Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/08/2024, 02:22
General
-
Target
b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
b9fd9883b90c1269e5a3b163c5da1ae9
-
SHA1
18abd5d200df33c96181d1fa2e956fdb357c561a
-
SHA256
0d80a74a32f6a4eabdc1deacae01089784122d99255f0b071d87dd95b59cbfea
-
SHA512
0f962023614d1f00466a00a85d7e53d36a937633efd2b4edd089cae4eedb262cf13dd8651531d788e6c87fef44d4aeaea51c403d00831aa395d279aa8dbee91a
-
SSDEEP
49152:/wddN8pT4QCOJ9TzmrJU6wucnErlH8TboegVg9Q:oV8pTswmrJRwucErt8Tbo9
Score
10/10
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 2 IoCs
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 25 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\csmm.exeC:\Windows\system32\csmm.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\csmm.exeC:\Windows\system32\csmm.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2764⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2765⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2766⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 2767⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 2768⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"9⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 2769⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"10⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 27610⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 104 -s 27611⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"12⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 27612⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"13⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 27613⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 27614⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 27615⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"16⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 27616⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"17⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 27617⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"18⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"17⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 27618⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"18⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"18⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 27619⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"19⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"20⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"19⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 27620⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"20⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"20⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 27621⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"21⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"21⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 27622⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"22⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"23⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"22⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 27623⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"23⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"23⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 27624⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"24⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"24⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 27625⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"25⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"25⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 27626⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"25⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"26⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"27⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"26⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 27627⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"26⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"27⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"27⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 27628⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"28⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"28⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 27629⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"28⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"29⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"30⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"29⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 27630⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"30⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"30⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 27631⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"31⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"32⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"31⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 27632⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"32⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"33⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"32⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 27633⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"33⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"33⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 27634⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"34⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"34⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 27635⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"35⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"35⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 27636⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"36⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"37⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"36⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 27637⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"37⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"37⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 27638⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"38⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 27639⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"39⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"40⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 27640⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"40⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"40⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 27641⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"41⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"41⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 27642⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"42⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"43⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"42⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 27643⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"43⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"44⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"43⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 27644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"44⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"45⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"44⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 27645⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"45⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 27646⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"46⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"47⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"46⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 27647⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"47⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"48⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"47⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 27648⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"47⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"48⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"48⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 27649⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"49⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"50⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"49⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 27650⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"50⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"51⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"50⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 27651⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"51⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"52⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"51⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 27652⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"52⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"53⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"52⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 27653⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"53⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"53⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 27654⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"54⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"54⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 27655⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"55⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"56⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"55⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 27656⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"56⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"56⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 27657⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"57⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"58⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"57⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 27658⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"57⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"58⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"58⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 27659⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"58⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"59⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"60⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"59⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 27660⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"59⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"60⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"60⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 27661⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"61⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"61⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 27662⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"62⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"63⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"62⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 27663⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"63⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"63⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 27664⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"64⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"64⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 27665⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"65⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"66⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"65⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 27666⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"66⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"66⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 27667⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"67⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"67⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 27668⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"67⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"68⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"69⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"68⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 27669⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"69⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"70⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"69⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 27670⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"69⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"70⤵
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"70⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 27671⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"71⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"72⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"71⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 27672⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"72⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"72⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 27673⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"73⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"73⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 27674⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"74⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"75⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"74⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 27675⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"75⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"75⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 27676⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"76⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"76⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 27677⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"77⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"77⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 27678⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"78⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"78⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 27679⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"79⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"79⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 27680⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"80⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 27681⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"81⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 27682⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"82⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 27683⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"83⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 27684⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"84⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"84⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 27685⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"85⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 27686⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"86⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"86⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 27687⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"86⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"87⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 27688⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"88⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 27689⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"89⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"89⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 27690⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"90⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 27691⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"91⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 27692⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"92⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 27693⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"93⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 27694⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"94⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"94⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 27695⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"95⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"95⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 27696⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"96⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"96⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 27697⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"97⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 27698⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"98⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 27699⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"99⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 276100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"100⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"100⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 276101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"101⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 276102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"102⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"102⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 276103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"103⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 276104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"104⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"104⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 276105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"104⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"105⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"105⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 276106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"106⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 276107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"107⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 276108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"107⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"108⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"108⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 276109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"109⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 276110⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"110⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"110⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 276111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"111⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"111⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 276112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"112⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"112⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 276113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"113⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"113⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 276114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"113⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"114⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 276115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"115⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 276116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"116⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 276117⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"117⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 276118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"118⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"118⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 276119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"119⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 276120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"120⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"120⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 276121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-