Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2115abb3b850a690a74ea252deaa710a.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2115abb3b850a690a74ea252deaa710a.exe
-
Size
622KB
-
MD5
2115abb3b850a690a74ea252deaa710a
-
SHA1
8e42491122339c022ee5c6cac17e547bfabd4e2a
-
SHA256
bb2a56b2d08dfd580aa7918d7f1f844959bee7f3b868488c5e2e932c9885ec32
-
SHA512
46e7f52f903591edad5d346312581a4d241c2fa8c2ae0760a2f469946f699475ef6956be71aba55659226d93a48574b59d19760412c2d32590e3a826d9c5757c
-
SSDEEP
12288:iFQXX1C7b94xV/sJI7nD68b618g6ggEfzDehxTjUZW2H82h:CIOsRnDg
Malware Config
Extracted
Family
redline
Botnet
NORMAN2
C2
45.14.49.184:27587
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/564-5-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/564-5-0x0000000000400000-0x0000000000422000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 39 IoCs
description pid Process procid_target PID 2908 set thread context of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 set thread context of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 set thread context of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 set thread context of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 set thread context of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 set thread context of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 set thread context of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 set thread context of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111 PID 2908 set thread context of 1144 2908 2115abb3b850a690a74ea252deaa710a.exe 112 PID 2908 set thread context of 3108 2908 2115abb3b850a690a74ea252deaa710a.exe 114 PID 2908 set thread context of 3280 2908 2115abb3b850a690a74ea252deaa710a.exe 115 PID 2908 set thread context of 3952 2908 2115abb3b850a690a74ea252deaa710a.exe 117 PID 2908 set thread context of 4768 2908 2115abb3b850a690a74ea252deaa710a.exe 120 PID 2908 set thread context of 4564 2908 2115abb3b850a690a74ea252deaa710a.exe 121 PID 2908 set thread context of 820 2908 2115abb3b850a690a74ea252deaa710a.exe 122 PID 2908 set thread context of 2448 2908 2115abb3b850a690a74ea252deaa710a.exe 123 PID 2908 set thread context of 4348 2908 2115abb3b850a690a74ea252deaa710a.exe 127 PID 2908 set thread context of 2424 2908 2115abb3b850a690a74ea252deaa710a.exe 128 PID 2908 set thread context of 3904 2908 2115abb3b850a690a74ea252deaa710a.exe 133 PID 2908 set thread context of 1340 2908 2115abb3b850a690a74ea252deaa710a.exe 134 PID 2908 set thread context of 3084 2908 2115abb3b850a690a74ea252deaa710a.exe 135 PID 2908 set thread context of 2368 2908 2115abb3b850a690a74ea252deaa710a.exe 136 PID 2908 set thread context of 1124 2908 2115abb3b850a690a74ea252deaa710a.exe 138 PID 2908 set thread context of 3404 2908 2115abb3b850a690a74ea252deaa710a.exe 139 PID 2908 set thread context of 2956 2908 2115abb3b850a690a74ea252deaa710a.exe 140 PID 2908 set thread context of 4888 2908 2115abb3b850a690a74ea252deaa710a.exe 141 PID 2908 set thread context of 4032 2908 2115abb3b850a690a74ea252deaa710a.exe 142 PID 2908 set thread context of 2840 2908 2115abb3b850a690a74ea252deaa710a.exe 145 PID 2908 set thread context of 2360 2908 2115abb3b850a690a74ea252deaa710a.exe 146 PID 2908 set thread context of 4584 2908 2115abb3b850a690a74ea252deaa710a.exe 147 PID 2908 set thread context of 5024 2908 2115abb3b850a690a74ea252deaa710a.exe 148 PID 2908 set thread context of 4892 2908 2115abb3b850a690a74ea252deaa710a.exe 149 PID 2908 set thread context of 4852 2908 2115abb3b850a690a74ea252deaa710a.exe 150 PID 2908 set thread context of 1020 2908 2115abb3b850a690a74ea252deaa710a.exe 151 PID 2908 set thread context of 1192 2908 2115abb3b850a690a74ea252deaa710a.exe 152 PID 2908 set thread context of 456 2908 2115abb3b850a690a74ea252deaa710a.exe 153 PID 2908 set thread context of 5240 2908 2115abb3b850a690a74ea252deaa710a.exe 154 PID 2908 set thread context of 5352 2908 2115abb3b850a690a74ea252deaa710a.exe 155 PID 2908 set thread context of 5848 2908 2115abb3b850a690a74ea252deaa710a.exe 162 -
Program crash 2 IoCs
pid pid_target Process procid_target 5024 2776 WerFault.exe 104 3168 4348 WerFault.exe 127 -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2776 2115abb3b850a690a74ea252deaa710a.exe 4348 2115abb3b850a690a74ea252deaa710a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 564 2908 2115abb3b850a690a74ea252deaa710a.exe 92 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 5060 2908 2115abb3b850a690a74ea252deaa710a.exe 94 PID 2908 wrote to memory of 3972 2908 2115abb3b850a690a74ea252deaa710a.exe 99 PID 2908 wrote to memory of 3972 2908 2115abb3b850a690a74ea252deaa710a.exe 99 PID 2908 wrote to memory of 3972 2908 2115abb3b850a690a74ea252deaa710a.exe 99 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2236 2908 2115abb3b850a690a74ea252deaa710a.exe 101 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 2776 2908 2115abb3b850a690a74ea252deaa710a.exe 104 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 3708 2908 2115abb3b850a690a74ea252deaa710a.exe 105 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4488 2908 2115abb3b850a690a74ea252deaa710a.exe 109 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 4432 2908 2115abb3b850a690a74ea252deaa710a.exe 110 PID 2908 wrote to memory of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111 PID 2908 wrote to memory of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111 PID 2908 wrote to memory of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111 PID 2908 wrote to memory of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111 PID 2908 wrote to memory of 3248 2908 2115abb3b850a690a74ea252deaa710a.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe"C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:564
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵
- Suspicious use of UnmapMainImage
PID:2776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 123⤵
- Program crash
PID:5024
-
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3280
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵
- Suspicious use of UnmapMainImage
PID:4348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 123⤵
- Program crash
PID:3168
-
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4912
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3904
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4032
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:2360
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4892
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:456
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5352
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5436
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5848
-
-
C:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exeC:\Users\Admin\AppData\Local\Temp\2115abb3b850a690a74ea252deaa710a.exe2⤵PID:5980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2776 -ip 27761⤵PID:3840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4348 -ip 43481⤵PID:2960