2W__NGRSAUdTks.exe 3208 38OGWRyZwf7s24NpladTGgzx.exe 4044 FnNH7HrgACEgRpTHWFhV1GRc.exe 4968 jwTlFwiAA0qVabCDVsX2ah5F.exe 3188 KaMHlVeCjcN40iDRCmRDwnPA.exe 2920 Sijvz7ZCwdMaJN1BjSC7tXzb.exe 72 D5GQzzk5LZTIbXf62xhIf6Y7.exe 972 gtaWyUsJGht8mvc5nRTOFSep.exe 1180 MNfT3CvaLm7XIM5Qr_s0sLhM.exe 724 StXuB3NdmBvNxPXCQ_bfFUsK.exe 1188 aSgnqJ7rrcJpp4b6_K0_xaLN.exe 1424 VnRqYi4T6BoJKQpaztXUzIgU.exe 1216 HgUa7UAqKKOm3XojHtaOi2gp.exe 1456 d0woXrFICW_s4SOlj87grt9A.exe 1620 U6Rc9b1g2kn7EWEHdz9kDmCv.exe 1708 iBoSaJ9lN7ZVOTCnFdY8UQXt.exe 1900 2qWhMfrebC5LAgI7a6RFJ1IG.exe 2384 dIL3GK_feidHPS2KGJ_27gDI.exe 2408 rXErAZzD8luCqwuIqJV2AuDk.exe 4632 BCYpRH2QLPr8fwK3yTMSd4XA.exe 2272 X2s3rFnXjiylBtqAjWURF6Df.exe 456 OuqMIUhAnbNLKqvNaXf0LMP8.exe 2012 150yKb53xV3GmcwwL5goOjmG.exe 2852 Sijvz7ZCwdMaJN1BjSC7tXzb.exe 3948 vMEp4Lq0N1VEUCFmD1jovThU.exe 3600 KBAvfsr.exe 3100 inst001.exe 796 cutm3.exe 1540 md8_8eus.exe 5092 vMEp4Lq0N1VEUCFmD1jovThU.tmp 2080 aSgnqJ7rrcJpp4b6_K0_xaLN.exe 4784 MNfT3CvaLm7XIM5Qr_s0sLhM.exe 792 iBoSaJ9lN7ZVOTCnFdY8UQXt.exe 5100 KaMHlVeCjcN40iDRCmRDwnPA.exe 1888 7CiJZaVe6j2W__NGRSAUdTks.exe 5564 5398714.exe 4800 MNfT3CvaLm7XIM5Qr_s0sLhM.exe 5656 5599651.exe 5200 7CiJZaVe6j2W__NGRSAUdTks.exe 816 iBoSaJ9lN7ZVOTCnFdY8UQXt.exe 5160 KaMHlVeCjcN40iDRCmRDwnPA.exe 5752 6995560.exe 6040 IQ0V_Fe_.eXE 6004 8199486.exe 3580 7030928.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion U6Rc9b1g2kn7EWEHdz9kDmCv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion U6Rc9b1g2kn7EWEHdz9kDmCv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gtaWyUsJGht8mvc5nRTOFSep.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gtaWyUsJGht8mvc5nRTOFSep.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion HgUa7UAqKKOm3XojHtaOi2gp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion HgUa7UAqKKOm3XojHtaOi2gp.exe -
Loads dropped DLL 3 IoCs
pid Process 5092 vMEp4Lq0N1VEUCFmD1jovThU.tmp 5092 vMEp4Lq0N1VEUCFmD1jovThU.tmp 1456 d0woXrFICW_s4SOlj87grt9A.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral17/files/0x000200000002b1ee-188.dat themida behavioral17/files/0x000200000002b1f8-185.dat themida behavioral17/files/0x000200000002b1f6-178.dat themida behavioral17/files/0x000200000002b1ee-217.dat themida behavioral17/files/0x000200000002b1f6-247.dat themida behavioral17/files/0x000200000002b1f8-235.dat themida behavioral17/memory/1620-298-0x00000000002B0000-0x00000000002B1000-memory.dmp themida behavioral17/memory/1216-315-0x0000000000E40000-0x0000000000E41000-memory.dmp themida behavioral17/memory/972-317-0x0000000000F80000-0x0000000000F81000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gtaWyUsJGht8mvc5nRTOFSep.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HgUa7UAqKKOm3XojHtaOi2gp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA U6Rc9b1g2kn7EWEHdz9kDmCv.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 43 ipinfo.io 118 ipinfo.io 212 ipinfo.io 1222 ipinfo.io 6 ipinfo.io 58 ip-api.com 63 ipinfo.io 109 ipinfo.io 171 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1620 U6Rc9b1g2kn7EWEHdz9kDmCv.exe 972 gtaWyUsJGht8mvc5nRTOFSep.exe 1216 HgUa7UAqKKOm3XojHtaOi2gp.exe -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 2920 set thread context of 2852 2920 Sijvz7ZCwdMaJN1BjSC7tXzb.exe 118 PID 1180 set thread context of 4784 1180 MNfT3CvaLm7XIM5Qr_s0sLhM.exe 135 PID 1708 set thread context of 792 1708 iBoSaJ9lN7ZVOTCnFdY8UQXt.exe 137 PID 3188 set thread context of 5100 3188 KaMHlVeCjcN40iDRCmRDwnPA.exe 139 PID 4672 set thread context of 1888 4672 7CiJZaVe6j2W__NGRSAUdTks.exe 138 PID 1180 set thread context of 4800 1180 MNfT3CvaLm7XIM5Qr_s0sLhM.exe 147 PID 4672 set thread context of 5200 4672 7CiJZaVe6j2W__NGRSAUdTks.exe 148 PID 1708 set thread context of 816 1708 iBoSaJ9lN7ZVOTCnFdY8UQXt.exe 151 PID 3188 set thread context of 5160 3188 KaMHlVeCjcN40iDRCmRDwnPA.exe 150 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe StXuB3NdmBvNxPXCQ_bfFUsK.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe StXuB3NdmBvNxPXCQ_bfFUsK.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe StXuB3NdmBvNxPXCQ_bfFUsK.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe StXuB3NdmBvNxPXCQ_bfFUsK.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini StXuB3NdmBvNxPXCQ_bfFUsK.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe svchost.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
pid pid_target Process procid_target 3404 1900 WerFault.exe 100 3544 4044 WerFault.exe 93 4764 4632 WerFault.exe 114 5932 2384 WerFault.exe 98 2276 3684 WerFault.exe 195 6848 3684 WerFault.exe 195 244 7116 WerFault.exe 220 6388 3580 WerFault.exe 161 4868 6104 WerFault.exe 237 2964 6104 WerFault.exe 237 10764 5564 WerFault.exe 152 6860 5564 WerFault.exe 152 5856 10372 WerFault.exe 402 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sijvz7ZCwdMaJN1BjSC7tXzb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sijvz7ZCwdMaJN1BjSC7tXzb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sijvz7ZCwdMaJN1BjSC7tXzb.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 7CiJZaVe6j2W__NGRSAUdTks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7CiJZaVe6j2W__NGRSAUdTks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 7CiJZaVe6j2W__NGRSAUdTks.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 7CiJZaVe6j2W__NGRSAUdTks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 7CiJZaVe6j2W__NGRSAUdTks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 7CiJZaVe6j2W__NGRSAUdTks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 7CiJZaVe6j2W__NGRSAUdTks.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3044 schtasks.exe 3604 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2200 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 7CiJZaVe6j2W__NGRSAUdTks.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 7CiJZaVe6j2W__NGRSAUdTks.exe -
Kills process with taskkill 1 IoCs
pid Process 2848 taskkill.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 777 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 116 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 120 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 205 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 Setup (24).exe 4324 Setup (24).exe 2852 Sijvz7ZCwdMaJN1BjSC7tXzb.exe 2852 Sijvz7ZCwdMaJN1BjSC7tXzb.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3404 WerFault.exe 3404 WerFault.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3544 WerFault.exe 3544 WerFault.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 4764 7CiJZaVe6j2W__NGRSAUdTks.exe 4764 7CiJZaVe6j2W__NGRSAUdTks.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2852 Sijvz7ZCwdMaJN1BjSC7tXzb.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeRestorePrivilege 3544 WerFault.exe Token: SeBackupPrivilege 3544 WerFault.exe Token: SeDebugPrivilege 4968 jwTlFwiAA0qVabCDVsX2ah5F.exe Token: SeDebugPrivilege 2012 150yKb53xV3GmcwwL5goOjmG.exe Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeDebugPrivilege 5564 5398714.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5092 vMEp4Lq0N1VEUCFmD1jovThU.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4672 4324 Setup (24).exe 89 PID 4324 wrote to memory of 4672 4324 Setup (24).exe 89 PID 4324 wrote to memory of 4672 4324 Setup (24).exe 89 PID 4324 wrote to memory of 3208 4324 Setup (24).exe 88 PID 4324 wrote to memory of 3208 4324 Setup (24).exe 88 PID 4324 wrote to memory of 3208 4324 Setup (24).exe 88 PID 4324 wrote to memory of 4044 4324 Setup (24).exe 93 PID 4324 wrote to memory of 4044 4324 Setup (24).exe 93 PID 4324 wrote to memory of 4044 4324 Setup (24).exe 93 PID 4324 wrote to memory of 4968 4324 Setup (24).exe 92 PID 4324 wrote to memory of 4968 4324 Setup (24).exe 92 PID 4324 wrote to memory of 3188 4324 Setup (24).exe 91 PID 4324 wrote to memory of 3188 4324 Setup (24).exe 91 PID 4324 wrote to memory of 3188 4324 Setup (24).exe 91 PID 4324 wrote to memory of 2920 4324 Setup (24).exe 94 PID 4324 wrote to memory of 2920 4324 Setup (24).exe 94 PID 4324 wrote to memory of 2920 4324 Setup (24).exe 94 PID 4324 wrote to memory of 972 4324 Setup (24).exe 95 PID 4324 wrote to memory of 972 4324 Setup (24).exe 95 PID 4324 wrote to memory of 972 4324 Setup (24).exe 95 PID 4324 wrote to memory of 72 4324 Setup (24).exe 96 PID 4324 wrote to memory of 72 4324 Setup (24).exe 96 PID 4324 wrote to memory of 72 4324 Setup (24).exe 96 PID 4324 wrote to memory of 1180 4324 Setup (24).exe 107 PID 4324 wrote to memory of 1180 4324 Setup (24).exe 107 PID 4324 wrote to memory of 1180 4324 Setup (24).exe 107 PID 4324 wrote to memory of 724 4324 Setup (24).exe 108 PID 4324 wrote to memory of 724 4324 Setup (24).exe 108 PID 4324 wrote to memory of 724 4324 Setup (24).exe 108 PID 4324 wrote to memory of 1188 4324 Setup (24).exe 106 PID 4324 wrote to memory of 1188 4324 Setup (24).exe 106 PID 4324 wrote to memory of 1188 4324 Setup (24).exe 106 PID 4324 wrote to memory of 1216 4324 Setup (24).exe 105 PID 4324 wrote to memory of 1216 4324 Setup (24).exe 105 PID 4324 wrote to memory of 1216 4324 Setup (24).exe 105 PID 4324 wrote to memory of 1424 4324 Setup (24).exe 104 PID 4324 wrote to memory of 1424 4324 Setup (24).exe 104 PID 4324 wrote to memory of 1424 4324 Setup (24).exe 104 PID 4324 wrote to memory of 1456 4324 Setup (24).exe 103 PID 4324 wrote to memory of 1456 4324 Setup (24).exe 103 PID 4324 wrote to memory of 1456 4324 Setup (24).exe 103 PID 4324 wrote to memory of 1620 4324 Setup (24).exe 102 PID 4324 wrote to memory of 1620 4324 Setup (24).exe 102 PID 4324 wrote to memory of 1620 4324 Setup (24).exe 102 PID 4324 wrote to memory of 1708 4324 Setup (24).exe 101 PID 4324 wrote to memory of 1708 4324 Setup (24).exe 101 PID 4324 wrote to memory of 1708 4324 Setup (24).exe 101 PID 4324 wrote to memory of 1900 4324 Setup (24).exe 100 PID 4324 wrote to memory of 1900 4324 Setup (24).exe 100 PID 4324 wrote to memory of 1900 4324 Setup (24).exe 100 PID 4324 wrote to memory of 2384 4324 Setup (24).exe 98 PID 4324 wrote to memory of 2384 4324 Setup (24).exe 98 PID 4324 wrote to memory of 2384 4324 Setup (24).exe 98 PID 4324 wrote to memory of 2408 4324 Setup (24).exe 97 PID 4324 wrote to memory of 2408 4324 Setup (24).exe 97 PID 4324 wrote to memory of 4632 4324 Setup (24).exe 114 PID 4324 wrote to memory of 4632 4324 Setup (24).exe 114 PID 4324 wrote to memory of 4632 4324 Setup (24).exe 114 PID 4324 wrote to memory of 456 4324 Setup (24).exe 116 PID 4324 wrote to memory of 456 4324 Setup (24).exe 116 PID 4324 wrote to memory of 456 4324 Setup (24).exe 116 PID 4324 wrote to memory of 2272 4324 Setup (24).exe 117 PID 4324 wrote to memory of 2272 4324 Setup (24).exe 117 PID 4324 wrote to memory of 2272 4324 Setup (24).exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (24).exe"C:\Users\Admin\AppData\Local\Temp\Setup (24).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\Documents\38OGWRyZwf7s24NpladTGgzx.exe"C:\Users\Admin\Documents\38OGWRyZwf7s24NpladTGgzx.exe"2⤵
- Executes dropped EXE
PID:3208 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3604
-
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe"C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4672 -
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵
- Executes dropped EXE
PID:1888
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵
- Executes dropped EXE
PID:5200
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:6076
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:3068
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:1608
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:1808
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:6740
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:2064
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:5216
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:6588
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:5372
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:460
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:2452
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:7892
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:4436
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:3736
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:2988
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:9172
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:10268
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:11008
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:8704
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:10244
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:7592
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:10372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10372 -s 284⤵
- Program crash
PID:5856
-
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:9564
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:5008
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:7636
-
-
C:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exeC:\Users\Admin\Documents\7CiJZaVe6j2W__NGRSAUdTks.exe3⤵PID:9136
-
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe"C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3188 -
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵
- Executes dropped EXE
PID:5100
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵
- Executes dropped EXE
PID:5160
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5916
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5852
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:1068
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:6656
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5424
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7044
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:6984
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:6256
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:1224
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:344
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:1880
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:2256
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:1556
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5784
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:2912
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5232
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7868
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:2672
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7660
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:1488
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7316
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5436
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7244
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:8104
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7844
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:8988
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:9912
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:9736
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:3832
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:10800
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:9396
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7808
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7492
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:7476
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:10868
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:6260
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:11024
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:9072
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:5980
-
-
C:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exeC:\Users\Admin\Documents\KaMHlVeCjcN40iDRCmRDwnPA.exe3⤵PID:10556
-
-
-
C:\Users\Admin\Documents\jwTlFwiAA0qVabCDVsX2ah5F.exe"C:\Users\Admin\Documents\jwTlFwiAA0qVabCDVsX2ah5F.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Users\Admin\Documents\FnNH7HrgACEgRpTHWFhV1GRc.exe"C:\Users\Admin\Documents\FnNH7HrgACEgRpTHWFhV1GRc.exe"2⤵
- Executes dropped EXE
PID:4044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
C:\Users\Admin\Documents\Sijvz7ZCwdMaJN1BjSC7tXzb.exe"C:\Users\Admin\Documents\Sijvz7ZCwdMaJN1BjSC7tXzb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2920 -
C:\Users\Admin\Documents\Sijvz7ZCwdMaJN1BjSC7tXzb.exe"C:\Users\Admin\Documents\Sijvz7ZCwdMaJN1BjSC7tXzb.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2852
-
-
-
C:\Users\Admin\Documents\gtaWyUsJGht8mvc5nRTOFSep.exe"C:\Users\Admin\Documents\gtaWyUsJGht8mvc5nRTOFSep.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:972
-
-
C:\Users\Admin\Documents\D5GQzzk5LZTIbXf62xhIf6Y7.exe"C:\Users\Admin\Documents\D5GQzzk5LZTIbXf62xhIf6Y7.exe"2⤵
- Executes dropped EXE
PID:72 -
C:\Users\Admin\Documents\D5GQzzk5LZTIbXf62xhIf6Y7.exe"C:\Users\Admin\Documents\D5GQzzk5LZTIbXf62xhIf6Y7.exe"3⤵PID:4560
-
-
-
C:\Users\Admin\Documents\rXErAZzD8luCqwuIqJV2AuDk.exe"C:\Users\Admin\Documents\rXErAZzD8luCqwuIqJV2AuDk.exe"2⤵
- Executes dropped EXE
PID:2408
-
-
C:\Users\Admin\Documents\dIL3GK_feidHPS2KGJ_27gDI.exe"C:\Users\Admin\Documents\dIL3GK_feidHPS2KGJ_27gDI.exe"2⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 2403⤵
- Program crash
PID:5932
-
-
-
C:\Users\Admin\Documents\2qWhMfrebC5LAgI7a6RFJ1IG.exe"C:\Users\Admin\Documents\2qWhMfrebC5LAgI7a6RFJ1IG.exe"2⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe"C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1708 -
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵
- Executes dropped EXE
PID:792
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵
- Executes dropped EXE
PID:816
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:5876
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:5696
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:1284
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:4952
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:4964
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2260
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:7024
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2228
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:6436
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:4536
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:5312
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:6384
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:4404
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:3140
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:4104
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2224
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:6584
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2560
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2424
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2212
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:6060
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:3760
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:6380
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:2124
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:5064
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:5808
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:3168
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:508
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:3212
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:9124
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:7768
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:9360
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:11152
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:9880
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:9516
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:8952
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:10544
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:9004
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:10236
-
-
C:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exeC:\Users\Admin\Documents\iBoSaJ9lN7ZVOTCnFdY8UQXt.exe3⤵PID:7096
-
-
-
C:\Users\Admin\Documents\U6Rc9b1g2kn7EWEHdz9kDmCv.exe"C:\Users\Admin\Documents\U6Rc9b1g2kn7EWEHdz9kDmCv.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1620
-
-
C:\Users\Admin\Documents\d0woXrFICW_s4SOlj87grt9A.exe"C:\Users\Admin\Documents\d0woXrFICW_s4SOlj87grt9A.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\d0woXrFICW_s4SOlj87grt9A.exe"3⤵PID:6856
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:2200
-
-
-
-
C:\Users\Admin\Documents\VnRqYi4T6BoJKQpaztXUzIgU.exe"C:\Users\Admin\Documents\VnRqYi4T6BoJKQpaztXUzIgU.exe"2⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:3600
-
-
-
C:\Users\Admin\Documents\HgUa7UAqKKOm3XojHtaOi2gp.exe"C:\Users\Admin\Documents\HgUa7UAqKKOm3XojHtaOi2gp.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1216
-
-
C:\Users\Admin\Documents\aSgnqJ7rrcJpp4b6_K0_xaLN.exe"C:\Users\Admin\Documents\aSgnqJ7rrcJpp4b6_K0_xaLN.exe"2⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\Documents\aSgnqJ7rrcJpp4b6_K0_xaLN.exe"C:\Users\Admin\Documents\aSgnqJ7rrcJpp4b6_K0_xaLN.exe" -u3⤵
- Executes dropped EXE
PID:2080
-
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe"C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1180 -
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵
- Executes dropped EXE
PID:4784
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵
- Executes dropped EXE
PID:4800
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:5792
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:3724
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:6088
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:6696
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:4564
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:6716
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:5488
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:4020
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1048
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:5640
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2800
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:780
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:6444
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2912
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:604
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2712
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1288
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:3836
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1568
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2188
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:7412
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:4552
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2876
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1964
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:7556
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:5676
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:3896
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:8696
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:8380
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:8844
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:2268
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:9928
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:8532
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:10672
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:10592
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1596
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:10108
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:1496
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:6068
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:9960
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:7424
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:5568
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:7108
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:10772
-
-
C:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exeC:\Users\Admin\Documents\MNfT3CvaLm7XIM5Qr_s0sLhM.exe3⤵PID:11436
-
-
-
C:\Users\Admin\Documents\StXuB3NdmBvNxPXCQ_bfFUsK.exe"C:\Users\Admin\Documents\StXuB3NdmBvNxPXCQ_bfFUsK.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:724 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:1540
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:796
-
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:3100
-
-
-
C:\Users\Admin\Documents\BCYpRH2QLPr8fwK3yTMSd4XA.exe"C:\Users\Admin\Documents\BCYpRH2QLPr8fwK3yTMSd4XA.exe"2⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 2763⤵
- Program crash
PID:4764
-
-
-
C:\Users\Admin\Documents\OuqMIUhAnbNLKqvNaXf0LMP8.exe"C:\Users\Admin\Documents\OuqMIUhAnbNLKqvNaXf0LMP8.exe"2⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\Documents\OuqMIUhAnbNLKqvNaXf0LMP8.exe"C:\Users\Admin\Documents\OuqMIUhAnbNLKqvNaXf0LMP8.exe"3⤵PID:6104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 17404⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 17404⤵
- Program crash
PID:2964
-
-
-
-
C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe"C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe"2⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:3472
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\X2s3rFnXjiylBtqAjWURF6Df.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:6040 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))6⤵PID:5404
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F7⤵PID:6176
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:7156
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "X2s3rFnXjiylBtqAjWURF6Df.exe" -F5⤵
- Kills process with taskkill
PID:2848
-
-
-
-
-
C:\Users\Admin\Documents\150yKb53xV3GmcwwL5goOjmG.exe"C:\Users\Admin\Documents\150yKb53xV3GmcwwL5goOjmG.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Users\Admin\AppData\Roaming\5398714.exe"C:\Users\Admin\AppData\Roaming\5398714.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5564 -s 22524⤵
- Program crash
PID:10764
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5564 -s 22524⤵
- Program crash
PID:6860
-
-
-
C:\Users\Admin\AppData\Roaming\5599651.exe"C:\Users\Admin\AppData\Roaming\5599651.exe"3⤵
- Executes dropped EXE
PID:5656 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:5648
-
-
-
C:\Users\Admin\AppData\Roaming\8199486.exe"C:\Users\Admin\AppData\Roaming\8199486.exe"3⤵
- Executes dropped EXE
PID:6004
-
-
C:\Users\Admin\AppData\Roaming\7030928.exe"C:\Users\Admin\AppData\Roaming\7030928.exe"3⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 21604⤵
- Program crash
PID:6388
-
-
-
C:\Users\Admin\AppData\Roaming\6995560.exe"C:\Users\Admin\AppData\Roaming\6995560.exe"3⤵
- Executes dropped EXE
PID:5752
-
-
-
C:\Users\Admin\Documents\vMEp4Lq0N1VEUCFmD1jovThU.exe"C:\Users\Admin\Documents\vMEp4Lq0N1VEUCFmD1jovThU.exe"2⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\is-LCDPO.tmp\vMEp4Lq0N1VEUCFmD1jovThU.tmp"C:\Users\Admin\AppData\Local\Temp\is-LCDPO.tmp\vMEp4Lq0N1VEUCFmD1jovThU.tmp" /SL5="$202BA,138429,56832,C:\Users\Admin\Documents\vMEp4Lq0N1VEUCFmD1jovThU.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\is-L1428.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-L1428.tmp\Setup.exe" /Verysilent4⤵PID:5184
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\is-N60KS.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-N60KS.tmp\stats.tmp" /SL5="$30372,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\is-80OQ8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-80OQ8.tmp\Setup.exe" /Verysilent7⤵PID:6500
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:6828
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:6820
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:6812
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:1452
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:6804
-
C:\Users\Admin\AppData\Roaming\8062123.exe"C:\Users\Admin\AppData\Roaming\8062123.exe"6⤵PID:7356
-
-
C:\Users\Admin\AppData\Roaming\6255002.exe"C:\Users\Admin\AppData\Roaming\6255002.exe"6⤵PID:8896
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:6792
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:6784
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1536
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2304
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3264
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6304
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2172
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5420
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1108
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8140
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5304
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1276
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7192
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8404
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8324
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8432
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6036
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7656
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3456
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7984
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7120
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8512
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10748
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7172
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5844
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7700
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9364
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6280
-
-
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv zEy2eSZMkUayvOouZcr9Dw.0.21⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4044 -ip 40441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1900 -ip 19001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4632 -ip 46321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
- Drops file in Program Files directory
PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2384 -ip 23841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5508
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 4603⤵
- Program crash
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 4603⤵
- Program crash
PID:6848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1608 -ip 16081⤵PID:6928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3684 -ip 36841⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2FA2.exeC:\Users\Admin\AppData\Local\Temp\2FA2.exe1⤵PID:7116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 2762⤵
- Program crash
PID:244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7116 -ip 71161⤵PID:2308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6104 -ip 61041⤵PID:9156
-
C:\Users\Admin\AppData\Local\Temp\17A4.exeC:\Users\Admin\AppData\Local\Temp\17A4.exe1⤵PID:1324
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 5564 -ip 55641⤵PID:6012
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9972
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8040
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6888
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9724
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7336
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7812
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7180
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:10368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7808 -ip 78081⤵PID:6012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 9972 -ip 99721⤵PID:6420
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:9328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7424 -ip 74241⤵PID:1428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10372 -ip 103721⤵PID:3272