Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
1801s -
max time network
1809s -
platform
windows11_x64 -
resource
win11 -
submitted
01-09-2021 13:04
Static task
static1
Behavioral task
behavioral1
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup.exe
Resource
win11
General
-
Target
Setup.exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
bratanchikAYE
45.14.49.232:63850
Extracted
metasploit
windows/single_exec
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
1
37.0.8.88:44263
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral7/memory/2472-292-0x00000000046F0000-0x0000000005016000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 3228 rundll32.exe 150 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7824 3228 rUNdlL32.eXe 150 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7388 3228 rundll32.exe 150 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 14 IoCs
resource yara_rule behavioral7/files/0x000100000002b1f7-188.dat family_redline behavioral7/files/0x000100000002b1f7-214.dat family_redline behavioral7/memory/3648-313-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3648-316-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral7/memory/3184-331-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral7/memory/3184-326-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3368-370-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/1464-367-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/5252-423-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/1072-409-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3592-414-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/6124-473-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/5792-465-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/672-503-0x0000000000000000-mapping.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 29 IoCs
description pid Process procid_target PID 3712 created 560 3712 WerFault.exe 83 PID 3312 created 860 3312 WerFault.exe 81 PID 1096 created 3204 1096 WerFault.exe 85 PID 1868 created 2396 1868 WerFault.exe 104 PID 5084 created 2092 5084 WerFault.exe 100 PID 3256 created 1264 3256 WerFault.exe 103 PID 1468 created 2472 1468 WerFault.exe 433 PID 5772 created 864 5772 468MAX86kZBlx4ZNrrJVNKK8.exe 86 PID 5788 created 1776 5788 WerFault.exe 429 PID 4212 created 3008 4212 468MAX86kZBlx4ZNrrJVNKK8.exe 465 PID 6680 created 3788 6680 WerFault.exe 199 PID 3676 created 6824 3676 WerFault.exe 478 PID 4796 created 7952 4796 WerFault.exe 262 PID 5940 created 7768 5940 WerFault.exe 545 PID 8600 created 8476 8600 6Ghd6tbPXeIptbY5eR0zjYBH.exe 811 PID 4416 created 1420 4416 x9A7zksb2bNiKlCcEJwaFrCp.exe 306 PID 2916 created 8872 2916 WerFault.exe 290 PID 3256 created 8548 3256 WerFault.exe 876 PID 3120 created 8384 3120 6Ghd6tbPXeIptbY5eR0zjYBH.exe 300 PID 8328 created 3496 8328 WerFault.exe 153 PID 8016 created 6840 8016 WerFault.exe 746 PID 2624 created 6864 2624 WerFault.exe 1216 PID 2624 created 6024 2624 WerFault.exe 163 PID 7152 created 5536 7152 WerFault.exe 164 PID 4420 created 9124 4420 WerFault.exe 351 PID 9004 created 6284 9004 WerFault.exe 834 PID 2200 created 2012 2200 468MAX86kZBlx4ZNrrJVNKK8.exe 179 PID 9284 created 8504 9284 WerFault.exe 298 PID 9416 created 10068 9416 WerFault.exe 404 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral7/memory/864-493-0x0000000000930000-0x0000000000A03000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 3204 KPIi6venqhklUEudwrH7yto5.exe 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 864 Cz2mJKDOU6JIpIwSwjt1s13E.exe 3196 s5LTZzJ14a7hoh1dzHlb0_JV.exe 560 3yVTDofbAXuNCSkNG6JIEdzA.exe 936 1OiXCcYBqCNSAzwk7Sl2UQKi.exe 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 860 1HwuLZOI_ia2IDtVepwPgTM7.exe 1452 Sm9jDaF5Rn5LS3KcKxG2nzVR.exe 1776 SbFnp3JBK5VZBGiEynEtSQEe.exe 1872 v0EJ9FujNNKwBVFI7ameFHNX.exe 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 2076 83rQNR7RSbxdY8xX2J7rAyEE.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2396 xh0nODyBNlZlURB4Fb2VtkzP.exe 1264 EJ4nDdCHxLLkR1IVMy4D4SKF.exe 2472 V3b1g_uOXSquvDp3y3Jp932Y.exe 2988 Mt5xso5G5tPeikFaMR0NRjyf.exe 2092 gQMDUFD63cpqvLTMYyNd2xM6.exe 4728 QU2OVBU5HGnIhS7hhd4pOPiv.exe 3984 zaJAoc_OY4FNXjLZpLLCIcQq.exe 1420 b_sIp1i9t84MS7P5nKEJxyEy.exe 2744 inst001.exe 1048 cutm3.exe 1408 md8_8eus.exe 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 4936 un9LQrwOV2iHPurv5fMmo2bD.exe 4276 v0EJ9FujNNKwBVFI7ameFHNX.exe 2220 KRkNvH~YgUUt9O.exE 3500 468MAX86kZBlx4ZNrrJVNKK8.exe 3648 x9A7zksb2bNiKlCcEJwaFrCp.exe 3184 6Ghd6tbPXeIptbY5eR0zjYBH.exe 3496 2580479.exe 1176 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1464 468MAX86kZBlx4ZNrrJVNKK8.exe 3368 x9A7zksb2bNiKlCcEJwaFrCp.exe 2272 6Ghd6tbPXeIptbY5eR0zjYBH.exe 5140 6Ghd6tbPXeIptbY5eR0zjYBH.exe 5160 Setup.exe 5328 1167733.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5536 2537226.exe 1072 468MAX86kZBlx4ZNrrJVNKK8.exe 3592 x9A7zksb2bNiKlCcEJwaFrCp.exe 5252 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6024 4849177.exe 5244 3741778.exe 5864 x9A7zksb2bNiKlCcEJwaFrCp.exe 3004 2293663.exe 5792 468MAX86kZBlx4ZNrrJVNKK8.exe 984 x9A7zksb2bNiKlCcEJwaFrCp.exe 6124 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 5316 PBrowFile15.exe 672 x9A7zksb2bNiKlCcEJwaFrCp.exe 2012 4309220.exe 3996 468MAX86kZBlx4ZNrrJVNKK8.exe 4060 x9A7zksb2bNiKlCcEJwaFrCp.exe 5484 lg.exe 2140 LivelyScreenRecS3.0.exe 4668 note866.exe 5416 x9A7zksb2bNiKlCcEJwaFrCp.exe 3200 stats.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ql_KNI31XxIlq1zxg9cGzU8I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ql_KNI31XxIlq1zxg9cGzU8I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion x9A7zksb2bNiKlCcEJwaFrCp.exe -
Loads dropped DLL 11 IoCs
pid Process 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 1996 stats.tmp 1996 stats.tmp 3008 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 7952 rundll32.exe 8640 WerFault.exe 8640 WerFault.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral7/files/0x000100000002b1fb-190.dat themida behavioral7/files/0x000100000002b200-202.dat themida behavioral7/files/0x000100000002b1fb-208.dat themida behavioral7/files/0x000100000002b200-253.dat themida behavioral7/memory/2348-301-0x0000000000CB0000-0x0000000000CB1000-memory.dmp themida behavioral7/memory/3984-305-0x0000000000310000-0x0000000000311000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6Ghd6tbPXeIptbY5eR0zjYBH.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp9B95_tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp9B95_tmp.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ql_KNI31XxIlq1zxg9cGzU8I.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 ip-api.com 87 ipinfo.io 113 ipinfo.io 209 ipinfo.io 351 ipinfo.io 352 ipinfo.io 386 ipinfo.io 1 ipinfo.io 485 ipinfo.io 89 ipinfo.io 140 ipinfo.io 185 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 3984 zaJAoc_OY4FNXjLZpLLCIcQq.exe 3660 ql_KNI31XxIlq1zxg9cGzU8I.exe 5876 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 856 set thread context of 3648 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 136 PID 452 set thread context of 3184 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 132 PID 1852 set thread context of 1464 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 141 PID 856 set thread context of 3368 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 143 PID 1852 set thread context of 1072 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 151 PID 856 set thread context of 3592 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 149 PID 452 set thread context of 5252 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 154 PID 1852 set thread context of 5792 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 160 PID 452 set thread context of 6124 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 162 PID 856 set thread context of 672 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 172 PID 1852 set thread context of 3996 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 183 PID 856 set thread context of 5416 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 188 PID 1852 set thread context of 5944 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 189 PID 856 set thread context of 3860 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 196 PID 452 set thread context of 5700 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 201 PID 1852 set thread context of 256 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 208 PID 1852 set thread context of 776 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 211 PID 856 set thread context of 6044 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 213 PID 452 set thread context of 5984 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 214 PID 856 set thread context of 6272 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 219 PID 1852 set thread context of 6824 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 478 PID 856 set thread context of 7060 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 227 PID 452 set thread context of 6568 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 225 PID 452 set thread context of 1176 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 237 PID 856 set thread context of 4648 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 240 PID 452 set thread context of 5704 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 242 PID 856 set thread context of 5988 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 243 PID 856 set thread context of 7364 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 252 PID 452 set thread context of 7288 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 253 PID 1852 set thread context of 3844 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 247 PID 1852 set thread context of 8096 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 265 PID 856 set thread context of 8168 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 321 PID 452 set thread context of 8044 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 266 PID 1852 set thread context of 5260 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 320 PID 452 set thread context of 1168 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 274 PID 1852 set thread context of 7928 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 275 PID 856 set thread context of 7684 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 277 PID 1452 set thread context of 8668 1452 Sm9jDaF5Rn5LS3KcKxG2nzVR.exe 293 PID 1852 set thread context of 8476 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 811 PID 452 set thread context of 8688 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 292 PID 856 set thread context of 8964 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 281 PID 1852 set thread context of 8276 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 284 PID 452 set thread context of 4404 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 287 PID 856 set thread context of 8856 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 325 PID 1852 set thread context of 8436 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 329 PID 856 set thread context of 7496 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 338 PID 452 set thread context of 4616 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 343 PID 1852 set thread context of 8912 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 344 PID 856 set thread context of 7440 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 366 PID 7688 set thread context of 2192 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 345 PID 452 set thread context of 2024 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 354 PID 856 set thread context of 7968 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 352 PID 5020 set thread context of 4284 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe 346 PID 1852 set thread context of 6664 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 347 PID 452 set thread context of 9124 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 351 PID 7688 set thread context of 6384 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 350 PID 856 set thread context of 4416 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 356 PID 5020 set thread context of 2036 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe 355 PID 1852 set thread context of 6924 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 361 PID 7688 set thread context of 7352 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 357 PID 452 set thread context of 3992 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 358 PID 856 set thread context of 7828 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 359 PID 856 set thread context of 8256 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 378 PID 5020 set thread context of 9212 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe 377 -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Mt5xso5G5tPeikFaMR0NRjyf.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Mt5xso5G5tPeikFaMR0NRjyf.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe xjikSqBs9p71niqBEOVxN0cY.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe xjikSqBs9p71niqBEOVxN0cY.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe Setup.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini Setup.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
pid pid_target Process procid_target 4928 860 WerFault.exe 81 1120 2396 WerFault.exe 104 3180 3204 WerFault.exe 85 2256 560 WerFault.exe 83 5988 864 WerFault.exe 86 3964 1776 WerFault.exe 91 5008 3008 WerFault.exe 206 6156 3788 WerFault.exe 199 6464 6824 WerFault.exe 229 7348 7952 WerFault.exe 262 716 1420 WerFault.exe 306 7356 8476 WerFault.exe 299 2196 7768 WerFault.exe 316 8304 8872 WerFault.exe 290 8016 9124 WerFault.exe 351 10208 2012 WerFault.exe 179 9828 6284 WerFault.exe 276 9884 5092 WerFault.exe 440 5740 1244 WerFault.exe 436 3488 9916 WerFault.exe 441 5212 8120 WerFault.exe 461 10416 6348 WerFault.exe 256 9632 6656 WerFault.exe 221 10540 7704 WerFault.exe 270 7232 7336 WerFault.exe 248 7576 2940 WerFault.exe 388 5576 9208 WerFault.exe 375 11004 9692 WerFault.exe 396 6436 10168 WerFault.exe 401 10480 1940 WerFault.exe 484 10536 8580 WerFault.exe 632 5772 10864 WerFault.exe 508 10828 4216 WerFault.exe 666 6104 5800 WerFault.exe 716 5420 7424 WerFault.exe 765 10828 10932 WerFault.exe 812 6092 7244 WerFault.exe 813 4440 2912 WerFault.exe 851 12708 6296 WerFault.exe 878 9840 12512 WerFault.exe 900 1256 2272 WerFault.exe 909 2228 1352 WerFault.exe 910 7644 13272 WerFault.exe 918 4408 12684 WerFault.exe 936 7792 8140 WerFault.exe 952 3120 8696 WerFault.exe 1026 12612 5756 WerFault.exe 1049 11512 13640 WerFault.exe 1118 14636 14816 WerFault.exe 1144 14712 15084 WerFault.exe 1147 13972 14392 Process not Found 1149 11976 2180 Process not Found 1184 16092 15408 Process not Found 1211 16752 12136 Process not Found 1254 17328 16604 Process not Found 1262 16412 16808 Process not Found 1265 14624 15240 Process not Found 1300 23420 22432 Process not Found 1369 24368 6316 Process not Found 1388 28548 18596 Process not Found 1460 28348 21864 Process not Found 1472 28236 12596 Process not Found 1483 19808 29476 Process not Found 1523 21624 16824 Process not Found 1592 -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision x9A7zksb2bNiKlCcEJwaFrCp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 4050658.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 8876 schtasks.exe 4532 schtasks.exe 5496 schtasks.exe 5432 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 2764 timeout.exe 11084 timeout.exe 10556 timeout.exe -
Enumerates system info in registry 2 TTPs 31 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 4050658.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS x9A7zksb2bNiKlCcEJwaFrCp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 4050658.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 4 IoCs
pid Process 4404 taskkill.exe 5220 taskkill.exe 8700 taskkill.exe 9840 taskkill.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 9556 PING.EXE -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 366 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 88 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 92 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 139 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 153 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 344 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4388 Setup.exe 4388 Setup.exe 1120 WerFault.exe 1120 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 4928 WerFault.exe 4928 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5988 x9A7zksb2bNiKlCcEJwaFrCp.exe 5988 x9A7zksb2bNiKlCcEJwaFrCp.exe 3964 Yuvk9b6ccodvNsR2JwuxBAfz.exe 3964 Yuvk9b6ccodvNsR2JwuxBAfz.exe 5008 WerFault.exe 5008 WerFault.exe 6516 msedge.exe 6516 msedge.exe 5016 msedge.exe 5016 msedge.exe 6156 WerFault.exe 6156 WerFault.exe 6464 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 6464 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 7348 WerFault.exe 7348 WerFault.exe 5536 2537226.exe 5536 2537226.exe 3496 2580479.exe 3496 2580479.exe 8792 identity_helper.exe 8792 identity_helper.exe 6024 4849177.exe 6024 4849177.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2012 4309220.exe 2012 4309220.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
pid Process 6392 WinHoster.exe 7160 4076929.exe 7268 7620916.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4728 QU2OVBU5HGnIhS7hhd4pOPiv.exe Token: SeRestorePrivilege 4928 WerFault.exe Token: SeBackupPrivilege 4928 WerFault.exe Token: SeBackupPrivilege 4928 WerFault.exe Token: SeDebugPrivilege 4936 un9LQrwOV2iHPurv5fMmo2bD.exe Token: SeDebugPrivilege 4404 6Ghd6tbPXeIptbY5eR0zjYBH.exe Token: SeDebugPrivilege 3496 2580479.exe Token: SeDebugPrivilege 5536 2537226.exe Token: SeDebugPrivilege 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe Token: SeDebugPrivilege 6024 4849177.exe Token: SeDebugPrivilege 5316 PBrowFile15.exe Token: SeDebugPrivilege 2012 4309220.exe Token: SeDebugPrivilege 5560 Yuvk9b6ccodvNsR2JwuxBAfz.exe Token: SeDebugPrivilege 2140 LivelyScreenRecS3.0.exe Token: SeDebugPrivilege 2348 BcYTY2JXtkuAtChqtILjkTTh.exe Token: SeDebugPrivilege 3984 x9A7zksb2bNiKlCcEJwaFrCp.exe Token: SeDebugPrivilege 6656 6021749.exe Token: SeDebugPrivilege 5140 6Ghd6tbPXeIptbY5eR0zjYBH.exe Token: SeDebugPrivilege 5328 1167733.exe Token: SeDebugPrivilege 6348 1748141.exe Token: SeDebugPrivilege 7336 8571699.exe Token: SeDebugPrivilege 984 x9A7zksb2bNiKlCcEJwaFrCp.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeDebugPrivilege 7704 2562092.exe Token: SeDebugPrivilege 6408 x2ARhHhqm2nRHegZfup3BisP.exe Token: SeDebugPrivilege 8540 Process not Found Token: SeDebugPrivilege 3004 2293663.exe Token: SeDebugPrivilege 7780 3084587.exe Token: SeDebugPrivilege 6364 1007247.exe Token: SeDebugPrivilege 2940 468MAX86kZBlx4ZNrrJVNKK8.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1204 Yuvk9b6ccodvNsR2JwuxBAfz.exe 1996 stats.tmp 5016 msedge.exe 8640 WerFault.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4388 wrote to memory of 856 4388 Setup.exe 87 PID 4388 wrote to memory of 856 4388 Setup.exe 87 PID 4388 wrote to memory of 856 4388 Setup.exe 87 PID 4388 wrote to memory of 864 4388 Setup.exe 86 PID 4388 wrote to memory of 864 4388 Setup.exe 86 PID 4388 wrote to memory of 864 4388 Setup.exe 86 PID 4388 wrote to memory of 3204 4388 Setup.exe 85 PID 4388 wrote to memory of 3204 4388 Setup.exe 85 PID 4388 wrote to memory of 3204 4388 Setup.exe 85 PID 4388 wrote to memory of 3196 4388 Setup.exe 84 PID 4388 wrote to memory of 3196 4388 Setup.exe 84 PID 4388 wrote to memory of 560 4388 Setup.exe 83 PID 4388 wrote to memory of 560 4388 Setup.exe 83 PID 4388 wrote to memory of 560 4388 Setup.exe 83 PID 4388 wrote to memory of 936 4388 Setup.exe 82 PID 4388 wrote to memory of 936 4388 Setup.exe 82 PID 4388 wrote to memory of 936 4388 Setup.exe 82 PID 4388 wrote to memory of 860 4388 Setup.exe 81 PID 4388 wrote to memory of 860 4388 Setup.exe 81 PID 4388 wrote to memory of 860 4388 Setup.exe 81 PID 4388 wrote to memory of 452 4388 Setup.exe 80 PID 4388 wrote to memory of 452 4388 Setup.exe 80 PID 4388 wrote to memory of 452 4388 Setup.exe 80 PID 4388 wrote to memory of 1452 4388 Setup.exe 93 PID 4388 wrote to memory of 1452 4388 Setup.exe 93 PID 4388 wrote to memory of 1452 4388 Setup.exe 93 PID 4388 wrote to memory of 1776 4388 Setup.exe 91 PID 4388 wrote to memory of 1776 4388 Setup.exe 91 PID 4388 wrote to memory of 1776 4388 Setup.exe 91 PID 4388 wrote to memory of 1852 4388 Setup.exe 90 PID 4388 wrote to memory of 1852 4388 Setup.exe 90 PID 4388 wrote to memory of 1852 4388 Setup.exe 90 PID 4388 wrote to memory of 1872 4388 Setup.exe 89 PID 4388 wrote to memory of 1872 4388 Setup.exe 89 PID 4388 wrote to memory of 1872 4388 Setup.exe 89 PID 4388 wrote to memory of 2076 4388 Setup.exe 94 PID 4388 wrote to memory of 2076 4388 Setup.exe 94 PID 4388 wrote to memory of 2076 4388 Setup.exe 94 PID 4388 wrote to memory of 2152 4388 Setup.exe 95 PID 4388 wrote to memory of 2152 4388 Setup.exe 95 PID 4388 wrote to memory of 2152 4388 Setup.exe 95 PID 4388 wrote to memory of 2348 4388 Setup.exe 105 PID 4388 wrote to memory of 2348 4388 Setup.exe 105 PID 4388 wrote to memory of 2348 4388 Setup.exe 105 PID 4388 wrote to memory of 2396 4388 Setup.exe 104 PID 4388 wrote to memory of 2396 4388 Setup.exe 104 PID 4388 wrote to memory of 2396 4388 Setup.exe 104 PID 4388 wrote to memory of 1264 4388 Setup.exe 103 PID 4388 wrote to memory of 1264 4388 Setup.exe 103 PID 4388 wrote to memory of 1264 4388 Setup.exe 103 PID 4388 wrote to memory of 2472 4388 Setup.exe 102 PID 4388 wrote to memory of 2472 4388 Setup.exe 102 PID 4388 wrote to memory of 2472 4388 Setup.exe 102 PID 4388 wrote to memory of 2988 4388 Setup.exe 101 PID 4388 wrote to memory of 2988 4388 Setup.exe 101 PID 4388 wrote to memory of 2988 4388 Setup.exe 101 PID 4388 wrote to memory of 2092 4388 Setup.exe 100 PID 4388 wrote to memory of 2092 4388 Setup.exe 100 PID 4388 wrote to memory of 2092 4388 Setup.exe 100 PID 4388 wrote to memory of 4728 4388 Setup.exe 96 PID 4388 wrote to memory of 4728 4388 Setup.exe 96 PID 4388 wrote to memory of 3984 4388 Setup.exe 109 PID 4388 wrote to memory of 3984 4388 Setup.exe 109 PID 4388 wrote to memory of 3984 4388 Setup.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe"C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:452 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:3184
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:2272
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:5252
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:6124
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4060
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4692
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5700
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4156
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5984
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6568
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1176
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5704
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7288
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8044
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1168
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8688
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7560
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4616
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9124 -s 284⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:8016
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2024
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3992
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6468
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9992
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5588
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8600
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7056
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 284⤵
- Program crash
PID:5740
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4344
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3668
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Loads dropped DLL
PID:3008
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2392
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7360
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9440
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3448
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10624
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11024
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10400
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7884
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11148
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11256
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7768
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4116
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8380
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10612
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5868
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7800
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3476
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7332
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4768
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8676
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2764
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7576
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11240
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8224
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5968
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7808
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7916
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2848
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 284⤵
- Program crash
PID:10828
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6428
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10064
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10360
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10280
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5860
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1700
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6496
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2568
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10592
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6480
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9928
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7116
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7252
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8648
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8804
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2696
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 284⤵
- Program crash
PID:5420
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6996
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5644
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10256
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6872
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10800
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6300
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2692
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10932 -s 284⤵
- Program crash
PID:10828
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8744
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4816
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7872
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11184
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6096
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10336
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 284⤵
- Program crash
PID:4440
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2044
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3032
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6108
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6736
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 284⤵
- Program crash
PID:12708
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12544
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13172
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13040
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13140
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 284⤵
- Program crash
PID:1256
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10316
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13216
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12876
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13052
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2956
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12728
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8616
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7580
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13696
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14236
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13780
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13508
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14296
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14012
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11456
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11660
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13736
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14084
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12364
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9804
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12476
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6728
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5736
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8540
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12604
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4292
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14060
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12596
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11308
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12940
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11792
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1248
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12216
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11940
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11176
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12180
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3120
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2472
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2856
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9576
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11284
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14608
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:15084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15084 -s 284⤵
- Program crash
PID:14712
-
-
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14600
-
-
-
C:\Users\Admin\Documents\1HwuLZOI_ia2IDtVepwPgTM7.exe"C:\Users\Admin\Documents\1HwuLZOI_ia2IDtVepwPgTM7.exe"2⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 2803⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
-
C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"2⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe" ) do taskkill -F /Im "%~nXN"4⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG5⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )6⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"7⤵PID:3008
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p6⤵PID:1500
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "1OiXCcYBqCNSAzwk7Sl2UQKi.exe"5⤵
- Kills process with taskkill
PID:4404
-
-
-
-
-
C:\Users\Admin\Documents\3yVTDofbAXuNCSkNG6JIEdzA.exe"C:\Users\Admin\Documents\3yVTDofbAXuNCSkNG6JIEdzA.exe"2⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
-
C:\Users\Admin\Documents\s5LTZzJ14a7hoh1dzHlb0_JV.exe"C:\Users\Admin\Documents\s5LTZzJ14a7hoh1dzHlb0_JV.exe"2⤵
- Executes dropped EXE
PID:3196
-
-
C:\Users\Admin\Documents\KPIi6venqhklUEudwrH7yto5.exe"C:\Users\Admin\Documents\KPIi6venqhklUEudwrH7yto5.exe"2⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
-
C:\Users\Admin\Documents\Cz2mJKDOU6JIpIwSwjt1s13E.exe"C:\Users\Admin\Documents\Cz2mJKDOU6JIpIwSwjt1s13E.exe"2⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 2363⤵
- Program crash
PID:5988
-
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe"C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:856 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3648
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3368
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3592
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:5864
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:672
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:5416
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3860
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2096
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3844
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6044
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6272
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7060
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6720
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4648
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5988
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7364
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7684
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8964
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6108
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8168
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8856
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7496
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7968
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4416
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7828
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7440
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8256
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10104
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9756
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9768
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1776
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3680
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8980
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8860
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10148
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5936
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1280
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9764
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6964
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9044
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10768
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4560
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10892
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11244
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1948
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9828
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7492
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:9404
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9572
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9964
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10372
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10416
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6940
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9596
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10688
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8760
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10176
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8972
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7020
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5720
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9408
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9316
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1288
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5064
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5664
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7260
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8536
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:4060
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10744
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7324
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7624
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8308
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10452
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9112
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5876
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8284
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9708
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7700
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8468
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4236
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8588
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9472
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1516
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4240
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3456
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6112
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10620
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6244
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10752
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3988
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2104
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7848
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10684
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7868
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8644
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6100
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2604
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2292
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5076
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9132
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3716
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3392
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3000
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7516
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2472
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8468
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9308
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12884
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12552
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13288
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13252
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13232
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13272 -s 284⤵
- Program crash
PID:7644
-
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11768
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10812
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12684 -s 284⤵
- Program crash
PID:4408
-
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12752
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1256
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5164
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7960
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13868
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13392
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7792
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10032
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9200
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10816
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11672
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14060
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11656
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10356
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13368
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1372
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8696 -s 284⤵
- Program crash
PID:3120
-
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4244
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10384
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10640
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12556
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4664
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11872
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13484
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13928
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10428
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11468
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14260
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1188
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11552
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14284
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14168
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7328
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11468
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7184
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12116
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14104
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13388
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14536
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:15012
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14488
-
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14976
-
-
-
C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"2⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe" -u3⤵
- Executes dropped EXE
PID:4276
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe"C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1852 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:3500
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:1464
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:1072
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:5792
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:3996
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5944
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2004
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:256
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:776
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5064
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 284⤵
- Program crash
PID:6464
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5828
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3844
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5928
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8096
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7928
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8276
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8476 -s 284⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7356
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5260
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8436
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3932
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8912
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6664
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6924
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8116
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1500
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8780
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9888
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5100
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9296
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6252
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5516
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8480
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4220
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5716
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5400
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10056
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6360
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4452
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1252
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10264
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10716
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11228
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10560
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10992
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8352
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4872
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9104
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4544
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2488
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10700
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1244
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8448
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8220
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6796
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1960
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7512
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1936
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5708
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2596
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8752
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5576
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 284⤵
- Program crash
PID:10536
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3488
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7020
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4056
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6076
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5744
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1192
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1756
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9264
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7804
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10676
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4212
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8796
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6416
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6836
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 284⤵
- Program crash
PID:6104
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4856
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5964
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4608
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3792
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7972
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6840
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3272
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10824
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5772
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7244
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10856
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6912
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4624
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10680
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6888
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5176
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11152
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8476
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5772
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6256
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8484
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6284
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8532
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5820
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2860
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7492
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8312
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11000
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10408
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4336
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8460
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12756
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10368
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13156
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12980
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 284⤵
- Program crash
PID:2228
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12936
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13148
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12424
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8540
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13108
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7960
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 284⤵
- Program crash
PID:7792
-
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1272
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11064
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13724
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14264
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13836
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13464
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10356
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14132
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13612
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1148
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9760
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14272
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5924
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11928
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12400
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5644
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5392
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12788
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11572
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12252
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11840
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12508
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10016
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2200
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12452
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3436
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14060
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5280
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10024
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13652
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11668
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13376
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7644
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12112
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12428
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12072
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14748
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:15348
-
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14772
-
-
-
C:\Users\Admin\Documents\SbFnp3JBK5VZBGiEynEtSQEe.exe"C:\Users\Admin\Documents\SbFnp3JBK5VZBGiEynEtSQEe.exe"2⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 2403⤵
- Program crash
PID:3964
-
-
-
C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1452 -
C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"3⤵PID:8668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Sm9jDaF5Rn5LS3KcKxG2nzVR.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe" & del C:\ProgramData\*.dll & exit4⤵PID:7120
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Sm9jDaF5Rn5LS3KcKxG2nzVR.exe /f5⤵
- Kills process with taskkill
PID:8700
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
PID:11084
-
-
-
-
-
C:\Users\Admin\Documents\83rQNR7RSbxdY8xX2J7rAyEE.exe"C:\Users\Admin\Documents\83rQNR7RSbxdY8xX2J7rAyEE.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2076 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:2744
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:1048
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1408
-
-
-
C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe"C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Users\Admin\Documents\QU2OVBU5HGnIhS7hhd4pOPiv.exe"C:\Users\Admin\Documents\QU2OVBU5HGnIhS7hhd4pOPiv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728 -
C:\Users\Admin\AppData\Roaming\6820413.exe"C:\Users\Admin\AppData\Roaming\6820413.exe"3⤵PID:1176
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Suspicious behavior: SetClipboardViewer
PID:6392
-
-
-
C:\Users\Admin\AppData\Roaming\2580479.exe"C:\Users\Admin\AppData\Roaming\2580479.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Roaming\1167733.exe"C:\Users\Admin\AppData\Roaming\1167733.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5328
-
-
C:\Users\Admin\AppData\Roaming\2537226.exe"C:\Users\Admin\AppData\Roaming\2537226.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536
-
-
C:\Users\Admin\AppData\Roaming\8077170.exe"C:\Users\Admin\AppData\Roaming\8077170.exe"3⤵PID:5140
-
-
-
C:\Users\Admin\Documents\gQMDUFD63cpqvLTMYyNd2xM6.exe"C:\Users\Admin\Documents\gQMDUFD63cpqvLTMYyNd2xM6.exe"2⤵
- Executes dropped EXE
PID:2092
-
-
C:\Users\Admin\Documents\Mt5xso5G5tPeikFaMR0NRjyf.exe"C:\Users\Admin\Documents\Mt5xso5G5tPeikFaMR0NRjyf.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2988 -
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5368 -
C:\Users\Admin\Documents\KfHD6D3LBFWwrIST7mRQQkry.exe"C:\Users\Admin\Documents\KfHD6D3LBFWwrIST7mRQQkry.exe"4⤵PID:5560
-
C:\Users\Admin\AppData\Roaming\6565722.exe"C:\Users\Admin\AppData\Roaming\6565722.exe"5⤵PID:7472
-
-
C:\Users\Admin\AppData\Roaming\7620916.exe"C:\Users\Admin\AppData\Roaming\7620916.exe"5⤵
- Suspicious behavior: SetClipboardViewer
PID:7268
-
-
C:\Users\Admin\AppData\Roaming\1748141.exe"C:\Users\Admin\AppData\Roaming\1748141.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:6348 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6348 -s 23126⤵
- Program crash
PID:10416
-
-
-
C:\Users\Admin\AppData\Roaming\3084587.exe"C:\Users\Admin\AppData\Roaming\3084587.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:7780
-
-
C:\Users\Admin\AppData\Roaming\2562092.exe"C:\Users\Admin\AppData\Roaming\2562092.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:7704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 24446⤵
- Program crash
PID:10540
-
-
-
-
C:\Users\Admin\Documents\r8ZSgypTHmqCMQUO_Hacoo3q.exe"C:\Users\Admin\Documents\r8ZSgypTHmqCMQUO_Hacoo3q.exe"4⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 2765⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6156
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5496
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5432
-
-
-
C:\Users\Admin\Documents\V3b1g_uOXSquvDp3y3Jp932Y.exe"C:\Users\Admin\Documents\V3b1g_uOXSquvDp3y3Jp932Y.exe"2⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\Documents\EJ4nDdCHxLLkR1IVMy4D4SKF.exe"C:\Users\Admin\Documents\EJ4nDdCHxLLkR1IVMy4D4SKF.exe"2⤵
- Executes dropped EXE
PID:1264
-
-
C:\Users\Admin\Documents\xh0nODyBNlZlURB4Fb2VtkzP.exe"C:\Users\Admin\Documents\xh0nODyBNlZlURB4Fb2VtkzP.exe"2⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2923⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
-
-
C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe"C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe"C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3984
-
-
C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"2⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\is-H12JO.tmp\q7HLuKYNdF36DsVbkZjiBMQg.tmp"C:\Users\Admin\AppData\Local\Temp\is-H12JO.tmp\q7HLuKYNdF36DsVbkZjiBMQg.tmp" /SL5="$1029A,138429,56832,C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\is-RITFF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RITFF.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs75⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb98046f8,0x7ffcb9804708,0x7ffcb98047186⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:26⤵PID:6308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:86⤵PID:6528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:6516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:16⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:16⤵PID:5444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:16⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:16⤵PID:6856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:86⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
PID:8792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=216 /prefetch:26⤵PID:7104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:16⤵PID:8764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:16⤵PID:10212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:16⤵PID:10968
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5316 -
C:\Users\Admin\AppData\Roaming\6021749.exe"C:\Users\Admin\AppData\Roaming\6021749.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6656 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6656 -s 22967⤵
- Program crash
PID:9632
-
-
-
C:\Users\Admin\AppData\Roaming\4076929.exe"C:\Users\Admin\AppData\Roaming\4076929.exe"6⤵
- Suspicious behavior: SetClipboardViewer
PID:7160
-
-
C:\Users\Admin\AppData\Roaming\8571699.exe"C:\Users\Admin\AppData\Roaming\8571699.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:7336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 24527⤵
- Program crash
PID:7232
-
-
-
C:\Users\Admin\AppData\Roaming\1007247.exe"C:\Users\Admin\AppData\Roaming\1007247.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6364
-
-
C:\Users\Admin\AppData\Roaming\8972505.exe"C:\Users\Admin\AppData\Roaming\8972505.exe"6⤵PID:5464
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"6⤵PID:9212
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:2764
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵
- Executes dropped EXE
PID:5484 -
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6404
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵
- Executes dropped EXE
PID:4668
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\tmp9B95_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9B95_tmp.exe"6⤵
- Adds Run key to start application
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:7092
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:4592
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:9056
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:9404
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:9952
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:5848
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:9556
-
-
-
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:8004
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\is-OMQKA.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-OMQKA.tmp\stats.tmp" /SL5="$30318,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\is-1OMFC.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-1OMFC.tmp\Setup.exe" /Verysilent7⤵
- Suspicious behavior: EnumeratesProcesses
PID:6668 -
C:\Users\Admin\Documents\tqDpIYYNNMYoCL8uIbjApvoR.exe"C:\Users\Admin\Documents\tqDpIYYNNMYoCL8uIbjApvoR.exe"8⤵PID:6284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 2449⤵
- Program crash
PID:9828
-
-
-
C:\Users\Admin\Documents\x2ARhHhqm2nRHegZfup3BisP.exe"C:\Users\Admin\Documents\x2ARhHhqm2nRHegZfup3BisP.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:6408 -
C:\Users\Admin\AppData\Roaming\2514969.exe"C:\Users\Admin\AppData\Roaming\2514969.exe"9⤵PID:7116
-
-
C:\Users\Admin\AppData\Roaming\7924087.exe"C:\Users\Admin\AppData\Roaming\7924087.exe"9⤵PID:4020
-
-
C:\Users\Admin\AppData\Roaming\7836513.exe"C:\Users\Admin\AppData\Roaming\7836513.exe"9⤵PID:8896
-
-
C:\Users\Admin\AppData\Roaming\4093911.exe"C:\Users\Admin\AppData\Roaming\4093911.exe"9⤵PID:2940
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2940 -s 228810⤵
- Program crash
PID:7576
-
-
-
C:\Users\Admin\AppData\Roaming\2768738.exe"C:\Users\Admin\AppData\Roaming\2768738.exe"9⤵PID:9692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9692 -s 219210⤵
- Program crash
PID:11004
-
-
-
-
C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"8⤵PID:9044
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )9⤵PID:4624
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe" ) do taskkill -F /Im "%~nXN"10⤵PID:8388
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG11⤵PID:9608
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )12⤵PID:5564
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"13⤵PID:9832
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p12⤵PID:668
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "ydAtqGo2PDD9NDxBiYsJj2Mx.exe"11⤵
- Kills process with taskkill
PID:5220
-
-
-
-
-
C:\Users\Admin\Documents\HSyCeLswLtnKLr1JGGXchIA7.exe"C:\Users\Admin\Documents\HSyCeLswLtnKLr1JGGXchIA7.exe"8⤵PID:8872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8872 -s 2809⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8304
-
-
-
C:\Users\Admin\Documents\vFJ5zaOKgEWSsvuiKkXj8fs8.exe"C:\Users\Admin\Documents\vFJ5zaOKgEWSsvuiKkXj8fs8.exe"8⤵PID:8764
-
-
C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"8⤵PID:8564
-
C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe" -u9⤵PID:6068
-
-
-
C:\Users\Admin\Documents\sxtmhvOTqNIypL0STL1xIRca.exe"C:\Users\Admin\Documents\sxtmhvOTqNIypL0STL1xIRca.exe"8⤵PID:8548
-
-
C:\Users\Admin\Documents\jnw5PVddGjTO1yegLOoJ3Q8E.exe"C:\Users\Admin\Documents\jnw5PVddGjTO1yegLOoJ3Q8E.exe"8⤵PID:8540
-
C:\Users\Admin\AppData\Roaming\3736358.exe"C:\Users\Admin\AppData\Roaming\3736358.exe"9⤵PID:9208
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 9208 -s 227610⤵
- Program crash
PID:5576
-
-
-
C:\Users\Admin\AppData\Roaming\4050658.exe"C:\Users\Admin\AppData\Roaming\4050658.exe"9⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:716
-
-
C:\Users\Admin\AppData\Roaming\1067481.exe"C:\Users\Admin\AppData\Roaming\1067481.exe"9⤵PID:9308
-
-
C:\Users\Admin\AppData\Roaming\2472343.exe"C:\Users\Admin\AppData\Roaming\2472343.exe"9⤵PID:10168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 150410⤵
- Program crash
PID:6436
-
-
-
C:\Users\Admin\AppData\Roaming\1180844.exe"C:\Users\Admin\AppData\Roaming\1180844.exe"9⤵PID:9980
-
-
-
C:\Users\Admin\Documents\pSz9cMYbBWKKlcYxPIQ9ZUGa.exe"C:\Users\Admin\Documents\pSz9cMYbBWKKlcYxPIQ9ZUGa.exe"8⤵PID:8504
-
-
C:\Users\Admin\Documents\ipEAPRT0zTvfXX_Xlr21VYec.exe"C:\Users\Admin\Documents\ipEAPRT0zTvfXX_Xlr21VYec.exe"8⤵PID:8384
-
-
C:\Users\Admin\Documents\fPH64L081kvPrhdQP_rmx0N0.exe"C:\Users\Admin\Documents\fPH64L081kvPrhdQP_rmx0N0.exe"8⤵PID:8340
-
-
C:\Users\Admin\Documents\ql_KNI31XxIlq1zxg9cGzU8I.exe"C:\Users\Admin\Documents\ql_KNI31XxIlq1zxg9cGzU8I.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3660
-
-
C:\Users\Admin\Documents\IUTPOg9NO_UN3c_h05nFa9Ut.exe"C:\Users\Admin\Documents\IUTPOg9NO_UN3c_h05nFa9Ut.exe"8⤵PID:6840
-
-
C:\Users\Admin\Documents\b_sIp1i9t84MS7P5nKEJxyEy.exe"C:\Users\Admin\Documents\b_sIp1i9t84MS7P5nKEJxyEy.exe"8⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 2809⤵
- Program crash
PID:716
-
-
-
C:\Users\Admin\Documents\xjikSqBs9p71niqBEOVxN0cY.exe"C:\Users\Admin\Documents\xjikSqBs9p71niqBEOVxN0cY.exe"8⤵
- Drops file in Program Files directory
PID:2996
-
-
C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"8⤵PID:3764
-
C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"9⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im AaYvd2_to8oBWRCXQKJE1FhH.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe" & del C:\ProgramData\*.dll & exit10⤵PID:5128
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im AaYvd2_to8oBWRCXQKJE1FhH.exe /f11⤵
- Kills process with taskkill
PID:9840
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
PID:10556
-
-
-
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe"C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe"8⤵
- Suspicious use of SetThreadContext
PID:7688 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2192
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6384
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7352
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:936
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9584
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6464
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6960
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3380
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8356
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8516
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8616
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9108
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8832
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4072
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8380
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10696
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11040
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9468
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10520
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11056
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5824
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11104
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4156
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2476
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10824
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7148
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7512
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5184
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1444
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5460
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9496
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6660
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10332
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7536
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10992
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:252
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6620
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9292
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8572
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10108
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9484
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9692
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10248
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9364
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6660
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8596
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2832
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7320
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10652
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6904
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4216
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9856
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5412
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8228
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9316
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:764
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10296
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1584
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4016
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10472
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8156
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9720
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10556
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5488
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5832
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7868
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8196
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11252
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10824
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10348
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10440
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4252
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7008
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8672
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7760
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10932
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4992
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3740
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7104
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9332
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8548
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2304
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12628
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13224
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9952
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12512 -s 2810⤵
- Program crash
PID:9840
-
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2060
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2720
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6876
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5292
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1484
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6096
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3264
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:816
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1372
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5600
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13432
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13920
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13500
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14144
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13772
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13064
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14248
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9724
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6992
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13968
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4244
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13944
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12868
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12840
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7932
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9976
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11876
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2404
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10868
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13340
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2500
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11276
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12696
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7640
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13204
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11832
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11916
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2540
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12164
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4788
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13640 -s 2810⤵
- Program crash
PID:11512
-
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5280
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14056
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5808
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14448
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14936
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14392
-
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14920
-
-
-
C:\Users\Admin\Documents\OyVo7K7KS6oTIcsGWS69NcJE.exe"C:\Users\Admin\Documents\OyVo7K7KS6oTIcsGWS69NcJE.exe"8⤵PID:6464
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:8876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:4532
-
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"9⤵PID:5888
-
C:\Users\Admin\Documents\0OzKzw6X1yYuvEgLz0FVhc2h.exe"C:\Users\Admin\Documents\0OzKzw6X1yYuvEgLz0FVhc2h.exe"10⤵PID:2472
-
C:\Users\Admin\AppData\Roaming\5880565.exe"C:\Users\Admin\AppData\Roaming\5880565.exe"11⤵PID:1940
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1940 -s 230812⤵
- Program crash
PID:10480
-
-
-
C:\Users\Admin\AppData\Roaming\4730539.exe"C:\Users\Admin\AppData\Roaming\4730539.exe"11⤵PID:9036
-
-
C:\Users\Admin\AppData\Roaming\6911664.exe"C:\Users\Admin\AppData\Roaming\6911664.exe"11⤵PID:10136
-
-
C:\Users\Admin\AppData\Roaming\1677693.exe"C:\Users\Admin\AppData\Roaming\1677693.exe"11⤵PID:10408
-
-
C:\Users\Admin\AppData\Roaming\1713062.exe"C:\Users\Admin\AppData\Roaming\1713062.exe"11⤵PID:10864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10864 -s 214012⤵
- Program crash
PID:5772
-
-
-
-
C:\Users\Admin\Documents\1ilDxDVZDYSPxzk74ziJDSOK.exe"C:\Users\Admin\Documents\1ilDxDVZDYSPxzk74ziJDSOK.exe"10⤵PID:9916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9916 -s 28011⤵
- Program crash
PID:3488
-
-
-
-
-
C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"8⤵PID:6540
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe"C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe"8⤵
- Suspicious use of SetThreadContext
PID:5020 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4284
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:2036
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8408
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9212
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10068
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9676
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4232
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10052
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10204
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8840
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4224
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8120 -s 2810⤵
- Program crash
PID:5212
-
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9204
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10136
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7992
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8952
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10592
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11012
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10524
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9988
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11052
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10160
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10988
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4036
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8720
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3488
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10860
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3708
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9528
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5748
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1500
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11192
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5720
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3236
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10644
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5748
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8496
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9140
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3388
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1484
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Suspicious use of FindShellTrayWindow
PID:1204
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6816
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6040
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8924
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6280
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10928
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:720
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7176
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7392
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3312
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3692
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5228
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6988
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5392
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1188
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7752
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5300
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7456
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6812
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11184
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10128
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5800
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8576
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8816
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8704
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7156
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:2432
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7604
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8216
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5076
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11036
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 2810⤵
- Program crash
PID:6092
-
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10276
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9024
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8128
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4908
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7776
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8388
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8932
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9548
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10252
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5296
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10368
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12444
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13068
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12868
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7584
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12816
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8920
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9028
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1912
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12852
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13104
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5220
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1496
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13324
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13816
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12804
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14004
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13528
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8900
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11684
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13592
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9336
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13416
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11744
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5848
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:456
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13384
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13900
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1576
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4800
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 2810⤵
- Program crash
PID:12612
-
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12392
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4092
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10308
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14092
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11740
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11096
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11268
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11280
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12008
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11760
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12404
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12236
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11312
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13628
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12580
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13380
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12076
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14816 -s 2810⤵
- Program crash
PID:14636
-
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14376
-
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14812
-
-
-
C:\Users\Admin\Documents\muQDxtj0UnsrCA4kiLdFmQ0g.exe"C:\Users\Admin\Documents\muQDxtj0UnsrCA4kiLdFmQ0g.exe"8⤵PID:7768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 2809⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2196
-
-
-
C:\Users\Admin\Documents\QpFVc4qDEA83KyNYARuSDzUK.exe"C:\Users\Admin\Documents\QpFVc4qDEA83KyNYARuSDzUK.exe"8⤵PID:5876
-
-
C:\Users\Admin\Documents\DHyHhOpD7alzwhQZKQkqoEjJ.exe"C:\Users\Admin\Documents\DHyHhOpD7alzwhQZKQkqoEjJ.exe"8⤵PID:6864
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\un9LQrwOV2iHPurv5fMmo2bD.exe"C:\Users\Admin\Documents\un9LQrwOV2iHPurv5fMmo2bD.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936 -
C:\Users\Admin\AppData\Roaming\4849177.exe"C:\Users\Admin\AppData\Roaming\4849177.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6024
-
-
C:\Users\Admin\AppData\Roaming\3741778.exe"C:\Users\Admin\AppData\Roaming\3741778.exe"3⤵
- Executes dropped EXE
PID:5244
-
-
C:\Users\Admin\AppData\Roaming\2293663.exe"C:\Users\Admin\AppData\Roaming\2293663.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Users\Admin\AppData\Roaming\1822748.exe"C:\Users\Admin\AppData\Roaming\1822748.exe"3⤵PID:984
-
-
C:\Users\Admin\AppData\Roaming\4309220.exe"C:\Users\Admin\AppData\Roaming\4309220.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 22404⤵
- Program crash
PID:10208
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.21⤵
- Modifies data under HKEY_USERS
PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3204 -ip 32041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1264 -ip 12641⤵PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 860 -ip 8601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2396 -ip 23961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 560 -ip 5601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2092 -ip 20921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2472 -ip 24721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1776 -ip 17761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 864 -ip 8641⤵PID:5772
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3008 -ip 30081⤵PID:4212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3788 -ip 37881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6824 -ip 68241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6728
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:7824 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:7952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:7348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7952 -ip 79521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7408
-
C:\Users\Admin\AppData\Local\Temp\is-VAS7O.tmp\52jBl1MYthE5TY0QSvLnq2OG.tmp"C:\Users\Admin\AppData\Local\Temp\is-VAS7O.tmp\52jBl1MYthE5TY0QSvLnq2OG.tmp" /SL5="$10426,138429,56832,C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"1⤵PID:8640
-
C:\Users\Admin\AppData\Local\Temp\is-EHD4E.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-EHD4E.tmp\Setup.exe" /Verysilent2⤵PID:9552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 8476 -ip 84761⤵PID:8600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7768 -ip 77681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1420 -ip 14201⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8548 -ip 85481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 8872 -ip 88721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2916
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 732 -p 3496 -ip 34961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8384 -ip 83841⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6840 -ip 68401⤵PID:8016
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 736 -p 6024 -ip 60241⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5536 -ip 55361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 9124 -ip 91241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6864 -ip 68641⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2012 -ip 20121⤵PID:2200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6284 -ip 62841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 8504 -ip 85041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 10068 -ip 100681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9416
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 4563⤵
- Program crash
PID:9884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5092 -ip 50921⤵PID:10072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1244 -ip 12441⤵PID:6508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 9916 -ip 99161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8616 -ip 86161⤵PID:8700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8120 -ip 81201⤵PID:6824
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 6348 -ip 63481⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:8640
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 720 -p 6656 -ip 66561⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7704 -ip 77041⤵PID:5136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7336 -ip 73361⤵PID:8240
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 828 -p 2940 -ip 29401⤵PID:5820
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 664 -p 9208 -ip 92081⤵PID:7676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 9692 -ip 96921⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 10168 -ip 101681⤵PID:4992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4768 -ip 47681⤵PID:3780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 840 -p 1940 -ip 19401⤵PID:6552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8580 -ip 85801⤵PID:9472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 10864 -ip 108641⤵PID:7104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4216 -ip 42161⤵PID:10340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5800 -ip 58001⤵PID:2700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7424 -ip 74241⤵PID:3144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 10932 -ip 109321⤵PID:10600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 7244 -ip 72441⤵PID:1568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2912 -ip 29121⤵PID:10028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6296 -ip 62961⤵PID:12496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 12512 -ip 125121⤵PID:12712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1352 -ip 13521⤵PID:6296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2272 -ip 22721⤵PID:13128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 13272 -ip 132721⤵PID:2720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 12684 -ip 126841⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 8140 -ip 81401⤵PID:8908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 8696 -ip 86961⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5756 -ip 57561⤵PID:12596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 13640 -ip 136401⤵PID:14104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 14816 -ip 148161⤵PID:14380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 15084 -ip 150841⤵PID:14588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 14392 -ip 143921⤵PID:11512
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1