Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
83s -
max time network
1812s -
platform
windows11_x64 -
resource
win11 -
submitted
31-08-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (6).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
NORMAN2
45.14.49.184:27587
Extracted
redline
1
37.0.8.88:44263
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral28/memory/1388-455-0x0000000004310000-0x0000000004C36000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5224 4848 rundll32.exe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7540 4848 rUNdlL32.eXe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 13892 4848 rundll32.exe 17 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 19 IoCs
resource yara_rule behavioral28/memory/4084-314-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral28/memory/5024-342-0x0000000004E90000-0x00000000054A8000-memory.dmp family_redline behavioral28/memory/1760-329-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral28/memory/1760-323-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/4084-311-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5024-303-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral28/memory/5024-298-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/4052-359-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/4196-366-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/4652-381-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5580-445-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5532-438-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5268-442-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/2180-495-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/1144-499-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5436-537-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/5292-551-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/6140-490-0x0000000000000000-mapping.dmp family_redline behavioral28/memory/6140-558-0x00000000058B0000-0x0000000005E56000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
description pid Process procid_target PID 2136 created 3124 2136 WerFault.exe 81 PID 4732 created 3560 4732 WerFault.exe 91 PID 4468 created 1388 4468 WerFault.exe 104 PID 2260 created 1760 2260 WerFault.exe 130 PID 344 created 3896 344 WerFault.exe 366 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral28/memory/3896-357-0x0000000000950000-0x0000000000A23000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 43 IoCs
pid Process 4936 QUzfdUic0aGcNf8VMkOik1HT.exe 4492 joRWVbGxZcdo4i9yrAQG25nS.exe 4504 CDoprTj42XZkmS3U6WSvqQZt.exe 4932 pwwYi3vJwlXLZP1i4buhp21X.exe 2884 ZyR2kpr4AH_fJVsDwZsAiSAc.exe 4948 CNfPC57pYwp43Gsk0V9uGqfL.exe 2924 AfMdle_jmEdHzmELqjpimLtb.exe 2536 E2MfDGFxvvA8s36PfhzdZnXr.exe 2372 xPMRFIA93tsdEd5C2DQBTjl9.exe 4008 qlC_TKInhGYfaMcctte6IKTA.exe 476 L7y0XT4gtv1rFLUqlibcwC9K.exe 3124 r8SNnhYzjubq0DbcXx520OTV.exe 3560 VD4_hToaNZoGlmv39kJ_Dz2S.exe 4972 5jR3SDfMzNqHVpKGQQawILlf.exe 3896 K1QDZDne4UPpksbLsxoTEIWQ.exe 3280 QOrDkSdv9BGNW3GOGigdZieK.exe 3368 uA0fcvMpzPQ00inXo3TX5X7i.exe 3784 5goINM87DTEG0SeMlT9rLwrG.exe 3792 cUyBaEpfH0FMZ_2qEUQMiW4O.exe 4860 kuoTbm0vCb5_fNfaDzcqiJEI.exe 1388 ve48BipqMgU7YMg6JQ5qZPA3.exe 848 Kc4VkYAY4fsfgdImxXI0pjVd.exe 1576 7DZ8aLnJzNC98tgr0DvHNBdH.exe 2208 9Wgwg2MjaQPqB6cWHIggpucB.exe 2588 CDoprTj42XZkmS3U6WSvqQZt.exe 3584 7DZ8aLnJzNC98tgr0DvHNBdH.tmp 1376 KBAvfsr.exe 2832 inst001.exe 2004 cutm3.exe 936 md8_8eus.exe 2152 IQ0V_Fe_.eXE 5024 joRWVbGxZcdo4i9yrAQG25nS.exe 4084 L7y0XT4gtv1rFLUqlibcwC9K.exe 1760 xPMRFIA93tsdEd5C2DQBTjl9.exe 5044 Kc4VkYAY4fsfgdImxXI0pjVd.exe 4052 CNfPC57pYwp43Gsk0V9uGqfL.exe 4196 joRWVbGxZcdo4i9yrAQG25nS.exe 4652 L7y0XT4gtv1rFLUqlibcwC9K.exe 3856 xPMRFIA93tsdEd5C2DQBTjl9.exe 5724 3730505.exe 5808 1645906.exe 5532 joRWVbGxZcdo4i9yrAQG25nS.exe 5268 CNfPC57pYwp43Gsk0V9uGqfL.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5goINM87DTEG0SeMlT9rLwrG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5goINM87DTEG0SeMlT9rLwrG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion uA0fcvMpzPQ00inXo3TX5X7i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion uA0fcvMpzPQ00inXo3TX5X7i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5jR3SDfMzNqHVpKGQQawILlf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5jR3SDfMzNqHVpKGQQawILlf.exe -
Loads dropped DLL 3 IoCs
pid Process 3584 7DZ8aLnJzNC98tgr0DvHNBdH.tmp 3584 7DZ8aLnJzNC98tgr0DvHNBdH.tmp 4932 pwwYi3vJwlXLZP1i4buhp21X.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral28/files/0x000100000002b1d7-188.dat themida behavioral28/files/0x000100000002b1fb-194.dat themida behavioral28/files/0x000100000002b1fd-193.dat themida behavioral28/files/0x000100000002b1fb-271.dat themida behavioral28/files/0x000100000002b1d7-275.dat themida behavioral28/files/0x000100000002b1fd-273.dat themida behavioral28/memory/4972-339-0x00000000009C0000-0x00000000009C1000-memory.dmp themida behavioral28/memory/3368-330-0x0000000000970000-0x0000000000971000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5jR3SDfMzNqHVpKGQQawILlf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uA0fcvMpzPQ00inXo3TX5X7i.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5goINM87DTEG0SeMlT9rLwrG.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 830 ipinfo.io 71 ip-api.com 118 ipinfo.io 123 ipinfo.io 151 ipinfo.io 337 ipinfo.io 462 ipinfo.io 829 ipinfo.io 10 ipinfo.io 52 ipinfo.io 189 ipinfo.io 464 ipinfo.io 800 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3368 uA0fcvMpzPQ00inXo3TX5X7i.exe 3784 5goINM87DTEG0SeMlT9rLwrG.exe 4972 5jR3SDfMzNqHVpKGQQawILlf.exe -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 4504 set thread context of 2588 4504 CDoprTj42XZkmS3U6WSvqQZt.exe 110 PID 4492 set thread context of 5024 4492 joRWVbGxZcdo4i9yrAQG25nS.exe 127 PID 476 set thread context of 4084 476 L7y0XT4gtv1rFLUqlibcwC9K.exe 125 PID 2372 set thread context of 1760 2372 xPMRFIA93tsdEd5C2DQBTjl9.exe 130 PID 4948 set thread context of 4052 4948 CNfPC57pYwp43Gsk0V9uGqfL.exe 149 PID 4492 set thread context of 4196 4492 joRWVbGxZcdo4i9yrAQG25nS.exe 135 PID 476 set thread context of 4652 476 L7y0XT4gtv1rFLUqlibcwC9K.exe 139 PID 4492 set thread context of 5532 4492 joRWVbGxZcdo4i9yrAQG25nS.exe 157 PID 4948 set thread context of 5268 4948 CNfPC57pYwp43Gsk0V9uGqfL.exe 151 PID 476 set thread context of 5580 476 L7y0XT4gtv1rFLUqlibcwC9K.exe 155 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe QOrDkSdv9BGNW3GOGigdZieK.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe QOrDkSdv9BGNW3GOGigdZieK.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe QOrDkSdv9BGNW3GOGigdZieK.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini QOrDkSdv9BGNW3GOGigdZieK.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe qlC_TKInhGYfaMcctte6IKTA.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe qlC_TKInhGYfaMcctte6IKTA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe QOrDkSdv9BGNW3GOGigdZieK.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
pid pid_target Process procid_target 3380 3560 WerFault.exe 91 3480 3124 WerFault.exe 81 4104 1388 WerFault.exe 104 5148 1760 WerFault.exe 130 5428 3896 WerFault.exe 102 6560 2692 WerFault.exe 199 6652 2692 WerFault.exe 199 5492 1736 WerFault.exe 213 7620 7708 WerFault.exe 267 6692 7708 WerFault.exe 267 5020 5844 WerFault.exe 291 8764 5724 WerFault.exe 158 5228 5724 WerFault.exe 158 8512 7116 WerFault.exe 247 9948 9036 WerFault.exe 346 9388 9012 WerFault.exe 364 5340 1468 WerFault.exe 178 5876 1468 WerFault.exe 178 10956 9108 WerFault.exe 352 11596 5492 WerFault.exe 363 11784 6032 WerFault.exe 497 13192 11384 WerFault.exe 531 11976 2972 WerFault.exe 511 6624 2972 WerFault.exe 511 17608 13508 WerFault.exe 585 7940 13508 WerFault.exe 585 17616 1376 WerFault.exe 123 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CDoprTj42XZkmS3U6WSvqQZt.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CDoprTj42XZkmS3U6WSvqQZt.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CDoprTj42XZkmS3U6WSvqQZt.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3684 schtasks.exe 4176 schtasks.exe 11188 schtasks.exe 8088 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 26096 timeout.exe 3964 timeout.exe 2088 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
pid Process 5020 taskkill.exe 5124 taskkill.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 10056 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 912 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 120 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 131 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 184 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 343 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 805 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4128 Setup (6).exe 4128 Setup (6).exe 2588 CDoprTj42XZkmS3U6WSvqQZt.exe 2588 CDoprTj42XZkmS3U6WSvqQZt.exe 3380 WerFault.exe 3380 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 4104 WerFault.exe 4104 WerFault.exe 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2588 CDoprTj42XZkmS3U6WSvqQZt.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 3792 cUyBaEpfH0FMZ_2qEUQMiW4O.exe Token: SeRestorePrivilege 3480 WerFault.exe Token: SeBackupPrivilege 3480 WerFault.exe Token: SeBackupPrivilege 3480 WerFault.exe Token: SeDebugPrivilege 2208 9Wgwg2MjaQPqB6cWHIggpucB.exe Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeDebugPrivilege 5020 WerFault.exe Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3584 7DZ8aLnJzNC98tgr0DvHNBdH.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 4936 4128 Setup (6).exe 90 PID 4128 wrote to memory of 4936 4128 Setup (6).exe 90 PID 4128 wrote to memory of 4492 4128 Setup (6).exe 89 PID 4128 wrote to memory of 4492 4128 Setup (6).exe 89 PID 4128 wrote to memory of 4492 4128 Setup (6).exe 89 PID 4128 wrote to memory of 4504 4128 Setup (6).exe 88 PID 4128 wrote to memory of 4504 4128 Setup (6).exe 88 PID 4128 wrote to memory of 4504 4128 Setup (6).exe 88 PID 4128 wrote to memory of 4932 4128 Setup (6).exe 92 PID 4128 wrote to memory of 4932 4128 Setup (6).exe 92 PID 4128 wrote to memory of 4932 4128 Setup (6).exe 92 PID 4128 wrote to memory of 2884 4128 Setup (6).exe 87 PID 4128 wrote to memory of 2884 4128 Setup (6).exe 87 PID 4128 wrote to memory of 2884 4128 Setup (6).exe 87 PID 4128 wrote to memory of 2924 4128 Setup (6).exe 86 PID 4128 wrote to memory of 2924 4128 Setup (6).exe 86 PID 4128 wrote to memory of 2924 4128 Setup (6).exe 86 PID 4128 wrote to memory of 4948 4128 Setup (6).exe 85 PID 4128 wrote to memory of 4948 4128 Setup (6).exe 85 PID 4128 wrote to memory of 4948 4128 Setup (6).exe 85 PID 4128 wrote to memory of 2536 4128 Setup (6).exe 83 PID 4128 wrote to memory of 2536 4128 Setup (6).exe 83 PID 4128 wrote to memory of 2536 4128 Setup (6).exe 83 PID 4128 wrote to memory of 476 4128 Setup (6).exe 84 PID 4128 wrote to memory of 476 4128 Setup (6).exe 84 PID 4128 wrote to memory of 476 4128 Setup (6).exe 84 PID 4128 wrote to memory of 2372 4128 Setup (6).exe 82 PID 4128 wrote to memory of 2372 4128 Setup (6).exe 82 PID 4128 wrote to memory of 2372 4128 Setup (6).exe 82 PID 4128 wrote to memory of 4008 4128 Setup (6).exe 80 PID 4128 wrote to memory of 4008 4128 Setup (6).exe 80 PID 4128 wrote to memory of 4008 4128 Setup (6).exe 80 PID 4128 wrote to memory of 3560 4128 Setup (6).exe 91 PID 4128 wrote to memory of 3560 4128 Setup (6).exe 91 PID 4128 wrote to memory of 3560 4128 Setup (6).exe 91 PID 4128 wrote to memory of 3124 4128 Setup (6).exe 81 PID 4128 wrote to memory of 3124 4128 Setup (6).exe 81 PID 4128 wrote to memory of 3124 4128 Setup (6).exe 81 PID 4128 wrote to memory of 4972 4128 Setup (6).exe 103 PID 4128 wrote to memory of 4972 4128 Setup (6).exe 103 PID 4128 wrote to memory of 4972 4128 Setup (6).exe 103 PID 4128 wrote to memory of 3896 4128 Setup (6).exe 102 PID 4128 wrote to memory of 3896 4128 Setup (6).exe 102 PID 4128 wrote to memory of 3896 4128 Setup (6).exe 102 PID 4128 wrote to memory of 3280 4128 Setup (6).exe 101 PID 4128 wrote to memory of 3280 4128 Setup (6).exe 101 PID 4128 wrote to memory of 3280 4128 Setup (6).exe 101 PID 4128 wrote to memory of 3368 4128 Setup (6).exe 100 PID 4128 wrote to memory of 3368 4128 Setup (6).exe 100 PID 4128 wrote to memory of 3368 4128 Setup (6).exe 100 PID 4128 wrote to memory of 3784 4128 Setup (6).exe 99 PID 4128 wrote to memory of 3784 4128 Setup (6).exe 99 PID 4128 wrote to memory of 3784 4128 Setup (6).exe 99 PID 4128 wrote to memory of 3792 4128 Setup (6).exe 98 PID 4128 wrote to memory of 3792 4128 Setup (6).exe 98 PID 4128 wrote to memory of 4860 4128 Setup (6).exe 96 PID 4128 wrote to memory of 4860 4128 Setup (6).exe 96 PID 4128 wrote to memory of 4860 4128 Setup (6).exe 96 PID 4128 wrote to memory of 1388 4128 Setup (6).exe 104 PID 4128 wrote to memory of 1388 4128 Setup (6).exe 104 PID 4128 wrote to memory of 1388 4128 Setup (6).exe 104 PID 4128 wrote to memory of 848 4128 Setup (6).exe 108 PID 4128 wrote to memory of 848 4128 Setup (6).exe 108 PID 4128 wrote to memory of 848 4128 Setup (6).exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (6).exe"C:\Users\Admin\AppData\Local\Temp\Setup (6).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\Documents\qlC_TKInhGYfaMcctte6IKTA.exe"C:\Users\Admin\Documents\qlC_TKInhGYfaMcctte6IKTA.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4008 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3684
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4176
-
-
-
C:\Users\Admin\Documents\r8SNnhYzjubq0DbcXx520OTV.exe"C:\Users\Admin\Documents\r8SNnhYzjubq0DbcXx520OTV.exe"2⤵
- Executes dropped EXE
PID:3124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 2803⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe"C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2372 -
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 284⤵
- Program crash
PID:5148
-
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵
- Executes dropped EXE
PID:3856
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:5616
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6072
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:5144
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:3976
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:1144
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:5232
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:872
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4632
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6364
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:1848
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6896
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7160
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7024
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7096
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4988
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7624
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6836
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:3300
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4120
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4176
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6448
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:1120
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8928
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4520
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8376
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8208
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9392
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9676
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8868
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9548
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:11136
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:10312
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8420
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:10744
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7544
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:11668
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9680
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4504
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7640
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9596
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6340
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9836
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9740
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:12916
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:13912
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:13948
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:13752
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:12716
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:8256
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:14812
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:14692
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:15284
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:14456
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:15720
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4340
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7940
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4388
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:16768
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:17440
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:9184
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:6784
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:18316
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:12860
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:13928
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:17572
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:7532
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:4664
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:21340
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:21888
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:13584
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:18632
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:17060
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:16984
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:26544
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:26132
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:12364
-
-
C:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exeC:\Users\Admin\Documents\xPMRFIA93tsdEd5C2DQBTjl9.exe3⤵PID:26156
-
-
-
C:\Users\Admin\Documents\E2MfDGFxvvA8s36PfhzdZnXr.exe"C:\Users\Admin\Documents\E2MfDGFxvvA8s36PfhzdZnXr.exe"2⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\Documents\E2MfDGFxvvA8s36PfhzdZnXr.exe"C:\Users\Admin\Documents\E2MfDGFxvvA8s36PfhzdZnXr.exe"3⤵PID:5224
-
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe"C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:476 -
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵
- Executes dropped EXE
PID:4084
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵
- Executes dropped EXE
PID:4652
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:5580
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:2180
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:5292
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:848
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:1008
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:2824
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6188
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:4404
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:1576
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6536
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:8140
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:7488
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:2844
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:2784
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:240
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6688
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:1456
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:8264
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:7416
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:9168
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6612
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:8392
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:4364
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:8296
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:5688
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10200
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:9192
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10260
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10032
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10632
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11256
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10548
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10392
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11064
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11148
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:5640
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10360
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:7552
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11796
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11656
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6256
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10812
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:9424
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10044
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10164
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13600
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:12628
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13588
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14292
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:12728
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13472
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11968
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14524
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:9668
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14512
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14836
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:12232
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:15500
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13584
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11316
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10976
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:16496
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:17152
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10880
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14260
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:6916
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13116
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10592
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:7224
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:10984
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14100
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:14568
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:13556
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:11812
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:21256
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:26460
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:26132
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:26196
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:24944
-
-
C:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exeC:\Users\Admin\Documents\L7y0XT4gtv1rFLUqlibcwC9K.exe3⤵PID:20488
-
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe"C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4948 -
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵
- Executes dropped EXE
PID:4052
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵
- Executes dropped EXE
PID:5268
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6140
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5436
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5620
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:1952
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5400
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:3988
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6244
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5644
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6804
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6260
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5188
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:7240
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:4044
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6712
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5968
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:2056
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5420
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6848
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:800
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8884
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8348
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8576
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6124
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8792
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8356
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:9384
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:3028
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:10388
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:6196
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:7296
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:2712
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:2492
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8772
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:11608
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:11096
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:3984
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:11116
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:9784
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:2888
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:10852
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5736
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:13704
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8308
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:10596
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:13164
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5336
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8740
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:14744
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:14480
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:11776
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:15308
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:7252
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:15704
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:8568
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:16900
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:13900
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:7988
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:16364
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:18244
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:14216
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:14216
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:14004
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:10672
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:15864
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:21164
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:25848
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:26600
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:11536
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:5988
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:23636
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:25352
-
-
C:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exeC:\Users\Admin\Documents\CNfPC57pYwp43Gsk0V9uGqfL.exe3⤵PID:19608
-
-
-
C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe"C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe"2⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\AfMdle_jmEdHzmELqjpimLtb.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))6⤵PID:2056
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F7⤵PID:5324
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:3168
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "AfMdle_jmEdHzmELqjpimLtb.exe" -F5⤵
- Kills process with taskkill
PID:5020
-
-
-
-
-
C:\Users\Admin\Documents\ZyR2kpr4AH_fJVsDwZsAiSAc.exe"C:\Users\Admin\Documents\ZyR2kpr4AH_fJVsDwZsAiSAc.exe"2⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 2884⤵
- Program crash
PID:17616
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:17976
-
-
-
C:\Users\Admin\Documents\CDoprTj42XZkmS3U6WSvqQZt.exe"C:\Users\Admin\Documents\CDoprTj42XZkmS3U6WSvqQZt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4504 -
C:\Users\Admin\Documents\CDoprTj42XZkmS3U6WSvqQZt.exe"C:\Users\Admin\Documents\CDoprTj42XZkmS3U6WSvqQZt.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2588
-
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe"C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4492 -
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵
- Executes dropped EXE
PID:5024
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵
- Executes dropped EXE
PID:4196
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵
- Executes dropped EXE
PID:5532
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:1580
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:3016
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5976
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:4088
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:2980
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5240
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6928
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6768
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:2692
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6700
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5704
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5856
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6732
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:2684
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:7732
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5524
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:9068
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6600
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5948
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10088
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:9280
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10144
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10912
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10808
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:1252
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10328
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:9652
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6664
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:12240
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:9988
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10096
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:7444
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:13748
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:14312
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:12292
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:13732
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:7780
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:12236
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:14944
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:14888
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:15012
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:2928
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:15636
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:8344
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:16144
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:8556
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:16864
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:16472
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:5748
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:17516
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:18188
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:6968
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:9376
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:14860
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:3388
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:23884
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:16584
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:26164
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:13256
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:10580
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:20396
-
-
C:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exeC:\Users\Admin\Documents\joRWVbGxZcdo4i9yrAQG25nS.exe3⤵PID:23612
-
-
-
C:\Users\Admin\Documents\QUzfdUic0aGcNf8VMkOik1HT.exe"C:\Users\Admin\Documents\QUzfdUic0aGcNf8VMkOik1HT.exe"2⤵
- Executes dropped EXE
PID:4936
-
-
C:\Users\Admin\Documents\VD4_hToaNZoGlmv39kJ_Dz2S.exe"C:\Users\Admin\Documents\VD4_hToaNZoGlmv39kJ_Dz2S.exe"2⤵
- Executes dropped EXE
PID:3560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
-
C:\Users\Admin\Documents\pwwYi3vJwlXLZP1i4buhp21X.exe"C:\Users\Admin\Documents\pwwYi3vJwlXLZP1i4buhp21X.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4932 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\pwwYi3vJwlXLZP1i4buhp21X.exe"3⤵PID:5328
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:3964
-
-
-
-
C:\Users\Admin\Documents\kuoTbm0vCb5_fNfaDzcqiJEI.exe"C:\Users\Admin\Documents\kuoTbm0vCb5_fNfaDzcqiJEI.exe"2⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\Documents\kuoTbm0vCb5_fNfaDzcqiJEI.exe"C:\Users\Admin\Documents\kuoTbm0vCb5_fNfaDzcqiJEI.exe"3⤵PID:7116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 16244⤵
- Program crash
PID:8512
-
-
-
-
C:\Users\Admin\Documents\cUyBaEpfH0FMZ_2qEUQMiW4O.exe"C:\Users\Admin\Documents\cUyBaEpfH0FMZ_2qEUQMiW4O.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792 -
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"3⤵PID:5068
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:2968
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6592
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:5700
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7068
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6680
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6196
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7388
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7696
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7044
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7148
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:5560
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7000
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:8964
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:132
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6884
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9912
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9600
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9904
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9480
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:10700
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7196
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:8836
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:5148
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:11636
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:4032
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6260
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:1480
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:5460
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:11384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11384 -s 285⤵
- Program crash
PID:13192
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:13772
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:2392
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:13080
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9932
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:3340
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:3164
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:13108
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:10992
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:14464
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:15164
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:14364
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:14760
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:15396
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:12136
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:11268
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:11008
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:17080
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:17644
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:6648
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:18072
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:18348
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:9644
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:11196
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:7348
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:19192
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:15820
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:21400
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:3708
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:16696
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:18224
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:24844
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:14180
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:19788
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"4⤵PID:26404
-
-
-
-
C:\Users\Admin\Documents\5goINM87DTEG0SeMlT9rLwrG.exe"C:\Users\Admin\Documents\5goINM87DTEG0SeMlT9rLwrG.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3784
-
-
C:\Users\Admin\Documents\uA0fcvMpzPQ00inXo3TX5X7i.exe"C:\Users\Admin\Documents\uA0fcvMpzPQ00inXo3TX5X7i.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3368
-
-
C:\Users\Admin\Documents\QOrDkSdv9BGNW3GOGigdZieK.exe"C:\Users\Admin\Documents\QOrDkSdv9BGNW3GOGigdZieK.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3280 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:936
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:2004
-
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:2832
-
-
-
C:\Users\Admin\Documents\K1QDZDne4UPpksbLsxoTEIWQ.exe"C:\Users\Admin\Documents\K1QDZDne4UPpksbLsxoTEIWQ.exe"2⤵
- Executes dropped EXE
PID:3896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 2403⤵
- Program crash
PID:5428
-
-
-
C:\Users\Admin\Documents\5jR3SDfMzNqHVpKGQQawILlf.exe"C:\Users\Admin\Documents\5jR3SDfMzNqHVpKGQQawILlf.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4972
-
-
C:\Users\Admin\Documents\ve48BipqMgU7YMg6JQ5qZPA3.exe"C:\Users\Admin\Documents\ve48BipqMgU7YMg6JQ5qZPA3.exe"2⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
-
C:\Users\Admin\Documents\Kc4VkYAY4fsfgdImxXI0pjVd.exe"C:\Users\Admin\Documents\Kc4VkYAY4fsfgdImxXI0pjVd.exe"2⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\Documents\Kc4VkYAY4fsfgdImxXI0pjVd.exe"C:\Users\Admin\Documents\Kc4VkYAY4fsfgdImxXI0pjVd.exe" -u3⤵
- Executes dropped EXE
PID:5044
-
-
-
C:\Users\Admin\Documents\9Wgwg2MjaQPqB6cWHIggpucB.exe"C:\Users\Admin\Documents\9Wgwg2MjaQPqB6cWHIggpucB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Users\Admin\AppData\Roaming\3730505.exe"C:\Users\Admin\AppData\Roaming\3730505.exe"3⤵
- Executes dropped EXE
PID:5724 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5724 -s 23404⤵
- Program crash
PID:8764
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5724 -s 23404⤵
- Program crash
PID:5228
-
-
-
C:\Users\Admin\AppData\Roaming\1645906.exe"C:\Users\Admin\AppData\Roaming\1645906.exe"3⤵
- Executes dropped EXE
PID:5808 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:3212
-
-
-
C:\Users\Admin\AppData\Roaming\5912256.exe"C:\Users\Admin\AppData\Roaming\5912256.exe"3⤵PID:6052
-
-
C:\Users\Admin\AppData\Roaming\5362720.exe"C:\Users\Admin\AppData\Roaming\5362720.exe"3⤵PID:3556
-
-
C:\Users\Admin\AppData\Roaming\3915231.exe"C:\Users\Admin\AppData\Roaming\3915231.exe"3⤵PID:1468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 22084⤵
- Program crash
PID:5340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 22084⤵
- Program crash
PID:5876
-
-
-
-
C:\Users\Admin\Documents\7DZ8aLnJzNC98tgr0DvHNBdH.exe"C:\Users\Admin\Documents\7DZ8aLnJzNC98tgr0DvHNBdH.exe"2⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\is-EVIKG.tmp\7DZ8aLnJzNC98tgr0DvHNBdH.tmp"C:\Users\Admin\AppData\Local\Temp\is-EVIKG.tmp\7DZ8aLnJzNC98tgr0DvHNBdH.tmp" /SL5="$10274,138429,56832,C:\Users\Admin\Documents\7DZ8aLnJzNC98tgr0DvHNBdH.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\is-NRL7C.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-NRL7C.tmp\Setup.exe" /Verysilent4⤵PID:3792
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:2712
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"6⤵PID:8204
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:2088
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:3080
-
C:\Users\Admin\AppData\Roaming\7103359.exe"C:\Users\Admin\AppData\Roaming\7103359.exe"6⤵PID:6372
-
-
C:\Users\Admin\AppData\Roaming\3012156.exe"C:\Users\Admin\AppData\Roaming\3012156.exe"6⤵PID:1428
-
-
C:\Users\Admin\AppData\Roaming\7391869.exe"C:\Users\Admin\AppData\Roaming\7391869.exe"6⤵PID:3956
-
-
C:\Users\Admin\AppData\Roaming\6476454.exe"C:\Users\Admin\AppData\Roaming\6476454.exe"6⤵PID:6000
-
-
C:\Users\Admin\AppData\Roaming\6868748.exe"C:\Users\Admin\AppData\Roaming\6868748.exe"6⤵PID:6492
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:3920
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6448
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\tmpAA6A_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAA6A_tmp.exe"6⤵PID:6996
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:4668
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:5668
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:7204
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:9636
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:10056
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:9632
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:10476
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:12488
-
-
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\is-N45V3.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-N45V3.tmp\stats.tmp" /SL5="$302E0,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\is-EMUM8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-EMUM8.tmp\Setup.exe" /Verysilent7⤵PID:7920
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe"C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe"8⤵PID:1476
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10508
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:2396
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10004
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:8228
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:3804
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:9208
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:11740
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:6340
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:2572
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:6280
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:7572
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10980
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:7768
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10784
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:14032
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:12656
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:13796
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:7896
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:6184
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:14092
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:3792
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:3960
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:15068
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:15532
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:15944
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:15048
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:16136
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:9644
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10788
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:16816
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:4216
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:16416
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10584
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:508
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:11128
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:9976
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:5236
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:14904
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:15264
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:19128
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:23816
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:19692
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:26184
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:5660
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:20244
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:10112
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:25092
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:23112
-
-
C:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exeC:\Users\Admin\Documents\uPArxiLxVnGOA80gK5UuAC9X.exe9⤵PID:22120
-
-
-
C:\Users\Admin\Documents\75rKPxRpgAaiGvcWwKZH0F22.exe"C:\Users\Admin\Documents\75rKPxRpgAaiGvcWwKZH0F22.exe"8⤵PID:9036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9036 -s 2809⤵
- Program crash
PID:9948
-
-
-
C:\Users\Admin\Documents\tNr8qozkBTdym0MHtvHflPQj.exe"C:\Users\Admin\Documents\tNr8qozkBTdym0MHtvHflPQj.exe"8⤵PID:7964
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\tNr8qozkBTdym0MHtvHflPQj.exe"9⤵PID:9456
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK10⤵
- Delays execution with timeout.exe
PID:26096
-
-
-
-
C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe"C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe"8⤵PID:8548
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:9828
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\iNQu8UpoIyb_DuVrNXW_tYNZ.exe" ) do taskkill /iM "%~NXm" -F10⤵PID:10280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "iNQu8UpoIyb_DuVrNXW_tYNZ.exe" -F11⤵
- Kills process with taskkill
PID:5124
-
-
-
-
-
C:\Users\Admin\Documents\GruNf9Sbv_TUs_HFXz0WY1y3.exe"C:\Users\Admin\Documents\GruNf9Sbv_TUs_HFXz0WY1y3.exe"8⤵PID:9108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9108 -s 2729⤵
- Program crash
PID:10956
-
-
-
C:\Users\Admin\Documents\IbSbAP_esp71efkw7e5NcQ4E.exe"C:\Users\Admin\Documents\IbSbAP_esp71efkw7e5NcQ4E.exe"8⤵PID:9112
-
-
C:\Users\Admin\Documents\r9Ax8reiKoeJwthX9sDVYN14.exe"C:\Users\Admin\Documents\r9Ax8reiKoeJwthX9sDVYN14.exe"8⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\is-69SB2.tmp\r9Ax8reiKoeJwthX9sDVYN14.tmp"C:\Users\Admin\AppData\Local\Temp\is-69SB2.tmp\r9Ax8reiKoeJwthX9sDVYN14.tmp" /SL5="$203D6,138429,56832,C:\Users\Admin\Documents\r9Ax8reiKoeJwthX9sDVYN14.exe"9⤵PID:9808
-
C:\Users\Admin\AppData\Local\Temp\is-KLHGN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KLHGN.tmp\Setup.exe" /Verysilent10⤵PID:25076
-
-
-
-
C:\Users\Admin\Documents\SedRQ0oA84nESGGmb4d78078.exe"C:\Users\Admin\Documents\SedRQ0oA84nESGGmb4d78078.exe"8⤵PID:1332
-
C:\Users\Admin\Documents\SedRQ0oA84nESGGmb4d78078.exe"C:\Users\Admin\Documents\SedRQ0oA84nESGGmb4d78078.exe"9⤵PID:9628
-
-
-
C:\Users\Admin\Documents\lDaCES7DRpLMpM103QCsNh4H.exe"C:\Users\Admin\Documents\lDaCES7DRpLMpM103QCsNh4H.exe"8⤵PID:4056
-
-
C:\Users\Admin\Documents\W2Q2QtHIB_eImEodR2Rsb8Zn.exe"C:\Users\Admin\Documents\W2Q2QtHIB_eImEodR2Rsb8Zn.exe"8⤵PID:8600
-
C:\Users\Admin\AppData\Roaming\3670993.exe"C:\Users\Admin\AppData\Roaming\3670993.exe"9⤵PID:5512
-
-
C:\Users\Admin\AppData\Roaming\4509184.exe"C:\Users\Admin\AppData\Roaming\4509184.exe"9⤵PID:6028
-
-
C:\Users\Admin\AppData\Roaming\4509329.exe"C:\Users\Admin\AppData\Roaming\4509329.exe"9⤵PID:7452
-
-
C:\Users\Admin\AppData\Roaming\7565081.exe"C:\Users\Admin\AppData\Roaming\7565081.exe"9⤵PID:12844
-
-
C:\Users\Admin\AppData\Roaming\1707593.exe"C:\Users\Admin\AppData\Roaming\1707593.exe"9⤵PID:19420
-
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe"C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe"8⤵PID:1212
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:11044
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:868
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:6868
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:1464
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:10272
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:3944
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:7476
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9760
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:12068
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:10748
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:7724
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9436
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:1564
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:11156
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9500
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:10952
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:12744
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:13788
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9532
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:8984
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14324
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:7864
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:13960
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14992
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:1660
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14476
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14372
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14504
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:16252
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9388
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:1148
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:16704
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:16892
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:9512
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:16632
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:15552
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:7932
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:17096
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:18060
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:13404
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:14940
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:17268
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:8960
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:7256
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:17880
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:16672
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:15792
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:21224
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:10960
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:25708
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:21984
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:19632
-
-
C:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exeC:\Users\Admin\Documents\K2iZlnW6DbOhcsKXLKYQqMz2.exe9⤵PID:23904
-
-
-
C:\Users\Admin\Documents\dIDAA9j6y0egbAvdax36UBQv.exe"C:\Users\Admin\Documents\dIDAA9j6y0egbAvdax36UBQv.exe"8⤵PID:5492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2449⤵
- Program crash
PID:11596
-
-
-
C:\Users\Admin\Documents\S9Cq2Dd4qvgZ3zxW97qQcr9l.exe"C:\Users\Admin\Documents\S9Cq2Dd4qvgZ3zxW97qQcr9l.exe"8⤵PID:9012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9012 -s 2809⤵
- Program crash
PID:9388
-
-
-
C:\Users\Admin\Documents\eIBq_QjR8hwHUY7eXCIKcqLW.exe"C:\Users\Admin\Documents\eIBq_QjR8hwHUY7eXCIKcqLW.exe"8⤵PID:6524
-
C:\Users\Admin\Documents\eIBq_QjR8hwHUY7eXCIKcqLW.exe"C:\Users\Admin\Documents\eIBq_QjR8hwHUY7eXCIKcqLW.exe" -u9⤵PID:4372
-
-
-
C:\Users\Admin\Documents\7_LMNkYl2kfelqCYwLz3pd8x.exe"C:\Users\Admin\Documents\7_LMNkYl2kfelqCYwLz3pd8x.exe"8⤵PID:3896
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:11188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:8088
-
-
-
C:\Users\Admin\Documents\fujjojV22KkoUMskXaAESL6V.exe"C:\Users\Admin\Documents\fujjojV22KkoUMskXaAESL6V.exe"8⤵PID:3008
-
-
C:\Users\Admin\Documents\CdWDcf3hfZVuz3erWdSW5kvD.exe"C:\Users\Admin\Documents\CdWDcf3hfZVuz3erWdSW5kvD.exe"8⤵PID:8200
-
-
C:\Users\Admin\Documents\UkkzZ5ZRii2MxJW3lDZoa2Tu.exe"C:\Users\Admin\Documents\UkkzZ5ZRii2MxJW3lDZoa2Tu.exe"8⤵PID:6844
-
C:\Users\Admin\Documents\UkkzZ5ZRii2MxJW3lDZoa2Tu.exe"C:\Users\Admin\Documents\UkkzZ5ZRii2MxJW3lDZoa2Tu.exe"9⤵PID:2972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 159210⤵
- Program crash
PID:11976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 159210⤵
- Program crash
PID:6624
-
-
-
-
C:\Users\Admin\Documents\ipvMSUx58DVjIFeRozfczyxs.exe"C:\Users\Admin\Documents\ipvMSUx58DVjIFeRozfczyxs.exe"8⤵PID:9176
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:7316
-
-
-
C:\Users\Admin\Documents\qUKmbt1zYdQpDvubGU7hull4.exe"C:\Users\Admin\Documents\qUKmbt1zYdQpDvubGU7hull4.exe"8⤵PID:7948
-
-
C:\Users\Admin\Documents\vc1_Cniw4O0J9hOuL0ijgnqJ.exe"C:\Users\Admin\Documents\vc1_Cniw4O0J9hOuL0ijgnqJ.exe"8⤵PID:1660
-
C:\Users\Admin\Documents\vc1_Cniw4O0J9hOuL0ijgnqJ.exe"C:\Users\Admin\Documents\vc1_Cniw4O0J9hOuL0ijgnqJ.exe"9⤵PID:14084
-
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe"C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe"8⤵PID:8524
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:7312
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10848
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10836
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:960
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:11036
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10316
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:9936
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:1184
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:6032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 2810⤵
- Program crash
PID:11784
-
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10756
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:12000
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:4548
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:6068
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:11944
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10552
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:12312
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:12400
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:13868
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:13104
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:12680
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10536
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:8160
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:15112
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:15268
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:5480
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:16016
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:9964
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10576
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:13616
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:13000
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:16520
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:10996
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:14500
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:6844
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:16080
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:11716
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:7228
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:11680
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:17144
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:21416
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:18988
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:26076
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:26344
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:22028
-
-
C:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exeC:\Users\Admin\Documents\ZGFmScJoXuIm_mkMzsOYGePR.exe9⤵PID:19824
-
-
-
C:\Users\Admin\Documents\QYuU1Z7UTrUKMRY9XnVKIi1H.exe"C:\Users\Admin\Documents\QYuU1Z7UTrUKMRY9XnVKIi1H.exe"8⤵PID:1548
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:5572
-
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 1C5qJ5HwJ0eXn19vhr0tng.0.21⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3124 -ip 31241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3560 -ip 35601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1388 -ip 13881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3896 -ip 38961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1760 -ip 17601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2260
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:5252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:972
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 4603⤵
- Program crash
PID:6560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 4603⤵
- Program crash
PID:6652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2692 -ip 26921⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7BC8.exeC:\Users\Admin\AppData\Local\Temp\7BC8.exe1⤵PID:1736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 2762⤵
- Program crash
PID:5492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1736 -ip 17361⤵PID:6848
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:7540 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:7708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 4563⤵
- Program crash
PID:7620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 4563⤵
- Program crash
PID:6692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7708 -ip 77081⤵PID:2700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1316
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 8722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\CCED.exeC:\Users\Admin\AppData\Local\Temp\CCED.exe1⤵PID:6016
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5844 -ip 58441⤵PID:5084
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5672
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6692
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7080
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4392
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7164
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 5724 -ip 57241⤵PID:3032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 9168 -ip 91681⤵PID:8224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7116 -ip 71161⤵PID:8340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6124 -ip 61241⤵PID:9360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5948 -ip 59481⤵PID:9120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 9036 -ip 90361⤵PID:9960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9012 -ip 90121⤵PID:9568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1468 -ip 14681⤵PID:8716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 8356 -ip 83561⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9108 -ip 91081⤵PID:6760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 10032 -ip 100321⤵PID:10772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5492 -ip 54921⤵PID:10756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6032 -ip 60321⤵PID:8408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 11384 -ip 113841⤵PID:7040
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:13892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:13508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13508 -s 4563⤵
- Program crash
PID:17608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13508 -s 4563⤵
- Program crash
PID:7940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2972 -ip 29721⤵PID:3272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 12728 -ip 127281⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 11968 -ip 119681⤵PID:14728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 14372 -ip 143721⤵PID:10576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 16768 -ip 167681⤵PID:3752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 13508 -ip 135081⤵PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1376 -ip 13761⤵PID:17752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:8248