Overview
overview
10Static
static
Setup (1).exe
windows10_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows10_x64
10Setup (24).exe
windows10_x64
10Setup (25).exe
windows10_x64
10Setup (26).exe
windows10_x64
10Setup (27).exe
windows10_x64
10Setup (28).exe
windows10_x64
10Setup (29).exe
windows10_x64
10Setup (3).exe
windows10_x64
10Setup (30).exe
windows10_x64
10Setup (31).exe
windows10_x64
10Setup (4).exe
windows10_x64
10Setup (5).exe
windows10_x64
10Setup (6).exe
windows10_x64
10Setup (7).exe
windows10_x64
10Setup (8).exe
windows10_x64
10Setup (9).exe
windows10_x64
Setup.exe
windows10_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
1207s -
max time network
1241s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-09-2021 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win10v20210408
General
-
Target
Setup (13).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
bratanchikAYE
45.14.49.232:63850
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
NORMAN2
45.14.49.184:27587
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10244 8048 rundll32.exe 276 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 40 IoCs
resource yara_rule behavioral5/files/0x000100000001ab83-119.dat family_redline behavioral5/files/0x000100000001ab83-165.dat family_redline behavioral5/memory/4680-252-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/4692-262-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/4692-256-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral5/memory/4680-255-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/4660-254-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/4896-304-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/5080-340-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/4896-360-0x0000000005250000-0x0000000005856000-memory.dmp family_redline behavioral5/memory/1784-359-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/4688-374-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/5064-339-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/4688-399-0x0000000004C90000-0x0000000005296000-memory.dmp family_redline behavioral5/memory/4964-396-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/4424-409-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/1792-429-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/1284-437-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/4424-432-0x0000000004D90000-0x0000000005396000-memory.dmp family_redline behavioral5/memory/4432-411-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/4816-298-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/4836-297-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/4660-250-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/152-453-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/5044-463-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/1792-456-0x0000000004C70000-0x0000000005276000-memory.dmp family_redline behavioral5/memory/180-452-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/1284-462-0x0000000005510000-0x0000000005B16000-memory.dmp family_redline behavioral5/memory/5184-485-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/5316-499-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/5164-484-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/5484-525-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/5596-537-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/5876-569-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/5888-572-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/2836-600-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/5544-601-0x000000000041C5EE-mapping.dmp family_redline behavioral5/memory/3264-624-0x000000000041C5CA-mapping.dmp family_redline behavioral5/memory/5960-625-0x000000000041C5BE-mapping.dmp family_redline behavioral5/memory/5864-646-0x000000000041C5EE-mapping.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral5/memory/1572-289-0x00000000006A0000-0x00000000007EA000-memory.dmp family_vidar behavioral5/memory/1572-300-0x0000000000400000-0x0000000000593000-memory.dmp family_vidar behavioral5/memory/3928-643-0x000000000049ECBD-mapping.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
pid Process 1576 2AbYLCxk8Zkqmk4lR4ZkGb5b.exe 1572 bOwFyc_rqE8QauX_fRDu0rGO.exe 3556 nrelLJfBvAvWpYS0ZmQCWBHT.exe 3952 cFps1__9TZQnikrzSLKPZqk6.exe 4080 gzUbbkRCSjvAckcCH6exZ2EM.exe 3512 EWlxCUwDYK0ri1IqwQiCbj7j.exe 3664 pkVFcJDwIsoZrQ_Y5Vlolypb.exe 1520 Kl2vhbqtOF1gBqcHbyv3kffR.exe 3152 UjGKYxwo3ek9AI8CxIy22YYq.exe 4088 uV1bGIMBIr0KqrKRKdWKGo7a.exe 4076 6PKJmqXlmTjegarWNgSD1FDF.exe 1440 0G8mkEMOQ_yveueRbHYWMX36.exe 2760 lOZp6TxPNuch4RAQcbxt0cqx.exe 3376 ZLoLtvyhpi6wNIV3jbqUpEGq.exe 2284 KTPm0tFlpp5ob_BpwjEdNA6A.exe 3524 kfhBptm0QS8_eg2gnVoJ0RPu.exe 744 a9jnjfdJru5EECRrxeldNq3T.exe 3172 SMUy6MRU3JBSm7UkHFh4uKPX.exe 936 3tp83oKKz0hhtAqPl0KBoxb5.exe 400 DkkLlyf1iRgcnGZafTuJ5Vc6.exe 3552 VURMRLQGA8fO44SHFdd5fkr9.exe 1800 UTzRG4mrimKWWrQdi3yQnKNk.exe 4152 KRdMxhXksdOuzErDtWKy22N0.exe 4216 ezJ5UPJj8TY_CoHrrd9WL2Qe.exe 4480 BOS_3bM_SG6m79emvMefQawS.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a9jnjfdJru5EECRrxeldNq3T.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a9jnjfdJru5EECRrxeldNq3T.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Setup (13).exe -
resource yara_rule behavioral5/files/0x000100000001ab95-171.dat themida behavioral5/files/0x000100000001ab8b-206.dat themida behavioral5/files/0x000100000001ab95-195.dat themida behavioral5/files/0x000100000001ab8b-185.dat themida behavioral5/memory/744-237-0x0000000000A10000-0x0000000000A11000-memory.dmp themida behavioral5/memory/3552-242-0x0000000000110000-0x0000000000111000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a9jnjfdJru5EECRrxeldNq3T.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ipinfo.io 117 ip-api.com 128 ipinfo.io 28 ipinfo.io 32 api.db-ip.com 33 api.db-ip.com 130 ipinfo.io 153 ipinfo.io 1088 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 744 a9jnjfdJru5EECRrxeldNq3T.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe pkVFcJDwIsoZrQ_Y5Vlolypb.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe pkVFcJDwIsoZrQ_Y5Vlolypb.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe pkVFcJDwIsoZrQ_Y5Vlolypb.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini pkVFcJDwIsoZrQ_Y5Vlolypb.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe pkVFcJDwIsoZrQ_Y5Vlolypb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 56 IoCs
pid pid_target Process procid_target 5208 4076 WerFault.exe 86 5828 4076 WerFault.exe 86 6128 3376 WerFault.exe 93 1384 2284 WerFault.exe 108 5132 3952 WerFault.exe 79 4272 1800 WerFault.exe 99 2416 3376 WerFault.exe 93 5992 2284 WerFault.exe 108 6044 3952 WerFault.exe 79 3220 1800 WerFault.exe 99 3000 3376 WerFault.exe 93 5768 2284 WerFault.exe 108 5288 3952 WerFault.exe 79 5820 2284 WerFault.exe 108 192 3376 WerFault.exe 93 4400 3952 WerFault.exe 79 4524 5668 WerFault.exe 186 6364 3376 WerFault.exe 93 6468 2284 WerFault.exe 108 6696 5724 WerFault.exe 200 6876 1800 WerFault.exe 99 7120 2284 WerFault.exe 108 6268 3376 WerFault.exe 93 6796 1800 WerFault.exe 99 6852 6160 WerFault.exe 221 7116 3376 WerFault.exe 93 7156 2284 WerFault.exe 108 4612 3952 WerFault.exe 79 6868 2284 WerFault.exe 108 4156 6704 WerFault.exe 239 7076 3952 WerFault.exe 79 4120 4076 WerFault.exe 86 5192 2284 WerFault.exe 108 7300 3952 WerFault.exe 79 7616 2284 WerFault.exe 108 7880 3952 WerFault.exe 79 7236 2284 WerFault.exe 108 8180 4076 WerFault.exe 86 6508 5492 WerFault.exe 268 7804 2284 WerFault.exe 108 5508 2284 WerFault.exe 108 7668 2184 WerFault.exe 275 9144 8836 WerFault.exe 297 12876 3952 WerFault.exe 79 12408 3952 WerFault.exe 79 10772 13008 WerFault.exe 428 14064 13588 WerFault.exe 457 2856 3952 WerFault.exe 79 13796 15404 WerFault.exe 528 4520 7808 WerFault.exe 551 16752 14448 WerFault.exe 593 17544 18216 WerFault.exe 612 18976 18080 WerFault.exe 624 19584 18780 WerFault.exe 7968 20052 WerFault.exe 685 20316 21008 WerFault.exe 732 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4120 schtasks.exe 5024 schtasks.exe -
Kills process with taskkill 5 IoCs
pid Process 7992 taskkill.exe 8596 taskkill.exe 7236 taskkill.exe 11472 taskkill.exe 11464 taskkill.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 152 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 167 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 908 Setup (13).exe 908 Setup (13).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3152 UjGKYxwo3ek9AI8CxIy22YYq.exe Token: SeDebugPrivilege 4152 KRdMxhXksdOuzErDtWKy22N0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 908 wrote to memory of 1576 908 Setup (13).exe 78 PID 908 wrote to memory of 1576 908 Setup (13).exe 78 PID 908 wrote to memory of 1576 908 Setup (13).exe 78 PID 908 wrote to memory of 1572 908 Setup (13).exe 82 PID 908 wrote to memory of 1572 908 Setup (13).exe 82 PID 908 wrote to memory of 1572 908 Setup (13).exe 82 PID 908 wrote to memory of 4080 908 Setup (13).exe 83 PID 908 wrote to memory of 4080 908 Setup (13).exe 83 PID 908 wrote to memory of 4080 908 Setup (13).exe 83 PID 908 wrote to memory of 3512 908 Setup (13).exe 81 PID 908 wrote to memory of 3512 908 Setup (13).exe 81 PID 908 wrote to memory of 3556 908 Setup (13).exe 80 PID 908 wrote to memory of 3556 908 Setup (13).exe 80 PID 908 wrote to memory of 3556 908 Setup (13).exe 80 PID 908 wrote to memory of 3952 908 Setup (13).exe 79 PID 908 wrote to memory of 3952 908 Setup (13).exe 79 PID 908 wrote to memory of 3952 908 Setup (13).exe 79 PID 908 wrote to memory of 3152 908 Setup (13).exe 89 PID 908 wrote to memory of 3152 908 Setup (13).exe 89 PID 908 wrote to memory of 1520 908 Setup (13).exe 88 PID 908 wrote to memory of 1520 908 Setup (13).exe 88 PID 908 wrote to memory of 1520 908 Setup (13).exe 88 PID 908 wrote to memory of 3664 908 Setup (13).exe 87 PID 908 wrote to memory of 3664 908 Setup (13).exe 87 PID 908 wrote to memory of 3664 908 Setup (13).exe 87 PID 908 wrote to memory of 4076 908 Setup (13).exe 86 PID 908 wrote to memory of 4076 908 Setup (13).exe 86 PID 908 wrote to memory of 4076 908 Setup (13).exe 86 PID 908 wrote to memory of 4088 908 Setup (13).exe 85 PID 908 wrote to memory of 4088 908 Setup (13).exe 85 PID 908 wrote to memory of 4088 908 Setup (13).exe 85 PID 908 wrote to memory of 1440 908 Setup (13).exe 91 PID 908 wrote to memory of 1440 908 Setup (13).exe 91 PID 908 wrote to memory of 1440 908 Setup (13).exe 91 PID 908 wrote to memory of 2760 908 Setup (13).exe 109 PID 908 wrote to memory of 2760 908 Setup (13).exe 109 PID 908 wrote to memory of 3376 908 Setup (13).exe 93 PID 908 wrote to memory of 3376 908 Setup (13).exe 93 PID 908 wrote to memory of 3376 908 Setup (13).exe 93 PID 908 wrote to memory of 2284 908 Setup (13).exe 108 PID 908 wrote to memory of 2284 908 Setup (13).exe 108 PID 908 wrote to memory of 2284 908 Setup (13).exe 108 PID 908 wrote to memory of 3524 908 Setup (13).exe 94 PID 908 wrote to memory of 3524 908 Setup (13).exe 94 PID 908 wrote to memory of 3524 908 Setup (13).exe 94 PID 908 wrote to memory of 744 908 Setup (13).exe 107 PID 908 wrote to memory of 744 908 Setup (13).exe 107 PID 908 wrote to memory of 744 908 Setup (13).exe 107 PID 908 wrote to memory of 3172 908 Setup (13).exe 105 PID 908 wrote to memory of 3172 908 Setup (13).exe 105 PID 908 wrote to memory of 3172 908 Setup (13).exe 105 PID 908 wrote to memory of 936 908 Setup (13).exe 103 PID 908 wrote to memory of 936 908 Setup (13).exe 103 PID 908 wrote to memory of 936 908 Setup (13).exe 103 PID 908 wrote to memory of 400 908 Setup (13).exe 102 PID 908 wrote to memory of 400 908 Setup (13).exe 102 PID 908 wrote to memory of 400 908 Setup (13).exe 102 PID 908 wrote to memory of 3552 908 Setup (13).exe 100 PID 908 wrote to memory of 3552 908 Setup (13).exe 100 PID 908 wrote to memory of 3552 908 Setup (13).exe 100 PID 908 wrote to memory of 1800 908 Setup (13).exe 99 PID 908 wrote to memory of 1800 908 Setup (13).exe 99 PID 908 wrote to memory of 1800 908 Setup (13).exe 99 PID 908 wrote to memory of 4152 908 Setup (13).exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\Documents\2AbYLCxk8Zkqmk4lR4ZkGb5b.exe"C:\Users\Admin\Documents\2AbYLCxk8Zkqmk4lR4ZkGb5b.exe"2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Users\Admin\Documents\cFps1__9TZQnikrzSLKPZqk6.exe"C:\Users\Admin\Documents\cFps1__9TZQnikrzSLKPZqk6.exe"2⤵
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 3843⤵
- Program crash
PID:5132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 4243⤵
- Program crash
PID:6044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 3883⤵
- Program crash
PID:5288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 6203⤵
- Program crash
PID:4400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 6883⤵
- Program crash
PID:4612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 5963⤵
- Program crash
PID:7076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 6883⤵
- Program crash
PID:7300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 7283⤵
- Program crash
PID:7880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 7803⤵
- Program crash
PID:12876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 7763⤵
- Program crash
PID:12408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 8243⤵
- Program crash
PID:2856
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe"C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe"2⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4660
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4984
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4688
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4432
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:1284
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5044
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5064
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4816
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5316
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5596
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6008
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4104
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:3264
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6008
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6052
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 244⤵
- Program crash
PID:4524
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:416
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 244⤵
- Program crash
PID:6696
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6624
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7028
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6476
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6980
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:1804
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6220
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4932
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7100
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7368
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7712
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8072
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5756
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:2184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 244⤵
- Program crash
PID:7668
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7748
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6680
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8304
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8624
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8952
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5252
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8672
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9108
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4800
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6592
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9456
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9732
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10052
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9496
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6720
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6856
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9680
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:4492
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:3112
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9884
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10568
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11096
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10752
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10660
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10324
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:5560
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8352
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11916
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11372
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12164
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11816
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12532
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12968
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12412
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13000
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:6616
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12780
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12448
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13280
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:3968
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10896
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9536
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11680
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12632
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10308
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13524
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13864
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14156
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13184
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13836
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12428
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:12576
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14064
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13612
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14260
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14612
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14360
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14744
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15376
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15660
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14504
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15892
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16312
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14740
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15676
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15904
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14740
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15404 -s 244⤵
- Program crash
PID:13796
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16232
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10528
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16440
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16744
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17044
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15800
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16852
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16464
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16776
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9492
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17696
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17936
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18176
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15488
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17748
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7508
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18004
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17940
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:2464
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:9588
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8292
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14448 -s 244⤵
- Program crash
PID:16752
-
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:11064
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17528
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:1344
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17484
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8380
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13424
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:13484
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17148
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:3344
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18520
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18900
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18280
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19248
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17876
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:8812
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18840
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19616
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20016
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20228
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19344
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19144
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18700
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19592
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:1444
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7492
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:7856
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20100
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20364
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17616
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15968
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20392
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:16896
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14328
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19992
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:18668
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20468
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:10256
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:15464
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17316
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:2304
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:19044
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:14476
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20780
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:21112
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20676
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:21432
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:20908
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:17448
-
-
C:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exeC:\Users\Admin\Documents\nrelLJfBvAvWpYS0ZmQCWBHT.exe3⤵PID:21324
-
-
-
C:\Users\Admin\Documents\EWlxCUwDYK0ri1IqwQiCbj7j.exe"C:\Users\Admin\Documents\EWlxCUwDYK0ri1IqwQiCbj7j.exe"2⤵
- Executes dropped EXE
PID:3512
-
-
C:\Users\Admin\Documents\bOwFyc_rqE8QauX_fRDu0rGO.exe"C:\Users\Admin\Documents\bOwFyc_rqE8QauX_fRDu0rGO.exe"2⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im bOwFyc_rqE8QauX_fRDu0rGO.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\bOwFyc_rqE8QauX_fRDu0rGO.exe" & del C:\ProgramData\*.dll & exit3⤵PID:6188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im bOwFyc_rqE8QauX_fRDu0rGO.exe /f4⤵
- Kills process with taskkill
PID:8596
-
-
-
-
C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe"C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe"2⤵
- Executes dropped EXE
PID:4080 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵PID:5976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\gzUbbkRCSjvAckcCH6exZ2EM.exe" ) do taskkill -F /Im "%~nXN"4⤵PID:8188
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG5⤵PID:7328
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )6⤵PID:10192
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"7⤵PID:11888
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p6⤵PID:12680
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "gzUbbkRCSjvAckcCH6exZ2EM.exe"5⤵
- Kills process with taskkill
PID:7992
-
-
-
-
-
C:\Users\Admin\Documents\uV1bGIMBIr0KqrKRKdWKGo7a.exe"C:\Users\Admin\Documents\uV1bGIMBIr0KqrKRKdWKGo7a.exe"2⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\Documents\uV1bGIMBIr0KqrKRKdWKGo7a.exe"C:\Users\Admin\Documents\uV1bGIMBIr0KqrKRKdWKGo7a.exe"3⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im uV1bGIMBIr0KqrKRKdWKGo7a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\uV1bGIMBIr0KqrKRKdWKGo7a.exe" & del C:\ProgramData\*.dll & exit4⤵PID:2624
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im uV1bGIMBIr0KqrKRKdWKGo7a.exe /f5⤵
- Kills process with taskkill
PID:7236
-
-
-
-
-
C:\Users\Admin\Documents\6PKJmqXlmTjegarWNgSD1FDF.exe"C:\Users\Admin\Documents\6PKJmqXlmTjegarWNgSD1FDF.exe"2⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 7723⤵
- Program crash
PID:5208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 8243⤵
- Program crash
PID:5828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 11003⤵
- Program crash
PID:4120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 11443⤵
- Program crash
PID:8180
-
-
-
C:\Users\Admin\Documents\pkVFcJDwIsoZrQ_Y5Vlolypb.exe"C:\Users\Admin\Documents\pkVFcJDwIsoZrQ_Y5Vlolypb.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3664 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵PID:5624
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:5672
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:5696
-
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe"C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe"2⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4680
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4836
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4760
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4956
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4424
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1792
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:152
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5080
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5184
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5484
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5888
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5544
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:3828
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5864
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1504
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:3828
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4356
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4124
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6536
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6944
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5180
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6536
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4544
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6852
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7100
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7156
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5248
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7584
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7960
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 244⤵
- Program crash
PID:6508
-
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4652
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8124
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8180
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1660
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4204
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8484
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8836 -s 244⤵
- Program crash
PID:9144
-
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9132
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8216
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8736
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8976
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8388
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9352
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9648
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9924
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10228
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9840
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10196
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9620
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:3240
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5016
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:3160
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10288
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10776
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:5104
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11036
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10676
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1328
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6416
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11348
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12128
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4928
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11448
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11424
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12696
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13092
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12392
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13172
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12080
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13008 -s 244⤵
- Program crash
PID:10772
-
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12836
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1292
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10312
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12824
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13176
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12992
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11436
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12924
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13344
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13680
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13992
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14308
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13404
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13800
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7876
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:13040
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9376
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11556
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1836
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14668
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14376
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:12212
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14716
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14036
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15700
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15436
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15944
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14128
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15628
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16112
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16008
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6580
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15512
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15788
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16404
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16708
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17136
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16136
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16752
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16776
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17288
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17192
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15980
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17504
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17716
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18040
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15500
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17648
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17912
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8424
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17800
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10488
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16204
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16576
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9804
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7840
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18308
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:3752
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16608
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:9316
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16332
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17412
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18344
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15928
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18584
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17860
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18968
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19332
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14124
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18636
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19380
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:6692
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18632
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18300
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19464
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19720
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20416
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17092
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:7392
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20180
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18600
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10044
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19428
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19900
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:8792
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19580
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19808
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:17024
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20128
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:4380
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20192
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11660
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20292
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:15464
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:1452
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:19236
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:18808
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:20636
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:21008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 21008 -s 244⤵
- Program crash
PID:20316
-
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:21336
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:14116
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:16768
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:11868
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:21328
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:21344
-
-
C:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exeC:\Users\Admin\Documents\Kl2vhbqtOF1gBqcHbyv3kffR.exe3⤵PID:10944
-
-
-
C:\Users\Admin\Documents\UjGKYxwo3ek9AI8CxIy22YYq.exe"C:\Users\Admin\Documents\UjGKYxwo3ek9AI8CxIy22YYq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152 -
C:\Users\Admin\AppData\Roaming\7710328.exe"C:\Users\Admin\AppData\Roaming\7710328.exe"3⤵PID:3872
-
-
C:\Users\Admin\AppData\Roaming\4823677.exe"C:\Users\Admin\AppData\Roaming\4823677.exe"3⤵PID:5936
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:8764
-
-
-
C:\Users\Admin\AppData\Roaming\1674305.exe"C:\Users\Admin\AppData\Roaming\1674305.exe"3⤵PID:4888
-
-
C:\Users\Admin\AppData\Roaming\4518330.exe"C:\Users\Admin\AppData\Roaming\4518330.exe"3⤵PID:5288
-
-
C:\Users\Admin\AppData\Roaming\1368958.exe"C:\Users\Admin\AppData\Roaming\1368958.exe"3⤵PID:5564
-
-
-
C:\Users\Admin\Documents\0G8mkEMOQ_yveueRbHYWMX36.exe"C:\Users\Admin\Documents\0G8mkEMOQ_yveueRbHYWMX36.exe"2⤵
- Executes dropped EXE
PID:1440 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:1804
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵PID:6152
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵PID:10372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffad9324f50,0x7ffad9324f60,0x7ffad9324f704⤵PID:10264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1536 /prefetch:24⤵PID:11672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1868 /prefetch:84⤵PID:11712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:84⤵PID:11736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:14⤵PID:6520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:14⤵PID:11872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:14⤵PID:12052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:14⤵PID:12184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:14⤵PID:12104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:14⤵PID:12260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:84⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2016 /prefetch:84⤵PID:10904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:84⤵PID:11056
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵PID:11756
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6470aa890,0x7ff6470aa8a0,0x7ff6470aa8b05⤵PID:13692
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5728 /prefetch:24⤵PID:13844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,12820072626514198032,10930892017559576196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 /prefetch:84⤵PID:12104
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 1440 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\0G8mkEMOQ_yveueRbHYWMX36.exe"3⤵PID:11288
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 14404⤵
- Kills process with taskkill
PID:11472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 1440 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\0G8mkEMOQ_yveueRbHYWMX36.exe"3⤵PID:11280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 14404⤵
- Kills process with taskkill
PID:11464
-
-
-
-
C:\Users\Admin\Documents\ZLoLtvyhpi6wNIV3jbqUpEGq.exe"C:\Users\Admin\Documents\ZLoLtvyhpi6wNIV3jbqUpEGq.exe"2⤵
- Executes dropped EXE
PID:3376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 6603⤵
- Program crash
PID:6128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 6643⤵
- Program crash
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 6803⤵
- Program crash
PID:3000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 6523⤵
- Program crash
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 8923⤵
- Program crash
PID:6364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 11163⤵
- Program crash
PID:6268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 11083⤵
- Program crash
PID:7116
-
-
-
C:\Users\Admin\Documents\kfhBptm0QS8_eg2gnVoJ0RPu.exe"C:\Users\Admin\Documents\kfhBptm0QS8_eg2gnVoJ0RPu.exe"2⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\Documents\kfhBptm0QS8_eg2gnVoJ0RPu.exe"C:\Users\Admin\Documents\kfhBptm0QS8_eg2gnVoJ0RPu.exe" -u3⤵PID:4200
-
-
-
C:\Users\Admin\Documents\ezJ5UPJj8TY_CoHrrd9WL2Qe.exe"C:\Users\Admin\Documents\ezJ5UPJj8TY_CoHrrd9WL2Qe.exe"2⤵
- Executes dropped EXE
PID:4216
-
-
C:\Users\Admin\Documents\KRdMxhXksdOuzErDtWKy22N0.exe"C:\Users\Admin\Documents\KRdMxhXksdOuzErDtWKy22N0.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4152 -
C:\Users\Admin\AppData\Roaming\5232808.exe"C:\Users\Admin\AppData\Roaming\5232808.exe"3⤵PID:4236
-
-
C:\Users\Admin\AppData\Roaming\2459520.exe"C:\Users\Admin\AppData\Roaming\2459520.exe"3⤵PID:3144
-
-
C:\Users\Admin\AppData\Roaming\3742067.exe"C:\Users\Admin\AppData\Roaming\3742067.exe"3⤵PID:6012
-
-
C:\Users\Admin\AppData\Roaming\5443324.exe"C:\Users\Admin\AppData\Roaming\5443324.exe"3⤵PID:6228
-
-
C:\Users\Admin\AppData\Roaming\5024613.exe"C:\Users\Admin\AppData\Roaming\5024613.exe"3⤵PID:6204
-
-
-
C:\Users\Admin\Documents\UTzRG4mrimKWWrQdi3yQnKNk.exe"C:\Users\Admin\Documents\UTzRG4mrimKWWrQdi3yQnKNk.exe"2⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 7003⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 6963⤵
- Program crash
PID:3220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 11203⤵
- Program crash
PID:6876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 11563⤵
- Program crash
PID:6796
-
-
-
C:\Users\Admin\Documents\VURMRLQGA8fO44SHFdd5fkr9.exe"C:\Users\Admin\Documents\VURMRLQGA8fO44SHFdd5fkr9.exe"2⤵
- Executes dropped EXE
PID:3552
-
-
C:\Users\Admin\Documents\DkkLlyf1iRgcnGZafTuJ5Vc6.exe"C:\Users\Admin\Documents\DkkLlyf1iRgcnGZafTuJ5Vc6.exe"2⤵
- Executes dropped EXE
PID:400 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5024
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe"C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe"2⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4692
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4896
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:1784
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4964
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4980
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:180
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:3740
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5164
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5512
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5876
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:2836
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5960
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4332
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5020
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5852
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4672
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6212
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6812
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 244⤵
- Program crash
PID:6852
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6792
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6224
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:5224
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 244⤵
- Program crash
PID:4156
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:3740
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7188
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7560
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7984
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7440
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7908
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8108
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:3772
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7652
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8332
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8644
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8984
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8236
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8700
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8396
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8236
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9240
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9552
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9860
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10176
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9100
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10168
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9328
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9652
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7160
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:2108
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10364
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10924
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10648
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10988
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8528
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11028
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4200
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11796
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11216
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11616
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:2168
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12480
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12928
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8608
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12952
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:360
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12912
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12672
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:13076
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:13080
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10064
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11908
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12204
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11012
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12916
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:13588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13588 -s 244⤵
- Program crash
PID:14064
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14072
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12924
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:13892
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10576
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6200
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:13644
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:3932
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14552
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14456
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14476
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14176
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15456
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15792
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16100
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15584
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15852
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10564
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15656
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16056
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16700
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17124
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16868
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:8364
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 244⤵
- Program crash
PID:4520
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17652
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17900
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18208
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17616
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7180
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14584
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17088
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12120
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:11724
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6272
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15528
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6596
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17308
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:7452
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:15500
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17168
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18216 -s 244⤵
- Program crash
PID:17544
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17416
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:10680
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17160
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18080 -s 244⤵
- Program crash
PID:18976
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18820
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19108
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19384
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18744
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18788
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17616
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:940
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4928
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6248
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18400
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19680
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20092
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20372
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:17316
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:12028
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18780
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19016
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19364
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19584
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 20052 -s 244⤵
- Program crash
PID:7968
-
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:18912
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14328
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20308
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16908
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9900
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:9888
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:14748
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20304
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16620
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19664
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:19700
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:2072
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20124
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:16724
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20832
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:21196
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:6756
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20888
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:21428
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20548
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:20756
-
-
C:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exeC:\Users\Admin\Documents\3tp83oKKz0hhtAqPl0KBoxb5.exe3⤵PID:4928
-
-
-
C:\Users\Admin\Documents\SMUy6MRU3JBSm7UkHFh4uKPX.exe"C:\Users\Admin\Documents\SMUy6MRU3JBSm7UkHFh4uKPX.exe"2⤵
- Executes dropped EXE
PID:3172
-
-
C:\Users\Admin\Documents\a9jnjfdJru5EECRrxeldNq3T.exe"C:\Users\Admin\Documents\a9jnjfdJru5EECRrxeldNq3T.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:744
-
-
C:\Users\Admin\Documents\KTPm0tFlpp5ob_BpwjEdNA6A.exe"C:\Users\Admin\Documents\KTPm0tFlpp5ob_BpwjEdNA6A.exe"2⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 7363⤵
- Program crash
PID:1384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 7403⤵
- Program crash
PID:5992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 7563⤵
- Program crash
PID:5768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 7283⤵
- Program crash
PID:5820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 9443⤵
- Program crash
PID:6468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 11923⤵
- Program crash
PID:7120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12443⤵
- Program crash
PID:7156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 11523⤵
- Program crash
PID:6868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13123⤵
- Program crash
PID:5192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12763⤵
- Program crash
PID:7616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12803⤵
- Program crash
PID:7236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12723⤵
- Program crash
PID:7804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12123⤵
- Program crash
PID:5508
-
-
-
C:\Users\Admin\Documents\lOZp6TxPNuch4RAQcbxt0cqx.exe"C:\Users\Admin\Documents\lOZp6TxPNuch4RAQcbxt0cqx.exe"2⤵
- Executes dropped EXE
PID:2760
-
-
C:\Users\Admin\Documents\BOS_3bM_SG6m79emvMefQawS.exe"C:\Users\Admin\Documents\BOS_3bM_SG6m79emvMefQawS.exe"2⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\is-A8M3F.tmp\BOS_3bM_SG6m79emvMefQawS.tmp"C:\Users\Admin\AppData\Local\Temp\is-A8M3F.tmp\BOS_3bM_SG6m79emvMefQawS.tmp" /SL5="$1028E,138429,56832,C:\Users\Admin\Documents\BOS_3bM_SG6m79emvMefQawS.exe"3⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\is-2L2AB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2L2AB.tmp\Setup.exe" /Verysilent4⤵PID:6836
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:10244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:10264
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:10496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18780 -s 281⤵
- Program crash
PID:19584