ramnit | 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

Analysis

max time kernel
80s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
Size

469KB
MD5

709802f0cfb676e53115189b5cd91cfc
SHA1

97027efdd9473b5f431179bc9b7ced86126cc625
SHA256

3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
SHA512

2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 64 IoCs

Processes:

3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exewoyooo.exeDesktopLayer.exewoyoooSrv.exeDesktopLayer.exehrlC1FE.tmphrlC1FESrv.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeiexplore.exehrlEEEA.tmphrlEEEASrv.exesvchost.exewoyooo.exewoyoooSrv.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeDesktopLayer.exehrlFC28.tmphrlFC28Srv.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeDesktopLayer.exewoyooo.exehrl6F6Srv.exewoyooo.exewoyoooSrv.exewoyoooSrv.exeDesktopLayer.exehrlCD2.tmphrlCD2Srv.exeDesktopLayer.exeDesktopLayer.exehrl134A.tmpDesktopLayer.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeDesktopLayer.exehrl1965.tmpwoyooo.exehrl1965Srv.exewoyoooSrv.exeDesktopLayer.exeiexplore.exehrl1DF9Srv.exeDesktopLayer.exewoyooo.exewoyoooSrv.exeDesktopLayer.exehrl22BB.tmphrl22BBSrv.exeDesktopLayer.exeDesktopLayer.exewoyoooSrv.exeDesktopLayer.exe

pid	process
3696	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
5080	woyooo.exe
5084	DesktopLayer.exe
1360	woyoooSrv.exe
2660	DesktopLayer.exe
2820	hrlC1FE.tmp
3976	hrlC1FESrv.exe
4176	DesktopLayer.exe
4216	woyooo.exe
3756	woyoooSrv.exe
2820	DesktopLayer.exe
4740	woyooo.exe
3988	woyoooSrv.exe
1356	iexplore.exe
3720	hrlEEEA.tmp
1260	hrlEEEASrv.exe
1276	svchost.exe
5240	woyooo.exe
5260	woyoooSrv.exe
5292	DesktopLayer.exe
5424	woyooo.exe
5444	woyoooSrv.exe
5476	DesktopLayer.exe
5588	hrlFC28.tmp
5620	hrlFC28Srv.exe
5648	DesktopLayer.exe
5852	woyooo.exe
5868	woyoooSrv.exe
5892	DesktopLayer.exe
6056	woyooo.exe
6080	hrl6F6Srv.exe
6112	woyooo.exe
6136	woyoooSrv.exe
5140	woyoooSrv.exe
5244	DesktopLayer.exe
5648	hrlCD2.tmp
5700	hrlCD2Srv.exe
5576	DesktopLayer.exe
6056	woyooo.exe
5140	woyoooSrv.exe
3936	DesktopLayer.exe
5492	hrl134A.tmp
5424	DesktopLayer.exe
5580	DesktopLayer.exe
4492	woyooo.exe
5048	woyoooSrv.exe
5292	DesktopLayer.exe
2940	hrl1965.tmp
1644	woyooo.exe
5268	hrl1965Srv.exe
4340	woyoooSrv.exe
4944	DesktopLayer.exe
3704	iexplore.exe
5892	hrl1DF9Srv.exe
4016	DesktopLayer.exe
1800	woyooo.exe
1100	woyoooSrv.exe
1032	DesktopLayer.exe
4892	hrl22BB.tmp
4864	hrl22BBSrv.exe
5212	DesktopLayer.exe
5456	DesktopLayer.exe
1392	woyoooSrv.exe
4408	DesktopLayer.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe	upx
behavioral2/memory/3696-139-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/5084-142-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/1360-147-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Windows\Temp\hrlC1FESrv.exe	upx
C:\Windows\TEMP\hrlC1FESrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/3976-160-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\Temp\hrlEEEASrv.exe	upx
C:\Windows\TEMP\hrlEEEASrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/1260-220-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Windows\woyoooSrv.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Windows\woyoooSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/5620-247-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/6080-259-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5700-268-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5424-278-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4340-289-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5268-288-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5892-295-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4864-303-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3696-306-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/1252-311-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/2084-314-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5164-318-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3172-320-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 56 IoCs

Processes:

woyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exeDesktopLayer.exewoyooo.exewoyooo.exewoyooo.exeiexplore.exewoyooo.exeiexplore.exewoyooo.exewoyooo.exewoyooo.exeiexplore.exewoyooo.exehrlBBCF.tmpwoyooo.exewoyooo.exewoyooo.exewoyooo.exeDesktopLayer.exewoyooo.exeIEXPLORE.EXEwoyooo.exewoyoooSrv.exeiexplore.exeDesktopLayer.exehrl3A17.tmpwoyooo.exewoyooo.exehrl5BC8Srv.exehrl53E8.tmpwoyoooSrv.exewoyooo.exewoyoooSrv.exewoyooo.exeiexplore.exewoyooo.exehrl86D0.tmpiexplore.exewoyooo.exewoyooo.exehrlE705Srv.exewoyooo.exewoyooo.exeiexplore.exeiexplore.exewoyooo.exe

pid	process
5080	woyooo.exe
4216	woyooo.exe
4740	woyooo.exe
5240	woyooo.exe
5424	woyooo.exe
5852	woyooo.exe
6112	woyooo.exe
6056	woyooo.exe
4492	woyooo.exe
1644	woyooo.exe
1800	woyooo.exe
5456	DesktopLayer.exe
4908	woyooo.exe
3492	woyooo.exe
6068	woyooo.exe
4872	iexplore.exe
3568	woyooo.exe
4492	iexplore.exe
4312	woyooo.exe
3784	woyooo.exe
1992	woyooo.exe
4092	iexplore.exe
820	woyooo.exe
5400	hrlBBCF.tmp
4484	woyooo.exe
6104	woyooo.exe
2960	woyooo.exe
2320	woyooo.exe
4636	DesktopLayer.exe
3656	woyooo.exe
1952	IEXPLORE.EXE
5828	woyooo.exe
4748	woyoooSrv.exe
176	iexplore.exe
5028	DesktopLayer.exe
5872	hrl3A17.tmp
5732	woyooo.exe
3732	woyooo.exe
2376	hrl5BC8Srv.exe
1924	hrl53E8.tmp
5648	woyoooSrv.exe
4848	woyooo.exe
4188	woyoooSrv.exe
5112	woyooo.exe
1940	iexplore.exe
5164	woyooo.exe
3136	hrl86D0.tmp
5812	iexplore.exe
3564	woyooo.exe
4884	woyooo.exe
2032	hrlE705Srv.exe
5508	woyooo.exe
5928	woyooo.exe
4760	iexplore.exe
4952	iexplore.exe
5380	woyooo.exe

Checks whether UAC is enabled 1 TTPs 32 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

hrlF9C.tmpDesktopLayer.exewoyooo.exehrl4AB6Srv.exewoyooo.exeDesktopLayer.exehrl2602Srv.exewoyooo.exewoyoooSrv.exehrl4AB6.tmpwoyoooSrv.exeDesktopLayer.exeDesktopLayer.exehrlC506.tmpwoyooo.exeDesktopLayer.exeDesktopLayer.exehrl73C9.tmphrl8CDFSrv.exewoyoooSrv.exewoyooo.exeDesktopLayer.exehrlC12E.tmpwoyooo.exehrl90D2.tmpwoyoooSrv.exeDesktopLayer.exeDesktopLayer.exewoyooo.exewoyooo.exewoyoooSrv.exeDesktopLayer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrlF9C.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl4AB6Srv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl2602Srv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyoooSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl4AB6.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyoooSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrlC506.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl73C9.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl8CDFSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyoooSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrlC12E.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrl90D2.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyoooSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyooo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	woyoooSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DesktopLayer.exe

Program crash 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4472	3200	WerFault.exe	IEXPLORE.EXE
5908	3200	WerFault.exe	IEXPLORE.EXE
4072	3200	WerFault.exe	IEXPLORE.EXE
1256	4440	WerFault.exe	iexplore.exe
2084	4440	WerFault.exe	iexplore.exe
3752	4440	WerFault.exe	iexplore.exe
5456	1820	WerFault.exe	iexplore.exe
4636	1820	WerFault.exe	iexplore.exe
5268	1952	WerFault.exe	IEXPLORE.EXE
3092	1660	WerFault.exe	iexplore.exe
5996	3224	WerFault.exe	IEXPLORE.EXE
1288	4684	WerFault.exe	iexplore.exe
1928	4684	WerFault.exe	iexplore.exe
6128	4896	WerFault.exe	iexplore.exe
2820	1764	WerFault.exe	iexplore.exe

Drops file in System32 directory 64 IoCs

Processes:

msedge.exeiexplore.exeiexplore.exeIEXPLORE.EXEwoyooo.exeiexplore.exeDesktopLayer.exewoyooo.exeiexplore.exeDesktopLayer.exewoyooo.exewoyooo.exeiexplore.exewoyoooSrv.exeiexplore.exeiexplore.exewoyooo.exemsedge.exewoyooo.exewoyooo.exeiexplore.exeDesktopLayer.exeiexplore.exewoyooo.exehrl3A17.tmp

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\443d0c3a-a033-4566-ba4d-88fda15e0a4c.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B6791097-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D77AC80B-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CCB447CE-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d61d4d04-568f-46fe-b0e2-48b2a88ef793.tmp	msedge.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	woyooo.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CCBDCF82-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	DesktopLayer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D77AC81D-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DD77CDF9-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d61d4d04-568f-46fe-b0e2-48b2a88ef793.tmp	msedge.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	DesktopLayer.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D77AC82D-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe571220.TMP	woyoooSrv.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\e0b31f92-a846-4c22-afb8-49d02d1c3666.tmp	woyoooSrv.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CCBDCF9C-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B6791097-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\0ac06b50-adff-4f65-97a3-6ce03ed44d2a.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D2D51155-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\7f88bdca-1d3d-4829-aa5a-c9327943540b.tmp	woyoooSrv.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D2D5114C-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe
File created	C:\Windows\SysWOW64\hra8.dll	woyooo.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CCB447CE-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CCBDCF93-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index	msedge.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	DesktopLayer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D2D51145-FA97-11EC-AD90-6A1EA45F0745}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2	msedge.exe
File opened for modification	C:\Windows\SysWOW64\hra864.dll	woyooo.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data	msedge.exe
File opened for modification	C:\Windows\SysWOW64\hra8.dll	hrl3A17.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\978794d7-4bb9-49aa-9e1c-a22760b2d824.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe

Drops file in Program Files directory 64 IoCs

Processes:

hrl2BF3Srv.exewoyoooSrv.exehrl73C9Srv.exewoyoooSrv.exewoyoooSrv.exehrl8CDF.tmpwoyoooSrv.exehrl2A67.tmpwoyooo.exehrlD765Srv.exehrl9FFASrv.exewoyoooSrv.exeDesktopLayer.exeiexplore.exesetup.exewoyoooSrv.exehrl1965Srv.exewoyoooSrv.exeDesktopLayer.exehrlDC38Srv.exehrlC1FESrv.exehrl53EDSrv.exeDesktopLayer.exehrl22BBSrv.exewoyoooSrv.exehrl615BSrv.exewoyoooSrv.exewoyoooSrv.exewoyoooSrv.exewoyoooSrv.exehrl327BSrv.exeDesktopLayer.exewoyoooSrv.exehrlC12ESrv.exewoyooo.exehrlBF3Srv.exeDesktopLayer.exewoyooo.exehrlBBCFSrv.exehrl7FA1Srv.exeDesktopLayer.exehrl42B7Srv.exewoyooo.exeiexplore.exewoyoooSrv.exeiexplore.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exehrl94EESrv.exewoyoooSrv.exewoyoooSrv.exewoyoooSrv.exehrl9125Srv.exehrl6F6Srv.exeWerFault.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px2C6F.tmp	hrl2BF3Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5B01.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl73C9Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl8CDF.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\px6793.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl2A67.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\pxD522.tmp	woyooo.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrlD765Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl9FFASrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxEB30.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px62C1.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	iexplore.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a7295080-96b3-4c95-9a94-6fa165b9d689.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px10F8.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl1965Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrlDC38Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxC2B8.tmp	hrlC1FESrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl53EDSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl22BBSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl615BSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBF3E.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrlC1FESrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px926C.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px9A9A.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px350A.tmp	hrl327BSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxA057.tmp	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxA671.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrlC12ESrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxC97A.tmp	woyooo.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8925.tmp	hrlBF3Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxA21C.tmp	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyooo.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrlBBCFSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px7FDE.tmp	hrl7FA1Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	hrl42B7Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyooo.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	woyooo.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px7CA2.tmp	iexplore.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD0FC.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	iexplore.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px953B.tmp	hrl94EESrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxCAC2.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE803.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220703061705.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px79B4.tmp	woyoooSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px91A1.tmp	hrl9125Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8AB.tmp	hrl6F6Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	WerFault.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB42D.tmp	woyooo.exe

Drops file in Windows directory 59 IoCs

Processes:

hrlE705Srv.exewoyooo.exewoyooo.exewoyooo.exeiexplore.exeiexplore.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exewoyooo.exewoyooo.exewoyooo.exehrl86D0.tmpwoyooo.exewoyooo.exewoyoooSrv.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exehrl53E8.tmpwoyooo.exeDesktopLayer.exewoyoooSrv.exeiexplore.exeiexplore.exehrl3A17.tmpiexplore.exewoyooo.exeIEXPLORE.EXEwoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exeiexplore.exeiexplore.exewoyoooSrv.exewoyooo.exewoyooo.exehrlBBCF.tmpwoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exeDesktopLayer.exewoyooo.exewoyooo.exewoyooo.exewoyooo.exeDesktopLayer.exeIEXPLORE.EXEiexplore.exehrlF9C.tmp

description	ioc	process
File opened for modification	C:\Windows\woyoooSrv.exe	hrlE705Srv.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyooo.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File created	C:\Windows\woyooo.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
File created	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	hrl86D0.tmp
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyoooSrv.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	hrl53E8.tmp
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	DesktopLayer.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyoooSrv.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	hrl3A17.tmp
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	IEXPLORE.EXE
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyoooSrv.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	hrlBBCF.tmp
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	DesktopLayer.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	woyooo.exe
File opened for modification	C:\Windows\woyoooSrv.exe	DesktopLayer.exe
File opened for modification	C:\Windows\woyoooSrv.exe	IEXPLORE.EXE
File opened for modification	C:\Windows\woyoooSrv.exe	iexplore.exe
File opened for modification	C:\Windows\woyoooSrv.exe	hrlF9C.tmp

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

woyooo.exewoyooo.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	woyooo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	woyooo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	woyooo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	woyooo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2331054333"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2345116706"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30969508"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B6744902-FA97-11EC-AD90-6A1EA45F0745} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30969508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2331054333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363593980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30969508"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exemsedge.exeiexplore.exeIEXPLORE.EXEwoyooo.exesetup.exeiexplore.exeIEXPLORE.EXEwoyooo.exeWerFault.exehrlC506.tmpDesktopLayer.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeie_to_edge_stub.exewoyooo.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEDesktopLayer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Time = e607070000000300060011001b007b01	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "83"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Time = e607070000000300060011003300a200	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\version = "92.0.902.67"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e607070000000300060011000500e801	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	woyooo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mht = "0"	setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 000000001200000000000000010000001200000002000000010000000c0000000200000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "60"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "72"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\LoadTimeArray = 050000000c0000000600000005000000050000000500000004000000050000000600000006000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	woyooo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	WerFault.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 0600000000000000010000001300000001000000010000001400000000000000000000000e000000	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 01000000070000000000000000000000090000000100000001000000010000000500000008000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\MUID\	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "10"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 070000000e000000000000000900000000000000040000000100000005000000010000000a000000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	hrlC506.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	DesktopLayer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "6"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 01000000130000000100000001000000000000002600000001000000010000000600000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ie_to_edge_stub.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e6070700000003000600110011001103	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 130000000a0000000900000000000000010000000000000029000000090000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	woyooo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\LoadTimeArray = 050000000c00000009000000110000000f00000006000000ffffffffffffffffffffffffffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Time = e6070700000003000600110023009a01	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "47"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "84"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e6070700000003000600110038009e03	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\kmendfapggjehodndflmmgagdbamhnfd = "413C52CC48BD0B93FF87E9AC6AE9629F2BE1E612A8BBCC34F9770A9847C1CE90"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	DesktopLayer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "1836509DB7F6C25812C5DC712834502F679959A1F3E77B7A84869FB4616B21C1"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9_.htm = "0"	setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\LoadTimeArray = 04000000040000000500000008000000050000000c00000005000000060000000500000007000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DesktopLayer.exeDesktopLayer.exeDesktopLayer.exemsedge.exemsedge.exeDesktopLayer.exeiexplore.exesvchost.exeDesktopLayer.exeDesktopLayer.exe

pid	process
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
5084	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
2660	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
4176	DesktopLayer.exe
1100	msedge.exe
1100	msedge.exe
4928	msedge.exe
4928	msedge.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1356	iexplore.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
1276	svchost.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5292	DesktopLayer.exe
5476	DesktopLayer.exe
5476	DesktopLayer.exe
5476	DesktopLayer.exe
5476	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

4564 iexplore.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe

pid process

5060 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe

pid	process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

pid	process
5060	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exeiexplore.exe

pid	process
4564	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
4564	iexplore.exe
4564	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4440	iexplore.exe
4240	IEXPLORE.EXE
4240	IEXPLORE.EXE
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE
3852	IEXPLORE.EXE
3852	IEXPLORE.EXE
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
816	IEXPLORE.EXE
816	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
3184	IEXPLORE.EXE
3184	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
3852	IEXPLORE.EXE
3852	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5352	IEXPLORE.EXE
5352	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
816	IEXPLORE.EXE
816	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5724	IEXPLORE.EXE
5724	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
3184	IEXPLORE.EXE
3184	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
4480	IEXPLORE.EXE
4480	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5352	IEXPLORE.EXE
5352	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5940	IEXPLORE.EXE
5940	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5724	IEXPLORE.EXE
5724	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe
5972	IEXPLORE.EXE
5972	IEXPLORE.EXE
4440	iexplore.exe
4440	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exewoyooo.exeDesktopLayer.exewoyoooSrv.exeDesktopLayer.exeiexplore.exeiexplore.exehrlC1FE.tmphrlC1FESrv.exeDesktopLayer.exeIEXPLORE.EXEie_to_edge_stub.exemsedge.exe

description	pid	process	target process
PID 5060 wrote to memory of 3696	5060	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
PID 5060 wrote to memory of 3696	5060	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
PID 5060 wrote to memory of 3696	5060	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
PID 3696 wrote to memory of 5084	3696	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe	DesktopLayer.exe
PID 3696 wrote to memory of 5084	3696	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe	DesktopLayer.exe
PID 3696 wrote to memory of 5084	3696	3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe	DesktopLayer.exe
PID 5080 wrote to memory of 1360	5080	woyooo.exe	woyoooSrv.exe
PID 5080 wrote to memory of 1360	5080	woyooo.exe	woyoooSrv.exe
PID 5080 wrote to memory of 1360	5080	woyooo.exe	woyoooSrv.exe
PID 5084 wrote to memory of 4564	5084	DesktopLayer.exe	iexplore.exe
PID 5084 wrote to memory of 4564	5084	DesktopLayer.exe	iexplore.exe
PID 1360 wrote to memory of 2660	1360	woyoooSrv.exe	DesktopLayer.exe
PID 1360 wrote to memory of 2660	1360	woyoooSrv.exe	DesktopLayer.exe
PID 1360 wrote to memory of 2660	1360	woyoooSrv.exe	DesktopLayer.exe
PID 2660 wrote to memory of 4440	2660	DesktopLayer.exe	iexplore.exe
PID 2660 wrote to memory of 4440	2660	DesktopLayer.exe	iexplore.exe
PID 4564 wrote to memory of 4228	4564	iexplore.exe	IEXPLORE.EXE
PID 4564 wrote to memory of 4228	4564	iexplore.exe	IEXPLORE.EXE
PID 4564 wrote to memory of 4228	4564	iexplore.exe	IEXPLORE.EXE
PID 4440 wrote to memory of 4240	4440	iexplore.exe	IEXPLORE.EXE
PID 4440 wrote to memory of 4240	4440	iexplore.exe	IEXPLORE.EXE
PID 4440 wrote to memory of 4240	4440	iexplore.exe	IEXPLORE.EXE
PID 5080 wrote to memory of 2820	5080	woyooo.exe	hrlC1FE.tmp
PID 5080 wrote to memory of 2820	5080	woyooo.exe	hrlC1FE.tmp
PID 5080 wrote to memory of 2820	5080	woyooo.exe	hrlC1FE.tmp
PID 2820 wrote to memory of 3976	2820	hrlC1FE.tmp	hrlC1FESrv.exe
PID 2820 wrote to memory of 3976	2820	hrlC1FE.tmp	hrlC1FESrv.exe
PID 2820 wrote to memory of 3976	2820	hrlC1FE.tmp	hrlC1FESrv.exe
PID 3976 wrote to memory of 4176	3976	hrlC1FESrv.exe	DesktopLayer.exe
PID 3976 wrote to memory of 4176	3976	hrlC1FESrv.exe	DesktopLayer.exe
PID 3976 wrote to memory of 4176	3976	hrlC1FESrv.exe	DesktopLayer.exe
PID 4176 wrote to memory of 2032	4176	DesktopLayer.exe	iexplore.exe
PID 4176 wrote to memory of 2032	4176	DesktopLayer.exe	iexplore.exe
PID 4440 wrote to memory of 3852	4440	iexplore.exe	IEXPLORE.EXE
PID 4440 wrote to memory of 3852	4440	iexplore.exe	IEXPLORE.EXE
PID 4440 wrote to memory of 3852	4440	iexplore.exe	IEXPLORE.EXE
PID 4240 wrote to memory of 3956	4240	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 4240 wrote to memory of 3956	4240	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 3956 wrote to memory of 4928	3956	ie_to_edge_stub.exe	msedge.exe
PID 3956 wrote to memory of 4928	3956	ie_to_edge_stub.exe	msedge.exe
PID 4928 wrote to memory of 1572	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1572	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1120	4928	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
"C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3696

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1360

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17410 /prefetch:2
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1004c
6⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1004c
7⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb7cc646f8,0x7ffb7cc64708,0x7ffb7cc64718
8⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
8⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
8⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
8⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
8⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
8⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
8⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
8⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
8⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
8⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,665960709592117292,5891653979376697901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:8
8⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
8⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x1bc,0x234,0x7ff7217c5460,0x7ff7217c5470,0x7ff7217c5480
9⤵
PID:732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17412 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82950 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:816

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82954 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82960 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:5352

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82966 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82972 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:4480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82978 /prefetch:2
5⤵
- Suspicious use of SetWindowsHookEx
PID:5940

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82984 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17426 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:5248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82990 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:5264

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:83004 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:4416

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:83010 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:1488

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17446 /prefetch:2
5⤵
PID:4596

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:83020 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1508
6⤵
- Program crash
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1396
6⤵
- Program crash
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1528
6⤵
- Program crash
PID:4072

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:83022 /prefetch:2
5⤵
PID:4816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4440 -s 6896
5⤵
- Program crash
PID:1256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4440 -s 7176
5⤵
- Program crash
- Drops file in Program Files directory
PID:2084

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4440 -s 7160
5⤵
- Program crash
PID:3752

C:\Windows\TEMP\hrlC1FE.tmp
C:\Windows\TEMP\hrlC1FE.tmp
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\TEMP\hrlC1FESrv.exe
C:\Windows\TEMP\hrlC1FESrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3976

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:4216

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3756

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4756

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:4740

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3988

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1356

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4632

C:\Windows\TEMP\hrlEEEA.tmp
C:\Windows\TEMP\hrlEEEA.tmp
2⤵
- Executes dropped EXE
PID:3720

C:\Windows\TEMP\hrlEEEASrv.exe
C:\Windows\TEMP\hrlEEEASrv.exe
3⤵
- Executes dropped EXE
PID:1260

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1276

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:5240

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:5260

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5320

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5424

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:5444

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5476

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5520

C:\Windows\TEMP\hrlFC28.tmp
C:\Windows\TEMP\hrlFC28.tmp
2⤵
- Executes dropped EXE
PID:5588

C:\Windows\TEMP\hrlFC28Srv.exe
C:\Windows\TEMP\hrlFC28Srv.exe
3⤵
- Executes dropped EXE
PID:5620

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:5648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5688

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:5852

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:5868

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:5892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5912

C:\Windows\TEMP\hrl6F6.tmp
C:\Windows\TEMP\hrl6F6.tmp
2⤵
PID:6056

C:\Windows\TEMP\hrl6F6Srv.exe
C:\Windows\TEMP\hrl6F6Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6080

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2208

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:6112

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:6136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:5244

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5456

C:\Windows\TEMP\hrlCD2.tmp
C:\Windows\TEMP\hrlCD2.tmp
2⤵
- Executes dropped EXE
PID:5648

C:\Windows\TEMP\hrlCD2Srv.exe
C:\Windows\TEMP\hrlCD2Srv.exe
3⤵
- Executes dropped EXE
PID:5700

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:5576

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5904

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:6056

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5140

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:3936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5948

C:\Windows\TEMP\hrl134A.tmp
C:\Windows\TEMP\hrl134A.tmp
2⤵
- Executes dropped EXE
PID:5492

C:\Windows\TEMP\hrl134ASrv.exe
C:\Windows\TEMP\hrl134ASrv.exe
3⤵
PID:5424

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:5580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1596

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:5048

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:5292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5444

C:\Windows\TEMP\hrl1965.tmp
C:\Windows\TEMP\hrl1965.tmp
2⤵
- Executes dropped EXE
PID:2940

C:\Windows\TEMP\hrl1965Srv.exe
C:\Windows\TEMP\hrl1965Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5268

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:4944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4456

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1644

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:4340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4516

C:\Windows\TEMP\hrl1DF9.tmp
C:\Windows\TEMP\hrl1DF9.tmp
2⤵
PID:3704

C:\Windows\TEMP\hrl1DF9Srv.exe
C:\Windows\TEMP\hrl1DF9Srv.exe
3⤵
- Executes dropped EXE
PID:5892

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:4016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4780

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5584

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1800

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1100

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:1032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4448

C:\Windows\TEMP\hrl22BB.tmp
C:\Windows\TEMP\hrl22BB.tmp
2⤵
- Executes dropped EXE
PID:4892

C:\Windows\TEMP\hrl22BBSrv.exe
C:\Windows\TEMP\hrl22BBSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4864

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:5212

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5328

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5456

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Executes dropped EXE
PID:1392

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
PID:4408

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1940

C:\Windows\TEMP\hrl26F2.tmp
C:\Windows\TEMP\hrl26F2.tmp
2⤵
PID:3172

C:\Windows\TEMP\hrl26F2Srv.exe
C:\Windows\TEMP\hrl26F2Srv.exe
3⤵
PID:3696

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5596

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4908

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:2724

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:6116

C:\Windows\TEMP\hrl2BF3.tmp
C:\Windows\TEMP\hrl2BF3.tmp
2⤵
PID:2932

C:\Windows\TEMP\hrl2BF3Srv.exe
C:\Windows\TEMP\hrl2BF3Srv.exe
3⤵
- Drops file in Program Files directory
PID:1252

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:5424

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3492

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Executes dropped EXE
PID:3704

C:\Windows\TEMP\hrl327B.tmp
C:\Windows\TEMP\hrl327B.tmp
2⤵
PID:1076

C:\Windows\TEMP\hrl327BSrv.exe
C:\Windows\TEMP\hrl327BSrv.exe
3⤵
- Drops file in Program Files directory
PID:5164

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2440

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5908

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:6068

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1952

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:2680

C:\Windows\TEMP\hrl37BA.tmp
C:\Windows\TEMP\hrl37BA.tmp
2⤵
PID:1364

C:\Windows\TEMP\hrl37BASrv.exe
C:\Windows\TEMP\hrl37BASrv.exe
3⤵
PID:3172

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3684

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4872

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5332

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies data under HKEY_USERS
PID:4456

C:\Windows\TEMP\hrl3DD5.tmp
C:\Windows\TEMP\hrl3DD5.tmp
2⤵
PID:2216

C:\Windows\TEMP\hrl3DD5Srv.exe
C:\Windows\TEMP\hrl3DD5Srv.exe
3⤵
PID:3724

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2964

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3568

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1992

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4848

C:\Windows\TEMP\hrl42B7.tmp
C:\Windows\TEMP\hrl42B7.tmp
2⤵
PID:1184

C:\Windows\TEMP\hrl42B7Srv.exe
C:\Windows\TEMP\hrl42B7Srv.exe
3⤵
- Drops file in Program Files directory
PID:4136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5456

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3200 -ip 3200
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3200 -ip 3200
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3200 -ip 3200
1⤵
PID:5652

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
PID:4492

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4080

C:\Windows\TEMP\hrl474B.tmp
C:\Windows\TEMP\hrl474B.tmp
2⤵
PID:1672

C:\Windows\TEMP\hrl474BSrv.exe
C:\Windows\TEMP\hrl474BSrv.exe
3⤵
PID:6084

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 4440 -ip 4440
1⤵
PID:5464

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4312

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:5292

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3544

C:\Windows\TEMP\hrl4AB6.tmp
C:\Windows\TEMP\hrl4AB6.tmp
2⤵
- Checks whether UAC is enabled
PID:6116

C:\Windows\TEMP\hrl4AB6Srv.exe
C:\Windows\TEMP\hrl4AB6Srv.exe
3⤵
- Checks whether UAC is enabled
PID:4456

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5932

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4440 -ip 4440
1⤵
PID:3436

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 4440 -ip 4440
1⤵
PID:5288

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3784

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5676

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
PID:2964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5116

C:\Windows\TEMP\hrl50A1.tmp
C:\Windows\TEMP\hrl50A1.tmp
2⤵
PID:4220

C:\Windows\TEMP\hrl50A1Srv.exe
C:\Windows\TEMP\hrl50A1Srv.exe
3⤵
PID:3724

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1820

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17410 /prefetch:2
6⤵
PID:5720

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17414 /prefetch:2
6⤵
PID:4448

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17418 /prefetch:2
6⤵
PID:5160

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:82946 /prefetch:2
6⤵
- Modifies data under HKEY_USERS
PID:5280

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17426 /prefetch:2
6⤵
PID:4668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17432 /prefetch:2
6⤵
PID:5136

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:82952 /prefetch:2
6⤵
PID:6136

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:82960 /prefetch:2
6⤵
PID:5812

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17450 /prefetch:2
6⤵
PID:4296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17458 /prefetch:2
6⤵
PID:5364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:82974 /prefetch:2
6⤵
PID:6084

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:17468 /prefetch:2
6⤵
PID:1612

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:148484 /prefetch:2
6⤵
- Modifies data under HKEY_USERS
PID:360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1820 -s 6136
6⤵
- Program crash
PID:5456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1820 -s 6160
6⤵
- Program crash
PID:4636

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1992

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2476

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:17410 /prefetch:2
4⤵
PID:788

C:\Windows\TEMP\hrl53ED.tmp
C:\Windows\TEMP\hrl53ED.tmp
2⤵
PID:4172

C:\Windows\TEMP\hrl53EDSrv.exe
C:\Windows\TEMP\hrl53EDSrv.exe
3⤵
- Drops file in Program Files directory
PID:1100

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:6084

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4092

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5728

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4020

C:\Windows\TEMP\hrl592D.tmp
C:\Windows\TEMP\hrl592D.tmp
2⤵
PID:5724

C:\Windows\TEMP\hrl592DSrv.exe
C:\Windows\TEMP\hrl592DSrv.exe
3⤵
PID:2320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4960

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:820

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:4488

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:936

C:\Windows\TEMP\hrl5D53.tmp
C:\Windows\TEMP\hrl5D53.tmp
2⤵
PID:4996

C:\Windows\TEMP\hrl5D53Srv.exe
C:\Windows\TEMP\hrl5D53Srv.exe
3⤵
PID:988

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4336

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4824

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5400

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5404

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5304

C:\Windows\TEMP\hrl615B.tmp
C:\Windows\TEMP\hrl615B.tmp
2⤵
PID:5880

C:\Windows\TEMP\hrl615BSrv.exe
C:\Windows\TEMP\hrl615BSrv.exe
3⤵
- Drops file in Program Files directory
PID:4372

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:380

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:244

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4484

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:3260

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:5248

C:\Windows\TEMP\hrl65FE.tmp
C:\Windows\TEMP\hrl65FE.tmp
2⤵
PID:6112

C:\Windows\TEMP\hrl65FESrv.exe
C:\Windows\TEMP\hrl65FESrv.exe
3⤵
PID:5368

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5568

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:6104

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:1856

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4492

C:\Windows\TEMP\hrl6A92.tmp
C:\Windows\TEMP\hrl6A92.tmp
2⤵
PID:4516

C:\Windows\TEMP\hrl6A92Srv.exe
C:\Windows\TEMP\hrl6A92Srv.exe
3⤵
PID:1256

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1772

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2960

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:220

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:6096

C:\Windows\TEMP\hrl6EE7.tmp
C:\Windows\TEMP\hrl6EE7.tmp
2⤵
PID:4508

C:\Windows\TEMP\hrl6EE7Srv.exe
C:\Windows\TEMP\hrl6EE7Srv.exe
3⤵
PID:3780

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5828

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4872

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2320

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5832

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4092

C:\Windows\TEMP\hrl73C9.tmp
C:\Windows\TEMP\hrl73C9.tmp
2⤵
- Checks whether UAC is enabled
PID:5908

C:\Windows\TEMP\hrl73C9Srv.exe
C:\Windows\TEMP\hrl73C9Srv.exe
3⤵
- Drops file in Program Files directory
PID:3948

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1380

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4144

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4636

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5872

C:\Windows\TEMP\hrl783E.tmp
C:\Windows\TEMP\hrl783E.tmp
2⤵
PID:2376

C:\Windows\TEMP\hrl783ESrv.exe
C:\Windows\TEMP\hrl783ESrv.exe
3⤵
PID:3316

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5432

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3656

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:228

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:176

C:\Windows\TEMP\hrl7BF7.tmp
C:\Windows\TEMP\hrl7BF7.tmp
2⤵
PID:828

C:\Windows\TEMP\hrl7BF7Srv.exe
C:\Windows\TEMP\hrl7BF7Srv.exe
3⤵
PID:5684

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5116

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:1952

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1516

C:\Windows\TEMP\hrl7FA1.tmp
C:\Windows\TEMP\hrl7FA1.tmp
2⤵
PID:5708

C:\Windows\TEMP\hrl7FA1Srv.exe
C:\Windows\TEMP\hrl7FA1Srv.exe
3⤵
- Drops file in Program Files directory
PID:220

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2260

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4332

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5828

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5736

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5728

C:\Windows\TEMP\hrl8492.tmp
C:\Windows\TEMP\hrl8492.tmp
2⤵
PID:5020

C:\Windows\TEMP\hrl8492Srv.exe
C:\Windows\TEMP\hrl8492Srv.exe
3⤵
PID:4688

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4004

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
PID:4748

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3024

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4244

C:\Windows\TEMP\hrl88C8.tmp
C:\Windows\TEMP\hrl88C8.tmp
2⤵
PID:5264

C:\Windows\TEMP\hrl88C8Srv.exe
C:\Windows\TEMP\hrl88C8Srv.exe
3⤵
PID:4636

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5148

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5296

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:176

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1940

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in Program Files directory
PID:5684

C:\Windows\TEMP\hrl8CDF.tmp
C:\Windows\TEMP\hrl8CDF.tmp
2⤵
- Drops file in Program Files directory
PID:4456

C:\Windows\TEMP\hrl8CDFSrv.exe
C:\Windows\TEMP\hrl8CDFSrv.exe
3⤵
- Checks whether UAC is enabled
PID:4080

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1952

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5028

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5900

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
PID:5728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4688

C:\Windows\TEMP\hrl9125.tmp
C:\Windows\TEMP\hrl9125.tmp
2⤵
PID:3508

C:\Windows\TEMP\hrl9125Srv.exe
C:\Windows\TEMP\hrl9125Srv.exe
3⤵
- Drops file in Program Files directory
PID:2216

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2340

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5872

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:4016

C:\Windows\TEMP\hrl94EE.tmp
C:\Windows\TEMP\hrl94EE.tmp
2⤵
PID:2508

C:\Windows\TEMP\hrl94EESrv.exe
C:\Windows\TEMP\hrl94EESrv.exe
3⤵
- Drops file in Program Files directory
PID:4920

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:5032

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 640 -p 1820 -ip 1820
1⤵
PID:5148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 1820 -ip 1820
1⤵
PID:4996

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5732

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1660

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17410 /prefetch:2
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 2588
6⤵
- Program crash
PID:5268

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17414 /prefetch:2
5⤵
PID:4644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:148482 /prefetch:2
5⤵
PID:6040

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:148484 /prefetch:2
5⤵
PID:2084

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17424 /prefetch:2
5⤵
PID:5588

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:82960 /prefetch:2
5⤵
PID:1644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17438 /prefetch:2
5⤵
PID:3964

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:148486 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:6044

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17452 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
PID:6016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:82988 /prefetch:2
5⤵
PID:1536

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17470 /prefetch:2
5⤵
PID:5048

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1660 -s 6420
5⤵
- Program crash
PID:3092

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:214018 /prefetch:2
5⤵
PID:1940

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:279554 /prefetch:2
5⤵
PID:1216

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:410626 /prefetch:2
5⤵
PID:6056

C:\Windows\TEMP\hrl9991.tmp
C:\Windows\TEMP\hrl9991.tmp
2⤵
PID:5908

C:\Windows\TEMP\hrl9991Srv.exe
C:\Windows\TEMP\hrl9991Srv.exe
3⤵
PID:4476

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4008

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3732

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4636

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4264

C:\Windows\TEMP\hrl9D79.tmp
C:\Windows\TEMP\hrl9D79.tmp
2⤵
PID:2940

C:\Windows\TEMP\hrl9D79Srv.exe
C:\Windows\TEMP\hrl9D79Srv.exe
3⤵
PID:5420

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1820

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Drops file in Windows directory
PID:2376

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:5592

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1416

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5464

C:\Windows\TEMP\hrl9FFA.tmp
C:\Windows\TEMP\hrl9FFA.tmp
2⤵
PID:5400

C:\Windows\TEMP\hrl9FFASrv.exe
C:\Windows\TEMP\hrl9FFASrv.exe
3⤵
- Drops file in Program Files directory
PID:5404

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4440

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:1924

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1964

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5368

C:\Windows\TEMP\hrlA4FB.tmp
C:\Windows\TEMP\hrlA4FB.tmp
2⤵
PID:4648

C:\Windows\TEMP\hrlA4FBSrv.exe
C:\Windows\TEMP\hrlA4FBSrv.exe
3⤵
PID:4736

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4568

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3164

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5648

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:2680

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:6136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3136

C:\Windows\TEMP\hrlA99F.tmp
C:\Windows\TEMP\hrlA99F.tmp
2⤵
PID:6108

C:\Windows\TEMP\hrlA99FSrv.exe
C:\Windows\TEMP\hrlA99FSrv.exe
3⤵
PID:5484

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5800

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4288

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4848

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4668

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5436

C:\Windows\TEMP\hrlAE52.tmp
C:\Windows\TEMP\hrlAE52.tmp
2⤵
PID:5104

C:\Windows\TEMP\hrlAE52Srv.exe
C:\Windows\TEMP\hrlAE52Srv.exe
3⤵
PID:652

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2820

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4188

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Checks whether UAC is enabled
PID:5364

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2636

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4516

C:\Windows\TEMP\hrlB23A.tmp
C:\Windows\TEMP\hrlB23A.tmp
2⤵
PID:2160

C:\Windows\TEMP\hrlB23ASrv.exe
C:\Windows\TEMP\hrlB23ASrv.exe
3⤵
PID:1168

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3564

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5112

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:4780

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1804

C:\Windows\TEMP\hrlB6DD.tmp
C:\Windows\TEMP\hrlB6DD.tmp
2⤵
PID:3092

C:\Windows\TEMP\hrlB6DDSrv.exe
C:\Windows\TEMP\hrlB6DDSrv.exe
3⤵
PID:1416

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5864

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:1940

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:2956

C:\Windows\TEMP\hrlBBCF.tmp
C:\Windows\TEMP\hrlBBCF.tmp
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5400

C:\Windows\TEMP\hrlBBCFSrv.exe
C:\Windows\TEMP\hrlBBCFSrv.exe
3⤵
- Drops file in Program Files directory
PID:6140

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5516

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5164

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:348

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3144

C:\Windows\TEMP\hrlC12E.tmp
C:\Windows\TEMP\hrlC12E.tmp
2⤵
- Checks whether UAC is enabled
PID:5032

C:\Windows\TEMP\hrlC12ESrv.exe
C:\Windows\TEMP\hrlC12ESrv.exe
3⤵
- Drops file in Program Files directory
PID:4320

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:6136

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:3136

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:6108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5800

C:\Windows\TEMP\hrlC506.tmp
C:\Windows\TEMP\hrlC506.tmp
2⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:4668

C:\Windows\TEMP\hrlC506Srv.exe
C:\Windows\TEMP\hrlC506Srv.exe
3⤵
PID:5852

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5436

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:5812

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Checks whether UAC is enabled
PID:5304

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Drops file in Program Files directory
PID:652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2636

C:\Windows\TEMP\hrlC91D.tmp
C:\Windows\TEMP\hrlC91D.tmp
2⤵
PID:1168

C:\Windows\TEMP\hrlC91DSrv.exe
C:\Windows\TEMP\hrlC91DSrv.exe
3⤵
PID:2004

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5796

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5872

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Checks processor information in registry
PID:3564

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:4732

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4172

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5560

C:\Windows\TEMP\hrlCF38.tmp
C:\Windows\TEMP\hrlCF38.tmp
2⤵
PID:3596

C:\Windows\TEMP\hrlCF38Srv.exe
C:\Windows\TEMP\hrlCF38Srv.exe
3⤵
PID:5420

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4992

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4884

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Drops file in Program Files directory
PID:1412

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:784

C:\Windows\TEMP\hrlD3BC.tmp
C:\Windows\TEMP\hrlD3BC.tmp
2⤵
PID:3852

C:\Windows\TEMP\hrlD3BCSrv.exe
C:\Windows\TEMP\hrlD3BCSrv.exe
3⤵
PID:2624

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1948

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2032

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5320

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5412

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2128

C:\Windows\TEMP\hrlD765.tmp
C:\Windows\TEMP\hrlD765.tmp
2⤵
PID:5256

C:\Windows\TEMP\hrlD765Srv.exe
C:\Windows\TEMP\hrlD765Srv.exe
3⤵
- Drops file in Program Files directory
PID:3960

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1540

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5552

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
PID:5508

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5300

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2260

C:\Windows\TEMP\hrlDC38.tmp
C:\Windows\TEMP\hrlDC38.tmp
2⤵
PID:5212

C:\Windows\TEMP\hrlDC38Srv.exe
C:\Windows\TEMP\hrlDC38Srv.exe
3⤵
- Drops file in Program Files directory
PID:4596

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2828

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1952 -ip 1952
1⤵
PID:828

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5928

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4748

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Drops file in Program Files directory
PID:5404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4416

C:\Windows\TEMP\hrlE1C6.tmp
C:\Windows\TEMP\hrlE1C6.tmp
2⤵
PID:3424

C:\Windows\TEMP\hrlE1C6Srv.exe
C:\Windows\TEMP\hrlE1C6Srv.exe
3⤵
PID:5424

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5440

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 1660 -ip 1660
1⤵
PID:4008

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4760

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5712

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:5800

C:\Windows\TEMP\hrlE705.tmp
C:\Windows\TEMP\hrlE705.tmp
2⤵
PID:5676

C:\Windows\TEMP\hrlE705Srv.exe
C:\Windows\TEMP\hrlE705Srv.exe
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2032

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:176

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:176 CREDAT:17410 /prefetch:2
6⤵
- Modifies data under HKEY_USERS
PID:4324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:3408

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4952

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Checks whether UAC is enabled
PID:2636

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Drops file in System32 directory
PID:4684

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:17410 /prefetch:2
4⤵
- Drops file in Windows directory
PID:3732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:17414 /prefetch:2
4⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 3364
5⤵
- Program crash
PID:5996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:17420 /prefetch:2
4⤵
PID:4448

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:82952 /prefetch:2
4⤵
PID:4852

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:82960 /prefetch:2
4⤵
PID:4912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4684 -s 6256
4⤵
- Program crash
PID:1288

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4684 -s 6272
4⤵
- Program crash
PID:1928

C:\Windows\TEMP\hrlEA32.tmp
C:\Windows\TEMP\hrlEA32.tmp
2⤵
PID:816

C:\Windows\TEMP\hrlEA32Srv.exe
C:\Windows\TEMP\hrlEA32Srv.exe
3⤵
PID:5268

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5020

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5380

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2556

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3568

C:\Windows\TEMP\hrlEFC0.tmp
C:\Windows\TEMP\hrlEFC0.tmp
2⤵
PID:1672

C:\Windows\TEMP\hrlEFC0Srv.exe
C:\Windows\TEMP\hrlEFC0Srv.exe
3⤵
PID:4368

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Checks whether UAC is enabled
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4980

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5516

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5372

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1772

C:\Windows\TEMP\hrlF379.tmp
C:\Windows\TEMP\hrlF379.tmp
2⤵
PID:5288

C:\Windows\TEMP\hrlF379Srv.exe
C:\Windows\TEMP\hrlF379Srv.exe
3⤵
PID:1540

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5332

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2192

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:216

C:\Windows\TEMP\hrlF713.tmp
C:\Windows\TEMP\hrlF713.tmp
2⤵
PID:4652

C:\Windows\TEMP\hrlF713Srv.exe
C:\Windows\TEMP\hrlF713Srv.exe
3⤵
PID:1396

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4500

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:6120

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3780

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1820

C:\Windows\TEMP\hrlFA8D.tmp
C:\Windows\TEMP\hrlFA8D.tmp
2⤵
PID:3316

C:\Windows\TEMP\hrlFA8DSrv.exe
C:\Windows\TEMP\hrlFA8DSrv.exe
3⤵
PID:5136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5700

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2440

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4080

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5352

C:\Windows\TEMP\hrlFF41.tmp
C:\Windows\TEMP\hrlFF41.tmp
2⤵
PID:4996

C:\Windows\TEMP\hrlFF41Srv.exe
C:\Windows\TEMP\hrlFF41Srv.exe
3⤵
PID:4876

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4004

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5104

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:6064

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5568

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5188

C:\Windows\TEMP\hrl329.tmp
C:\Windows\TEMP\hrl329.tmp
2⤵
PID:6108

C:\Windows\TEMP\hrl329Srv.exe
C:\Windows\TEMP\hrl329Srv.exe
3⤵
PID:6048

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5300

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4372

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2392

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5900

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4048

C:\Windows\TEMP\hrl7AD.tmp
C:\Windows\TEMP\hrl7AD.tmp
2⤵
PID:4512

C:\Windows\TEMP\hrl7ADSrv.exe
C:\Windows\TEMP\hrl7ADSrv.exe
3⤵
PID:5604

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5448

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2556

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5908

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4608

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3828

C:\Windows\TEMP\hrlBF3.tmp
C:\Windows\TEMP\hrlBF3.tmp
2⤵
PID:3420

C:\Windows\TEMP\hrlBF3Srv.exe
C:\Windows\TEMP\hrlBF3Srv.exe
3⤵
- Drops file in Program Files directory
PID:4636

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3424

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3164

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3412

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Checks whether UAC is enabled
PID:6136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
PID:3408

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5840

C:\Windows\TEMP\hrlF9C.tmp
C:\Windows\TEMP\hrlF9C.tmp
2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:5516

C:\Windows\TEMP\hrlF9CSrv.exe
C:\Windows\TEMP\hrlF9CSrv.exe
3⤵
PID:4788

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5636

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5332

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2192

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:6036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4660

C:\Windows\TEMP\hrl146E.tmp
C:\Windows\TEMP\hrl146E.tmp
2⤵
PID:1608

C:\Windows\TEMP\hrl146ESrv.exe
C:\Windows\TEMP\hrl146ESrv.exe
3⤵
PID:2724

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5940

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3704

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5704

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5952

C:\Windows\TEMP\hrl1895.tmp
C:\Windows\TEMP\hrl1895.tmp
2⤵
PID:5352

C:\Windows\TEMP\hrl1895Srv.exe
C:\Windows\TEMP\hrl1895Srv.exe
3⤵
PID:1964

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1032

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2936

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5692

C:\Windows\TEMP\hrl1CAC.tmp
C:\Windows\TEMP\hrl1CAC.tmp
2⤵
PID:3440

C:\Windows\TEMP\hrl1CACSrv.exe
C:\Windows\TEMP\hrl1CACSrv.exe
3⤵
PID:1344

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3964

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:224

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5852

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4952

C:\Windows\TEMP\hrl2140.tmp
C:\Windows\TEMP\hrl2140.tmp
2⤵
PID:5604

C:\Windows\TEMP\hrl2140Srv.exe
C:\Windows\TEMP\hrl2140Srv.exe
3⤵
PID:3968

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5064

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2004

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5872

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4000

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3424

C:\Windows\TEMP\hrl2602.tmp
C:\Windows\TEMP\hrl2602.tmp
2⤵
PID:1848

C:\Windows\TEMP\hrl2602Srv.exe
C:\Windows\TEMP\hrl2602Srv.exe
3⤵
- Checks whether UAC is enabled
PID:1216

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:732

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4316

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5840

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:5800

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4044

C:\Windows\TEMP\hrl2A67.tmp
C:\Windows\TEMP\hrl2A67.tmp
2⤵
- Drops file in Program Files directory
PID:5484

C:\Windows\TEMP\hrl2A67Srv.exe
C:\Windows\TEMP\hrl2A67Srv.exe
3⤵
PID:4944

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Drops file in Program Files directory
PID:2724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4612

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5388

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1332

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3884

C:\Windows\TEMP\hrl2ECC.tmp
C:\Windows\TEMP\hrl2ECC.tmp
2⤵
PID:1416

C:\Windows\TEMP\hrl2ECCSrv.exe
C:\Windows\TEMP\hrl2ECCSrv.exe
3⤵
PID:3032

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Drops file in Program Files directory
PID:1964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3224 -ip 3224
1⤵
PID:6120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 4684 -ip 4684
1⤵
PID:3152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 4684 -ip 4684
1⤵
- Modifies data under HKEY_USERS
PID:6040

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4872

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3440

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5252

C:\Windows\TEMP\hrl368D.tmp
C:\Windows\TEMP\hrl368D.tmp
2⤵
PID:5652

C:\Windows\TEMP\hrl368DSrv.exe
C:\Windows\TEMP\hrl368DSrv.exe
3⤵
PID:4372

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4124

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4896 CREDAT:17410 /prefetch:2
6⤵
PID:3144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4896 -s 5988
6⤵
- Program crash
PID:6128

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4200

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5268

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4240 CREDAT:17410 /prefetch:2
4⤵
PID:5116

C:\Windows\TEMP\hrl3A17.tmp
C:\Windows\TEMP\hrl3A17.tmp
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5872

C:\Windows\TEMP\hrl3A17Srv.exe
C:\Windows\TEMP\hrl3A17Srv.exe
3⤵
PID:100

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3376

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5504

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5868

C:\Windows\TEMP\hrl3EE9.tmp
C:\Windows\TEMP\hrl3EE9.tmp
2⤵
PID:5272

C:\Windows\TEMP\hrl3EE9Srv.exe
C:\Windows\TEMP\hrl3EE9Srv.exe
3⤵
PID:6104

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4484

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3200

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4528

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3792

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4940

C:\Windows\TEMP\hrl432F.tmp
C:\Windows\TEMP\hrl432F.tmp
2⤵
PID:6128

C:\Windows\TEMP\hrl432FSrv.exe
C:\Windows\TEMP\hrl432FSrv.exe
3⤵
PID:332

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4668

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5380

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4356

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2392

C:\Windows\TEMP\hrl46B9.tmp
C:\Windows\TEMP\hrl46B9.tmp
2⤵
PID:2784

C:\Windows\TEMP\hrl46B9Srv.exe
C:\Windows\TEMP\hrl46B9Srv.exe
3⤵
PID:360

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1032

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5472

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4492

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4648

C:\Windows\TEMP\hrl4B1E.tmp
C:\Windows\TEMP\hrl4B1E.tmp
2⤵
PID:4748

C:\Windows\TEMP\hrl4B1ESrv.exe
C:\Windows\TEMP\hrl4B1ESrv.exe
3⤵
PID:2364

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:2324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4072

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:3732

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4568

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5428

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3924

C:\Windows\TEMP\hrl503F.tmp
C:\Windows\TEMP\hrl503F.tmp
2⤵
PID:1488

C:\Windows\TEMP\hrl503FSrv.exe
C:\Windows\TEMP\hrl503FSrv.exe
3⤵
PID:3260

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5264

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5708

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4836

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:6092

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5812

C:\Windows\TEMP\hrl53E8.tmp
C:\Windows\TEMP\hrl53E8.tmp
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1924

C:\Windows\TEMP\hrl53E8Srv.exe
C:\Windows\TEMP\hrl53E8Srv.exe
3⤵
PID:3692

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5664

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4128

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5700

C:\Windows\TEMP\hrl57FF.tmp
C:\Windows\TEMP\hrl57FF.tmp
2⤵
PID:5456

C:\Windows\TEMP\hrl57FFSrv.exe
C:\Windows\TEMP\hrl57FFSrv.exe
3⤵
PID:828

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Checks whether UAC is enabled
PID:5552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5612

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5652

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5648

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:1848

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2804

C:\Windows\TEMP\hrl5BC8.tmp
C:\Windows\TEMP\hrl5BC8.tmp
2⤵
PID:2936

C:\Windows\TEMP\hrl5BC8Srv.exe
C:\Windows\TEMP\hrl5BC8Srv.exe
3⤵
- Loads dropped DLL
PID:2376

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2832

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3412

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:880

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5860

C:\Windows\TEMP\hrl608B.tmp
C:\Windows\TEMP\hrl608B.tmp
2⤵
PID:6104

C:\Windows\TEMP\hrl608BSrv.exe
C:\Windows\TEMP\hrl608BSrv.exe
3⤵
PID:3316

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:6120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4484

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4344

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5172

C:\Windows\TEMP\hrl64C1.tmp
C:\Windows\TEMP\hrl64C1.tmp
2⤵
PID:3200

C:\Windows\TEMP\hrl64C1Srv.exe
C:\Windows\TEMP\hrl64C1Srv.exe
3⤵
PID:2556

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4800

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Drops file in Program Files directory
PID:4780

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4188

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4824

C:\Windows\TEMP\hrl68D8.tmp
C:\Windows\TEMP\hrl68D8.tmp
2⤵
PID:3612

C:\Windows\TEMP\hrl68D8Srv.exe
C:\Windows\TEMP\hrl68D8Srv.exe
3⤵
PID:5696

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4916

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3176

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:1136

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5472

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5744

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4072

C:\Windows\TEMP\hrl6D8B.tmp
C:\Windows\TEMP\hrl6D8B.tmp
2⤵
PID:4392

C:\Windows\TEMP\hrl6D8BSrv.exe
C:\Windows\TEMP\hrl6D8BSrv.exe
3⤵
PID:4220

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3260

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4308

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3132

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4880

C:\Windows\TEMP\hrl71D1.tmp
C:\Windows\TEMP\hrl71D1.tmp
2⤵
PID:4292

C:\Windows\TEMP\hrl71D1Srv.exe
C:\Windows\TEMP\hrl71D1Srv.exe
3⤵
PID:1924

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4244

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5304

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5364

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5456

C:\Windows\TEMP\hrl7607.tmp
C:\Windows\TEMP\hrl7607.tmp
2⤵
PID:4192

C:\Windows\TEMP\hrl7607Srv.exe
C:\Windows\TEMP\hrl7607Srv.exe
3⤵
PID:5300

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3532

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:6116

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5604

C:\Windows\TEMP\hrl7AAA.tmp
C:\Windows\TEMP\hrl7AAA.tmp
2⤵
PID:5272

C:\Windows\TEMP\hrl7AAASrv.exe
C:\Windows\TEMP\hrl7AAASrv.exe
3⤵
PID:4980

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Checks whether UAC is enabled
PID:4288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 4896 -ip 4896
1⤵
PID:5704

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5940

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:6112

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:3412

C:\Windows\TEMP\hrl7F5D.tmp
C:\Windows\TEMP\hrl7F5D.tmp
2⤵
PID:4668

C:\Windows\TEMP\hrl7F5DSrv.exe
C:\Windows\TEMP\hrl7F5DSrv.exe
3⤵
PID:3976

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5912

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2556

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2208

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:1940

C:\Windows\TEMP\hrl8394.tmp
C:\Windows\TEMP\hrl8394.tmp
2⤵
PID:2400

C:\Windows\TEMP\hrl8394Srv.exe
C:\Windows\TEMP\hrl8394Srv.exe
3⤵
PID:2784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2544

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:17410 /prefetch:2
5⤵
PID:5256

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4020

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5392

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies data under HKEY_USERS
PID:6056

C:\Windows\TEMP\hrl86D0.tmp
C:\Windows\TEMP\hrl86D0.tmp
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3136

C:\Windows\TEMP\hrl86D0Srv.exe
C:\Windows\TEMP\hrl86D0Srv.exe
3⤵
PID:4024

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4424

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3132

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:6096

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:17410 /prefetch:2
5⤵
PID:3440

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1764 -s 5604
5⤵
- Program crash
PID:2820

C:\Windows\TEMP\hrl8CEA.tmp
C:\Windows\TEMP\hrl8CEA.tmp
2⤵
PID:2856

C:\Windows\TEMP\hrl8CEASrv.exe
C:\Windows\TEMP\hrl8CEASrv.exe
3⤵
PID:5140

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4984

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3376

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4692

C:\Windows\TEMP\hrl90D2.tmp
C:\Windows\TEMP\hrl90D2.tmp
2⤵
- Checks whether UAC is enabled
PID:5872

C:\Windows\TEMP\hrl90D2Srv.exe
C:\Windows\TEMP\hrl90D2Srv.exe
3⤵
PID:4372

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5952

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Drops file in Program Files directory
PID:5320

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:332

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in Program Files directory
PID:5424

C:\Windows\TEMP\hrl94CA.tmp
C:\Windows\TEMP\hrl94CA.tmp
2⤵
PID:1992

C:\Windows\TEMP\hrl94CASrv.exe
C:\Windows\TEMP\hrl94CASrv.exe
3⤵
PID:6000

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4848

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4760

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4444

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:708

C:\Windows\TEMP\hrl98F0.tmp
C:\Windows\TEMP\hrl98F0.tmp
2⤵
PID:1952

C:\Windows\TEMP\hrl98F0Srv.exe
C:\Windows\TEMP\hrl98F0Srv.exe
3⤵
PID:3836

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5924

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
PID:2956

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4712

C:\Windows\TEMP\hrl9D07.tmp
C:\Windows\TEMP\hrl9D07.tmp
2⤵
PID:6088

C:\Windows\TEMP\hrl9D07Srv.exe
C:\Windows\TEMP\hrl9D07Srv.exe
3⤵
PID:5028

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3656

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4204

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:732

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5548

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5076

C:\Windows\TEMP\hrlA11E.tmp
C:\Windows\TEMP\hrlA11E.tmp
2⤵
PID:2348

C:\Windows\TEMP\hrlA11ESrv.exe
C:\Windows\TEMP\hrlA11ESrv.exe
3⤵
PID:4632

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5432

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3424

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5556

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:5532

C:\Windows\TEMP\hrlA583.tmp
C:\Windows\TEMP\hrlA583.tmp
2⤵
PID:5428

C:\Windows\TEMP\hrlA583Srv.exe
C:\Windows\TEMP\hrlA583Srv.exe
3⤵
PID:2392

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:360

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:6040

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:1136

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Drops file in Program Files directory
PID:5420

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4392

C:\Windows\TEMP\hrlAA36.tmp
C:\Windows\TEMP\hrlAA36.tmp
2⤵
PID:4292

C:\Windows\TEMP\hrlAA36Srv.exe
C:\Windows\TEMP\hrlAA36Srv.exe
3⤵
PID:2484

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4308

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4192

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2936

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1100

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:6068

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5272

C:\Windows\TEMP\hrlAE2E.tmp
C:\Windows\TEMP\hrlAE2E.tmp
2⤵
PID:2092

C:\Windows\TEMP\hrlAE2ESrv.exe
C:\Windows\TEMP\hrlAE2ESrv.exe
3⤵
PID:5536

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1364

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5268

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2108

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:6024

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2372

C:\Windows\TEMP\hrlB2B2.tmp
C:\Windows\TEMP\hrlB2B2.tmp
2⤵
PID:5940

C:\Windows\TEMP\hrlB2B2Srv.exe
C:\Windows\TEMP\hrlB2B2Srv.exe
3⤵
PID:4344

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:224

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3124

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5732

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:5248

C:\Windows\TEMP\hrlB65C.tmp
C:\Windows\TEMP\hrlB65C.tmp
2⤵
PID:5908

C:\Windows\TEMP\hrlB65CSrv.exe
C:\Windows\TEMP\hrlB65CSrv.exe
3⤵
PID:5020

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:6080

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4800

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5660

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1952

C:\Windows\TEMP\hrlBAA1.tmp
C:\Windows\TEMP\hrlBAA1.tmp
2⤵
PID:3996

C:\Windows\TEMP\hrlBAA1Srv.exe
C:\Windows\TEMP\hrlBAA1Srv.exe
3⤵
PID:4964

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5412

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2976

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Checks whether UAC is enabled
PID:4416

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4480

C:\Windows\TEMP\hrlBF35.tmp
C:\Windows\TEMP\hrlBF35.tmp
2⤵
PID:5644

C:\Windows\TEMP\hrlBF35Srv.exe
C:\Windows\TEMP\hrlBF35Srv.exe
3⤵
PID:3828

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4144

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4636

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5464

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5984

C:\Windows\TEMP\hrlC3F8.tmp
C:\Windows\TEMP\hrlC3F8.tmp
2⤵
PID:6108

C:\Windows\TEMP\hrlC3F8Srv.exe
C:\Windows\TEMP\hrlC3F8Srv.exe
3⤵
PID:3588

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5696

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5556

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4024

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:6040

C:\Windows\TEMP\hrlC86D.tmp
C:\Windows\TEMP\hrlC86D.tmp
2⤵
PID:5404

C:\Windows\TEMP\hrlC86DSrv.exe
C:\Windows\TEMP\hrlC86DSrv.exe
3⤵
PID:5676

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:1860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 1764 -ip 1764
1⤵
PID:5472

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5864

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5852

C:\Windows\TEMP\hrlCDDB.tmp
C:\Windows\TEMP\hrlCDDB.tmp
2⤵
PID:3792

C:\Windows\TEMP\hrlCDDBSrv.exe
C:\Windows\TEMP\hrlCDDBSrv.exe
3⤵
PID:5740

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3376

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Drops file in Program Files directory
PID:2624

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:17410 /prefetch:2
6⤵
PID:4940

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5288

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:5872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5872 CREDAT:17410 /prefetch:2
4⤵
PID:2372

C:\Windows\TEMP\hrlD146.tmp
C:\Windows\TEMP\hrlD146.tmp
2⤵
PID:2824

C:\Windows\TEMP\hrlD146Srv.exe
C:\Windows\TEMP\hrlD146Srv.exe
3⤵
PID:5680

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
PID:5020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3492

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:6080

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5924

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:3996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5968

C:\Windows\TEMP\hrlD676.tmp
C:\Windows\TEMP\hrlD676.tmp
2⤵
PID:1340

C:\Windows\TEMP\hrlD676Srv.exe
C:\Windows\TEMP\hrlD676Srv.exe
3⤵
PID:2976

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5028

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4368

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5692

C:\Windows\TEMP\hrlDA20.tmp
C:\Windows\TEMP\hrlDA20.tmp
2⤵
PID:5528

C:\Windows\TEMP\hrlDA20Srv.exe
C:\Windows\TEMP\hrlDA20Srv.exe
3⤵
PID:2620

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:348

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1852

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:380

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4196

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:4220

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:5472

C:\Windows\TEMP\hrlDE75.tmp
C:\Windows\TEMP\hrlDE75.tmp
2⤵
PID:5404

C:\Windows\TEMP\hrlDE75Srv.exe
C:\Windows\TEMP\hrlDE75Srv.exe
3⤵
PID:5388

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4292

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2340

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4012

C:\Windows\TEMP\hrlE2AB.tmp
C:\Windows\TEMP\hrlE2AB.tmp
2⤵
PID:5948

C:\Windows\TEMP\hrlE2ABSrv.exe
C:\Windows\TEMP\hrlE2ABSrv.exe
3⤵
PID:5092

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5724

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:5652

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4548

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4496

C:\Windows\TEMP\hrlE645.tmp
C:\Windows\TEMP\hrlE645.tmp
2⤵
PID:4652

C:\Windows\TEMP\hrlE645Srv.exe
C:\Windows\TEMP\hrlE645Srv.exe
3⤵
PID:5624

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4124

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
- Drops file in Program Files directory
PID:2556

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:6048

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Checks whether UAC is enabled
PID:3568

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4984

C:\Windows\TEMP\hrlEA4C.tmp
C:\Windows\TEMP\hrlEA4C.tmp
2⤵
PID:5320

C:\Windows\TEMP\hrlEA4CSrv.exe
C:\Windows\TEMP\hrlEA4CSrv.exe
3⤵
PID:5484

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:5596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2956

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:3504

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4128

C:\Windows\TEMP\hrlEE25.tmp
C:\Windows\TEMP\hrlEE25.tmp
2⤵
PID:5616

C:\Windows\TEMP\hrlEE25Srv.exe
C:\Windows\TEMP\hrlEE25Srv.exe
3⤵
PID:6112

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:3948

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:4904

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
- Checks whether UAC is enabled
PID:4980

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:5908

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4736

C:\Windows\TEMP\hrlF2B9.tmp
C:\Windows\TEMP\hrlF2B9.tmp
2⤵
PID:5204

C:\Windows\TEMP\hrlF2B9Srv.exe
C:\Windows\TEMP\hrlF2B9Srv.exe
3⤵
PID:4580

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:4384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:4420

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:988

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:5504

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:244

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2176

C:\Windows\TEMP\hrlF6C0.tmp
C:\Windows\TEMP\hrlF6C0.tmp
2⤵
PID:4064

C:\Windows\TEMP\hrlF6C0Srv.exe
C:\Windows\TEMP\hrlF6C0Srv.exe
3⤵
PID:5112

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
PID:3960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1608

C:\Windows\woyooo.exe
C:\Windows\woyooo.exe
1⤵
PID:2328

C:\Windows\woyoooSrv.exe
C:\Windows\woyoooSrv.exe
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
PID:2620

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2348

C:\Windows\TEMP\hrlFB15.tmp
C:\Windows\TEMP\hrlFB15.tmp
2⤵
PID:5644

C:\Windows\TEMP\hrlFB15Srv.exe
C:\Windows\TEMP\hrlFB15Srv.exe
3⤵
PID:5768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
482KB

MD5
c557b3eb2cfc0f897ef106d909e8fcd1

SHA1
edb013dcd2071f87529de64c13eb8cf8c8c9cd94

SHA256
1277b91193b0d5271a6030d0a1dcc23de6f497120a6e73549d4996009fa92e58

SHA512
8e6d9c3b69d3703763cadaa47147865d801cdbe952f36ebc6b1764bdc4a32267d017fa7eccdd846da8a2496d2e30b4d9487c06a3db4b7bc70f8a874b65c7869d

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
12KB

MD5
de61de242b5500304af17e4661100ea5

SHA1
ed6c1fce0696ce100a93f2d3cea83a0475947e4f

SHA256
3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

SHA512
b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
12KB

MD5
de61de242b5500304af17e4661100ea5

SHA1
ed6c1fce0696ce100a93f2d3cea83a0475947e4f

SHA256
3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

SHA512
b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
12KB

MD5
de61de242b5500304af17e4661100ea5

SHA1
ed6c1fce0696ce100a93f2d3cea83a0475947e4f

SHA256
3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

SHA512
b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
482KB

MD5
c557b3eb2cfc0f897ef106d909e8fcd1

SHA1
edb013dcd2071f87529de64c13eb8cf8c8c9cd94

SHA256
1277b91193b0d5271a6030d0a1dcc23de6f497120a6e73549d4996009fa92e58

SHA512
8e6d9c3b69d3703763cadaa47147865d801cdbe952f36ebc6b1764bdc4a32267d017fa7eccdd846da8a2496d2e30b4d9487c06a3db4b7bc70f8a874b65c7869d

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
12KB

MD5
de61de242b5500304af17e4661100ea5

SHA1
ed6c1fce0696ce100a93f2d3cea83a0475947e4f

SHA256
3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

SHA512
b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

Download Submit
C:\Windows\SysWOW64\hra8.dll
Filesize
12KB

MD5
de61de242b5500304af17e4661100ea5

SHA1
ed6c1fce0696ce100a93f2d3cea83a0475947e4f

SHA256
3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

SHA512
b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

Download Submit
C:\Windows\SysWOW64\hra864.dll
Filesize
128B

MD5
1bbb616322d34852b7e71e7253c8eaac

SHA1
f6a19ac9515b17a7c95aa99fdeff2b8260547d4c

SHA256
a2eaf05f2fc8bde09ff96abc7c5d428ecef100bec34896232710210005cab511

SHA512
e5ff535839431c216614c4d8e1b5d6bdde3dad58127300444aad9339c5d7215bedf1eccdb924c06c38bdda4e84585f21f8b6288f5cb0c5cf23ee885058c4dba1

Download Submit
C:\Windows\SysWOW64\hra864.dll
Filesize
128B

MD5
1bbb616322d34852b7e71e7253c8eaac

SHA1
f6a19ac9515b17a7c95aa99fdeff2b8260547d4c

SHA256
a2eaf05f2fc8bde09ff96abc7c5d428ecef100bec34896232710210005cab511

SHA512
e5ff535839431c216614c4d8e1b5d6bdde3dad58127300444aad9339c5d7215bedf1eccdb924c06c38bdda4e84585f21f8b6288f5cb0c5cf23ee885058c4dba1

Download Submit
C:\Windows\SysWOW64\hra864.dll
Filesize
128B

MD5
1bbb616322d34852b7e71e7253c8eaac

SHA1
f6a19ac9515b17a7c95aa99fdeff2b8260547d4c

SHA256
a2eaf05f2fc8bde09ff96abc7c5d428ecef100bec34896232710210005cab511

SHA512
e5ff535839431c216614c4d8e1b5d6bdde3dad58127300444aad9339c5d7215bedf1eccdb924c06c38bdda4e84585f21f8b6288f5cb0c5cf23ee885058c4dba1

Download Submit
C:\Windows\TEMP\hrlC1FE.tmp
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\TEMP\hrlC1FESrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\TEMP\hrlEEEA.tmp
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\TEMP\hrlEEEASrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\Temp\hrlC1FE.tmp
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\Temp\hrlC1FESrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\Temp\hrlEEEA.tmp
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\Temp\hrlEEEASrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
1KB

MD5
72d715b2396286b749f3089e313cf5c7

SHA1
1b691747f3423391a39a0a60f5dee49874d3c986

SHA256
d90210974205104013220df68e829fa74e13104807f4a505deb12832bacb3ef0

SHA512
7ecea2fee7db17c801ec3c78bd65a46e3a2687eac8826a42a1b978e4daee8906acdc5fbed3a866701896213467f0cc4fb8ab642be5f2a645cdb897d2d60dc995

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
404B

MD5
90f35fe1db5460762b8c2e4770dc9e05

SHA1
6d205fb947b4277d1e0526f1669b76c304d40975

SHA256
a0f202767f5bed02bc73133cd1ab70728667f9f2953df7b4428d4439a6ad5879

SHA512
3cba99ce0adb80bdaa2d81f7563764d2c355985eb46dbe533b71c4a65d01e09229c6cbe40564630df02769ee62ee189a6a1ee91563153f62a252014f13668fe3

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c2b1ebba1b0e0d87b7d7391eec3891bc

SHA1
0885f089f334518425e683c1d463146077e5f539

SHA256
fccdf33996048effe578fc718fb92a18a4e61abc7964630f46c8651dbea40839

SHA512
c2b7826e779566e2a2f9ec813e8bcafbed60e2d4bddf420c66a632e665196a7d730e9013993b1e78186095f08db9e9306d8fc9d174bcd1c11e29c3c4291242e9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyooo.exe
Filesize
469KB

MD5
709802f0cfb676e53115189b5cd91cfc

SHA1
97027efdd9473b5f431179bc9b7ced86126cc625

SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3

SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\woyoooSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\??\pipe\LOCAL\crashpad_4928_UKFBFUMTTZMILDXU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/732-260-0x0000000000000000-mapping.dmp

Download
memory/1032-172-0x0000000000000000-mapping.dmp

Download
memory/1032-299-0x0000000000000000-mapping.dmp

Download
memory/1076-316-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1100-298-0x0000000000000000-mapping.dmp

Download
memory/1100-170-0x0000000000000000-mapping.dmp

Download
memory/1120-169-0x0000000000000000-mapping.dmp

Download
memory/1252-311-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1260-214-0x0000000000000000-mapping.dmp

Download
memory/1260-220-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1276-218-0x0000000000000000-mapping.dmp

Download
memory/1356-204-0x0000000000000000-mapping.dmp

Download
memory/1360-147-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1360-137-0x0000000000000000-mapping.dmp

Download
memory/1364-321-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1572-165-0x0000000000000000-mapping.dmp

Download
memory/1644-297-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1644-286-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1800-304-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2084-313-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/2084-314-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2660-145-0x0000000000000000-mapping.dmp

Download
memory/2820-158-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2820-193-0x0000000000000000-mapping.dmp

Download
memory/2820-151-0x0000000000000000-mapping.dmp

Download
memory/2932-312-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2940-282-0x0000000000000000-mapping.dmp

Download
memory/2940-287-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3136-185-0x0000000000000000-mapping.dmp

Download
memory/3172-320-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3172-308-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3492-315-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3492-310-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3696-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3696-306-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3696-131-0x0000000000000000-mapping.dmp

Download
memory/3704-296-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3704-292-0x0000000000000000-mapping.dmp

Download
memory/3720-211-0x0000000000000000-mapping.dmp

Download
memory/3720-216-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3756-189-0x0000000000000000-mapping.dmp

Download
memory/3756-192-0x00000000004B0000-0x00000000004BF000-memory.dmp

Filesize
60KB

Download
memory/3936-272-0x0000000000000000-mapping.dmp

Download
memory/3956-163-0x0000000000000000-mapping.dmp

Download
memory/3976-154-0x0000000000000000-mapping.dmp

Download
memory/3976-160-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3988-201-0x0000000000000000-mapping.dmp

Download
memory/4016-294-0x0000000000000000-mapping.dmp

Download
memory/4048-175-0x0000000000000000-mapping.dmp

Download
memory/4176-157-0x0000000000000000-mapping.dmp

Download
memory/4216-199-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4296-183-0x0000000000000000-mapping.dmp

Download
memory/4340-289-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4340-285-0x0000000000000000-mapping.dmp

Download
memory/4340-291-0x0000000000470000-0x000000000047F000-memory.dmp

Filesize
60KB

Download
memory/4368-181-0x0000000000000000-mapping.dmp

Download
memory/4472-177-0x0000000000000000-mapping.dmp

Download
memory/4492-283-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4740-222-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4740-207-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4864-301-0x0000000000000000-mapping.dmp

Download
memory/4864-187-0x0000000000000000-mapping.dmp

Download
memory/4864-303-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4892-300-0x0000000000000000-mapping.dmp

Download
memory/4892-302-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4908-309-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4928-164-0x0000000000000000-mapping.dmp

Download
memory/4944-290-0x0000000000000000-mapping.dmp

Download
memory/5048-280-0x0000000000000000-mapping.dmp

Download
memory/5060-144-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5060-130-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5080-162-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5080-149-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5084-135-0x0000000000000000-mapping.dmp

Download
memory/5084-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5116-179-0x0000000000000000-mapping.dmp

Download
memory/5140-261-0x0000000000470000-0x000000000047F000-memory.dmp

Filesize
60KB

Download
memory/5140-271-0x0000000000000000-mapping.dmp

Download
memory/5140-258-0x0000000000000000-mapping.dmp

Download
memory/5164-318-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5164-319-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/5212-305-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5240-235-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5244-264-0x0000000000000000-mapping.dmp

Download
memory/5260-226-0x0000000000000000-mapping.dmp

Download
memory/5268-284-0x0000000000000000-mapping.dmp

Download
memory/5268-288-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5292-229-0x0000000000000000-mapping.dmp

Download
memory/5292-281-0x0000000000000000-mapping.dmp

Download
memory/5424-278-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5424-275-0x0000000000000000-mapping.dmp

Download
memory/5424-246-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5444-237-0x0000000000000000-mapping.dmp

Download
memory/5456-307-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5476-240-0x0000000000000000-mapping.dmp

Download
memory/5492-276-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5492-274-0x0000000000000000-mapping.dmp

Download
memory/5576-267-0x0000000000000000-mapping.dmp

Download
memory/5580-277-0x0000000000000000-mapping.dmp

Download
memory/5588-245-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5588-242-0x0000000000000000-mapping.dmp

Download
memory/5620-247-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5620-243-0x0000000000000000-mapping.dmp

Download
memory/5648-248-0x0000000000470000-0x000000000047F000-memory.dmp

Filesize
60KB

Download
memory/5648-244-0x0000000000000000-mapping.dmp

Download
memory/5648-269-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5648-265-0x0000000000000000-mapping.dmp

Download
memory/5700-268-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5700-266-0x0000000000000000-mapping.dmp

Download
memory/5852-251-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5852-254-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5868-249-0x0000000000000000-mapping.dmp

Download
memory/5892-250-0x0000000000000000-mapping.dmp

Download
memory/5892-295-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5892-293-0x0000000000000000-mapping.dmp

Download
memory/6000-253-0x0000000000000000-mapping.dmp

Download
memory/6056-256-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6056-279-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6056-252-0x0000000000000000-mapping.dmp

Download
memory/6056-273-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6068-317-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6068-322-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6080-255-0x0000000000000000-mapping.dmp

Download
memory/6080-259-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6112-262-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6112-270-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/6136-263-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/6136-257-0x0000000000000000-mapping.dmp

Download