Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 02:22
Behavioral task
behavioral1
Sample
b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
b9fd9883b90c1269e5a3b163c5da1ae9
-
SHA1
18abd5d200df33c96181d1fa2e956fdb357c561a
-
SHA256
0d80a74a32f6a4eabdc1deacae01089784122d99255f0b071d87dd95b59cbfea
-
SHA512
0f962023614d1f00466a00a85d7e53d36a937633efd2b4edd089cae4eedb262cf13dd8651531d788e6c87fef44d4aeaea51c403d00831aa395d279aa8dbee91a
-
SSDEEP
49152:/wddN8pT4QCOJ9TzmrJU6wucnErlH8TboegVg9Q:oV8pTswmrJRwucErt8Tbo9
Malware Config
Signatures
-
Ardamax main executable 2 IoCs
resource yara_rule behavioral1/files/0x0006000000016dbd-43.dat family_ardamax behavioral1/files/0x0006000000016de2-123.dat family_ardamax -
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\csmm.exe" Unlocker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\csmm.exe" csmm.exe -
Executes dropped EXE 64 IoCs
pid Process 688 Install.exe 2268 Unlocker.exe 2972 setup_akl.exe 2836 Install.exe 2656 setup_akl.exe 2696 ICXH.exe 2716 Unlocker.exe 2600 csmm.exe 2064 Install.exe 1692 Unlocker.exe 2724 setup_akl.exe 2940 ICXH.exe 1924 csmm.exe 3016 Unlocker.exe 3044 Install.exe 3032 setup_akl.exe 2636 ICXH.exe 1552 ICXH.exe 1764 Unlocker.exe 2644 setup_akl.exe 308 Install.exe 2120 Unlocker.exe 2200 setup_akl.exe 2764 Install.exe 2500 Unlocker.exe 2100 setup_akl.exe 860 Install.exe 580 Unlocker.exe 2140 ICXH.exe 924 Install.exe 996 setup_akl.exe 2084 ICXH.exe 2152 ICXH.exe 1472 Install.exe 2492 setup_akl.exe 104 Unlocker.exe 868 Unlocker.exe 2280 ICXH.exe 1148 ICXH.exe 2512 Install.exe 960 setup_akl.exe 2540 ICXH.exe 2688 Install.exe 2564 Unlocker.exe 2928 setup_akl.exe 1712 ICXH.exe 2756 Install.exe 1464 Unlocker.exe 2384 setup_akl.exe 3052 ICXH.exe 1724 Install.exe 1896 Unlocker.exe 2068 setup_akl.exe 2132 ICXH.exe 756 Install.exe 692 Unlocker.exe 524 setup_akl.exe 2336 ICXH.exe 2152 Install.exe 684 Unlocker.exe 3020 setup_akl.exe 1848 Install.exe 2184 setup_akl.exe 2100 ICXH.exe -
Loads dropped DLL 64 IoCs
pid Process 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 688 Install.exe 688 Install.exe 688 Install.exe 688 Install.exe 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 2972 setup_akl.exe 2972 setup_akl.exe 2972 setup_akl.exe 688 Install.exe 688 Install.exe 2972 setup_akl.exe 2972 setup_akl.exe 2972 setup_akl.exe 2972 setup_akl.exe 2656 setup_akl.exe 2656 setup_akl.exe 2656 setup_akl.exe 2836 Install.exe 2836 Install.exe 2836 Install.exe 2696 ICXH.exe 2696 ICXH.exe 2696 ICXH.exe 2268 Unlocker.exe 2268 Unlocker.exe 2716 Unlocker.exe 2716 Unlocker.exe 2716 Unlocker.exe 2836 Install.exe 2656 setup_akl.exe 2064 Install.exe 2064 Install.exe 2064 Install.exe 2656 setup_akl.exe 2064 Install.exe 2656 setup_akl.exe 1692 Unlocker.exe 1692 Unlocker.exe 1692 Unlocker.exe 2656 setup_akl.exe 2724 setup_akl.exe 2724 setup_akl.exe 2724 setup_akl.exe 2600 csmm.exe 2600 csmm.exe 2836 Install.exe 2836 Install.exe 2940 ICXH.exe 2940 ICXH.exe 2940 ICXH.exe 2724 setup_akl.exe 2724 setup_akl.exe 2724 setup_akl.exe 2724 setup_akl.exe 3016 Unlocker.exe 3016 Unlocker.exe 3016 Unlocker.exe 3044 Install.exe 3044 Install.exe 3044 Install.exe 2064 Install.exe -
resource yara_rule behavioral1/memory/1080-2-0x0000000000400000-0x0000000000606000-memory.dmp upx behavioral1/files/0x0008000000015fa5-33.dat upx behavioral1/memory/2972-41-0x0000000000BF0000-0x0000000000D7C000-memory.dmp upx behavioral1/memory/1080-38-0x0000000000400000-0x0000000000606000-memory.dmp upx behavioral1/memory/2656-121-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2200-155-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2100-171-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2492-187-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2492-200-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/996-178-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/996-189-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2644-146-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3032-141-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2724-125-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2972-68-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2972-63-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/960-221-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2384-236-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2928-243-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2068-251-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2384-250-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2068-260-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/524-267-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3020-275-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2184-284-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1488-293-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2840-300-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1840-314-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/856-318-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1156-333-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2160-339-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1112-359-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3000-376-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1008-385-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2512-395-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1212-399-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2508-413-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2632-422-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1312-436-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3044-440-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2940-454-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2700-463-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2044-479-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1840-488-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2868-505-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2492-519-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1608-525-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2056-541-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3004-542-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2856-555-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1312-559-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/2676-588-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1368-607-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3144-616-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3268-620-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3380-630-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3492-641-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3624-650-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3756-657-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3892-664-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/4016-672-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3080-676-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3160-693-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/3364-701-0x0000000000400000-0x000000000058C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICXH Agent = "C:\\Windows\\SysWOW64\\Sys32\\ICXH.exe" ICXH.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32 ICXH.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32 ICXH.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.001 Install.exe File created C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32 ICXH.exe File created C:\Windows\SysWOW64\Sys32\ICXH.006 Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\AKV.exe Install.exe File opened for modification C:\Windows\SysWOW64\Sys32\ICXH.007 Install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 2964 2716 WerFault.exe 35 1444 1764 WerFault.exe 1700 2120 WerFault.exe 2216 2500 WerFault.exe 1168 580 WerFault.exe 2292 104 WerFault.exe 71 1932 868 WerFault.exe 3048 3016 WerFault.exe 2648 1692 WerFault.exe 2956 2564 WerFault.exe 82 2636 1464 WerFault.exe 87 1660 1896 WerFault.exe 92 1744 692 WerFault.exe 97 2876 684 WerFault.exe 102 1344 1136 WerFault.exe 107 1448 2272 WerFault.exe 112 2596 1912 WerFault.exe 117 1528 2064 WerFault.exe 122 2832 1588 WerFault.exe 127 2600 1992 WerFault.exe 132 2096 2208 WerFault.exe 137 532 572 WerFault.exe 142 2872 3020 WerFault.exe 103 2184 1460 WerFault.exe 152 1740 2324 WerFault.exe 636 2836 WerFault.exe 162 960 2528 WerFault.exe 167 3008 1356 WerFault.exe 172 776 1852 WerFault.exe 177 2100 2752 WerFault.exe 182 2348 2996 WerFault.exe 186 2952 2496 WerFault.exe 192 2380 2740 WerFault.exe 2152 2128 WerFault.exe 1352 2508 WerFault.exe 207 2660 2428 WerFault.exe 211 2328 2664 WerFault.exe 217 3056 2028 WerFault.exe 222 892 2640 WerFault.exe 1868 2180 WerFault.exe 232 3064 2032 WerFault.exe 237 2584 308 WerFault.exe 242 2572 2076 WerFault.exe 221 2092 2668 WerFault.exe 252 2336 3036 WerFault.exe 257 2884 1648 WerFault.exe 262 2492 2728 WerFault.exe 266 992 2948 WerFault.exe 272 2512 760 WerFault.exe 277 3152 3120 WerFault.exe 282 3300 3260 WerFault.exe 287 3388 3368 WerFault.exe 292 3512 3484 WerFault.exe 3632 3592 WerFault.exe 3780 3740 WerFault.exe 307 3900 3868 WerFault.exe 312 4044 4008 WerFault.exe 317 2676 2068 WerFault.exe 322 3104 1368 WerFault.exe 326 3480 3272 WerFault.exe 332 3572 3524 WerFault.exe 337 3736 3692 WerFault.exe 342 3888 3796 WerFault.exe 347 4000 3940 WerFault.exe 352 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlocker.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: 33 2696 ICXH.exe Token: SeIncBasePriorityPrivilege 2696 ICXH.exe Token: 33 2280 ICXH.exe Token: SeIncBasePriorityPrivilege 2280 ICXH.exe Token: 33 1712 ICXH.exe Token: SeIncBasePriorityPrivilege 1712 ICXH.exe Token: 33 2336 ICXH.exe Token: SeIncBasePriorityPrivilege 2336 ICXH.exe Token: 33 2252 ICXH.exe Token: SeIncBasePriorityPrivilege 2252 ICXH.exe Token: 33 2044 ICXH.exe Token: SeIncBasePriorityPrivilege 2044 ICXH.exe Token: 33 2904 ICXH.exe Token: SeIncBasePriorityPrivilege 2904 ICXH.exe Token: 33 476 ICXH.exe Token: SeIncBasePriorityPrivilege 476 ICXH.exe Token: 33 1568 ICXH.exe Token: SeIncBasePriorityPrivilege 1568 ICXH.exe Token: 33 280 ICXH.exe Token: SeIncBasePriorityPrivilege 280 ICXH.exe Token: 33 2312 ICXH.exe Token: SeIncBasePriorityPrivilege 2312 ICXH.exe Token: 33 884 ICXH.exe Token: SeIncBasePriorityPrivilege 884 ICXH.exe Token: 33 1920 ICXH.exe Token: SeIncBasePriorityPrivilege 1920 ICXH.exe Token: 33 3184 ICXH.exe Token: SeIncBasePriorityPrivilege 3184 ICXH.exe Token: 33 3556 ICXH.exe Token: SeIncBasePriorityPrivilege 3556 ICXH.exe Token: 33 3812 ICXH.exe Token: SeIncBasePriorityPrivilege 3812 ICXH.exe Token: 33 3380 ICXH.exe Token: SeIncBasePriorityPrivilege 3380 ICXH.exe Token: 33 3928 ICXH.exe Token: SeIncBasePriorityPrivilege 3928 ICXH.exe Token: 33 3468 ICXH.exe Token: SeIncBasePriorityPrivilege 3468 ICXH.exe Token: 33 3776 ICXH.exe Token: SeIncBasePriorityPrivilege 3776 ICXH.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2268 Unlocker.exe 2600 csmm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2268 Unlocker.exe 2600 csmm.exe 1924 csmm.exe 2696 ICXH.exe 2696 ICXH.exe 2696 ICXH.exe 2696 ICXH.exe 2696 ICXH.exe 2280 ICXH.exe 2280 ICXH.exe 2280 ICXH.exe 2280 ICXH.exe 2280 ICXH.exe 1712 ICXH.exe 1712 ICXH.exe 1712 ICXH.exe 1712 ICXH.exe 1712 ICXH.exe 2336 ICXH.exe 2336 ICXH.exe 2336 ICXH.exe 2336 ICXH.exe 2336 ICXH.exe 2252 ICXH.exe 2252 ICXH.exe 2252 ICXH.exe 2252 ICXH.exe 2252 ICXH.exe 2352 ICXH.exe 2352 ICXH.exe 2044 ICXH.exe 2044 ICXH.exe 2044 ICXH.exe 2044 ICXH.exe 2044 ICXH.exe 2904 ICXH.exe 2904 ICXH.exe 2904 ICXH.exe 2904 ICXH.exe 2904 ICXH.exe 476 ICXH.exe 476 ICXH.exe 476 ICXH.exe 476 ICXH.exe 476 ICXH.exe 1568 ICXH.exe 1568 ICXH.exe 1568 ICXH.exe 1568 ICXH.exe 1568 ICXH.exe 280 ICXH.exe 280 ICXH.exe 280 ICXH.exe 280 ICXH.exe 280 ICXH.exe 2076 ICXH.exe 2076 ICXH.exe 2312 ICXH.exe 2312 ICXH.exe 2312 ICXH.exe 2312 ICXH.exe 2312 ICXH.exe 2728 ICXH.exe 2728 ICXH.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 688 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 30 PID 1080 wrote to memory of 2268 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 31 PID 1080 wrote to memory of 2268 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 31 PID 1080 wrote to memory of 2268 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 31 PID 1080 wrote to memory of 2268 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 31 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 1080 wrote to memory of 2972 1080 b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe 32 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 688 wrote to memory of 2696 688 Install.exe 33 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2836 2972 setup_akl.exe 162 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2716 2972 setup_akl.exe 35 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2972 wrote to memory of 2656 2972 setup_akl.exe 36 PID 2268 wrote to memory of 2600 2268 Unlocker.exe 134 PID 2268 wrote to memory of 2600 2268 Unlocker.exe 134 PID 2268 wrote to memory of 2600 2268 Unlocker.exe 134 PID 2268 wrote to memory of 2600 2268 Unlocker.exe 134 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 2064 2656 setup_akl.exe 122 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39 PID 2656 wrote to memory of 1692 2656 setup_akl.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9fd9883b90c1269e5a3b163c5da1ae9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\csmm.exeC:\Windows\system32\csmm.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Windows\SysWOW64\csmm.exeC:\Windows\system32\csmm.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2764⤵
- Program crash
PID:2964
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"5⤵
- Executes dropped EXE
PID:2636
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2765⤵
- Program crash
PID:2648
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"6⤵
- Executes dropped EXE
PID:1552
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2766⤵
- Program crash
PID:3048
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"5⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"6⤵
- Executes dropped EXE
PID:308 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"7⤵
- Executes dropped EXE
PID:2084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"6⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 2767⤵
- Program crash
PID:1444
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"6⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"7⤵
- Executes dropped EXE
PID:2764 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"8⤵
- Executes dropped EXE
PID:2140
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"7⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 2768⤵
- Program crash
PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"8⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"9⤵
- Executes dropped EXE
PID:2152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"8⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 2769⤵
- Program crash
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"8⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"9⤵
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"10⤵
- Executes dropped EXE
PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"9⤵
- Executes dropped EXE
PID:580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 27610⤵
- Program crash
PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"9⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"10⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"10⤵
- Executes dropped EXE
PID:104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 104 -s 27611⤵
- Program crash
PID:2292
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"10⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"12⤵
- Executes dropped EXE
PID:2540
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"11⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 27612⤵
- Program crash
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"13⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"12⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 27613⤵
- Program crash
PID:2956
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"12⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2756 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 27614⤵
- Program crash
PID:2636
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"13⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1724 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"14⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 27615⤵
- Program crash
PID:1660
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"14⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"15⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"16⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 27616⤵
- Program crash
PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"15⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"16⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"17⤵
- Executes dropped EXE
PID:2100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 27617⤵
- Program crash
PID:2876
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"18⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"17⤵PID:1136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 27618⤵
- Program crash
PID:1344
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"17⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"18⤵PID:560
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"19⤵PID:1576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"18⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 27619⤵
- Program crash
PID:1448
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"18⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"19⤵
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"20⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"19⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 27620⤵
- Program crash
PID:2596
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"19⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"20⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"21⤵PID:2496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"20⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 27621⤵
- Program crash
PID:1528
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"20⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"21⤵
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"22⤵PID:2572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"21⤵PID:1588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 27622⤵
- Program crash
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"21⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"22⤵
- Drops file in System32 directory
PID:1356 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"23⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"22⤵PID:1992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 27623⤵
- Program crash
PID:2600
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"22⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"23⤵PID:1852
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"24⤵PID:280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"23⤵PID:2208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 27624⤵
- Program crash
PID:2096
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"23⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"24⤵PID:2172
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"25⤵PID:524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"24⤵PID:572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 27625⤵
- Program crash
PID:532
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"24⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"25⤵PID:2696
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"26⤵PID:2736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"25⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 27626⤵
- Program crash
PID:2872
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"25⤵
- System Location Discovery: System Language Discovery
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"26⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"27⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"26⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 27627⤵
- Program crash
PID:2184
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"26⤵
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"27⤵
- Drops file in System32 directory
PID:2000 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"28⤵PID:588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"27⤵PID:2324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 27628⤵
- Program crash
PID:1740
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"27⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"28⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"29⤵PID:2776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"28⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 27629⤵
- Program crash
PID:636
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"28⤵
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"29⤵PID:2828
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"30⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:476
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"29⤵PID:2528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 27630⤵
- Program crash
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"29⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"30⤵
- Drops file in System32 directory
PID:2708 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"31⤵PID:1332
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"30⤵PID:1356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 27631⤵
- Program crash
PID:3008
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"30⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"31⤵
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"32⤵PID:3036
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"31⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 27632⤵
- Program crash
PID:776
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"31⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"32⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"33⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"32⤵PID:2752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 27633⤵
- Program crash
PID:2100
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"32⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"33⤵PID:1476
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"34⤵PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"33⤵PID:2996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 27634⤵
- Program crash
PID:2348
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"33⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"34⤵
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"35⤵PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"34⤵PID:2496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 27635⤵
- Program crash
PID:2952
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"34⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"35⤵PID:2828
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"36⤵
- System Location Discovery: System Language Discovery
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"35⤵PID:2740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 27636⤵
- Program crash
PID:2380
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"35⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"36⤵PID:2868
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"37⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"36⤵PID:2128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 27637⤵
- Program crash
PID:2152
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"36⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"37⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"38⤵PID:3000
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"37⤵PID:2508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 27638⤵
- Program crash
PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"37⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"38⤵
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"39⤵PID:924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"38⤵PID:2428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 27639⤵
- Program crash
PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"38⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"39⤵PID:2684
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"40⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"39⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 27640⤵
- Program crash
PID:2328
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"39⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"40⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"41⤵PID:2068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"40⤵PID:2028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 27641⤵
- Program crash
PID:3056
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"40⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"41⤵
- Drops file in System32 directory
PID:1648 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"42⤵PID:2936
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"41⤵PID:2640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 27642⤵
- Program crash
PID:892
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"41⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"42⤵
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"43⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"42⤵PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 27643⤵
- Program crash
PID:1868
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"42⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"43⤵
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"44⤵PID:2336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"43⤵PID:2032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 27644⤵
- Program crash
PID:3064
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"43⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"44⤵
- Drops file in System32 directory
PID:852 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"45⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"44⤵PID:308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 27645⤵
- Program crash
PID:2584
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"44⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"45⤵
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"46⤵PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"45⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 27646⤵
- Program crash
PID:2572
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"45⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"46⤵
- Drops file in System32 directory
PID:1712 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"47⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"46⤵PID:2668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 27647⤵
- Program crash
PID:2092
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"46⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"47⤵
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"48⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"47⤵PID:3036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 27648⤵
- Program crash
PID:2336
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"47⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"48⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"49⤵PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"48⤵PID:1648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 27649⤵
- Program crash
PID:2884
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"48⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"49⤵
- Drops file in System32 directory
PID:1696 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"50⤵PID:2512
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"49⤵PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 27650⤵
- Program crash
PID:2492
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"49⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"50⤵
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"51⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"50⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 27651⤵
- Program crash
PID:992
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"50⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"51⤵
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"52⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"51⤵PID:760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 27652⤵
- Program crash
PID:2512
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"51⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"52⤵
- Drops file in System32 directory
PID:3100 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"53⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"52⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 27653⤵
- Program crash
PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"52⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"53⤵
- Drops file in System32 directory
PID:3244 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"54⤵PID:3316
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"53⤵PID:3260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 27654⤵
- Program crash
PID:3300
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"53⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"54⤵
- Drops file in System32 directory
PID:3360 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"55⤵PID:3448
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"54⤵PID:3368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 27655⤵
- Program crash
PID:3388
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"54⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"55⤵PID:3472
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"56⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"55⤵PID:3484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 27656⤵
- Program crash
PID:3512
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"55⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"56⤵
- Drops file in System32 directory
PID:3584 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"57⤵PID:3656
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"56⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 27657⤵
- Program crash
PID:3632
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"56⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"57⤵PID:3720
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"58⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"57⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 27658⤵
- Program crash
PID:3780
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"57⤵
- System Location Discovery: System Language Discovery
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"58⤵PID:3844
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"59⤵PID:3952
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"58⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 27659⤵
- Program crash
PID:3900
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"58⤵
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"59⤵
- Drops file in System32 directory
PID:3988 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"60⤵
- Adds Run key to start application
PID:4088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"59⤵PID:4008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 27660⤵
- Program crash
PID:4044
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"59⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"60⤵
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"61⤵PID:3340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"60⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 27661⤵
- Program crash
PID:2676
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"60⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"61⤵PID:3096
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"62⤵PID:3144
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"61⤵PID:1368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 27662⤵
- Program crash
PID:3104
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"61⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"62⤵
- Drops file in System32 directory
PID:3356 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"63⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"62⤵PID:3272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 27663⤵
- Program crash
PID:3480
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"62⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"63⤵
- Drops file in System32 directory
PID:3188 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"64⤵PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"63⤵PID:3524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 27664⤵
- Program crash
PID:3572
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"63⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"64⤵PID:3672
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"65⤵PID:3768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"64⤵PID:3692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 27665⤵
- Program crash
PID:3736
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"64⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"65⤵
- Drops file in System32 directory
PID:3664 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"66⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"65⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 27666⤵
- Program crash
PID:3888
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"65⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"66⤵PID:3964
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"67⤵PID:4060
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"66⤵PID:3940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 27667⤵
- Program crash
PID:4000
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"66⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"67⤵
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"68⤵PID:3144
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"67⤵PID:3080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 27668⤵PID:3376
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"67⤵
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"68⤵
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"69⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"68⤵PID:3148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 27669⤵PID:3320
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"68⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"69⤵PID:3184
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"70⤵
- System Location Discovery: System Language Discovery
PID:3660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"69⤵PID:3612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 27670⤵PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"69⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"70⤵PID:3644
-
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"71⤵PID:3380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"70⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 27671⤵PID:3496
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"70⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"71⤵
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"72⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"71⤵PID:3556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 27672⤵PID:3964
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"71⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"72⤵
- Drops file in System32 directory
PID:4068 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"73⤵PID:3244
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"72⤵PID:4056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 27673⤵PID:3208
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"72⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"73⤵
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"74⤵PID:3296
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"73⤵PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 27674⤵PID:3532
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"73⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"74⤵
- Drops file in System32 directory
PID:3384 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"75⤵
- Adds Run key to start application
PID:3760
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"74⤵
- System Location Discovery: System Language Discovery
PID:3752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 27675⤵PID:3560
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"74⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"75⤵
- Drops file in System32 directory
PID:3360 -
C:\Windows\SysWOW64\Sys32\ICXH.exe"C:\Windows\system32\Sys32\ICXH.exe"76⤵PID:2736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"75⤵PID:3976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 27676⤵PID:3924
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"75⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"76⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"76⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 27677⤵PID:4024
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"76⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"77⤵PID:3316
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"77⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 27678⤵PID:3404
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"77⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"78⤵PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"78⤵PID:3452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 27679⤵PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"78⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"79⤵PID:3656
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"79⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 27680⤵PID:3308
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"79⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"80⤵PID:3756
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"80⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 27681⤵PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"80⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"81⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"81⤵PID:3916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 27682⤵PID:3852
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"81⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"82⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"82⤵PID:3196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 27683⤵PID:3312
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"82⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"83⤵PID:3456
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"83⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 27684⤵PID:3800
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"83⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"84⤵PID:3504
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"84⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 27685⤵PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"84⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"85⤵PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"85⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 27686⤵PID:3748
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"85⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"86⤵
- System Location Discovery: System Language Discovery
PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"86⤵PID:3408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 27687⤵PID:3244
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"86⤵
- System Location Discovery: System Language Discovery
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"87⤵PID:3564
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"87⤵PID:4104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 27688⤵PID:4164
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"87⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"88⤵PID:4176
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"88⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 27689⤵PID:4220
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"88⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"89⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"89⤵PID:4260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 27690⤵PID:4296
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"89⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"90⤵PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"90⤵
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 27691⤵PID:4388
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"90⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"91⤵PID:4408
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"91⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 27692⤵PID:4452
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"91⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"92⤵PID:4468
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"92⤵PID:4476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 27693⤵PID:4512
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"92⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"93⤵PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"93⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 27694⤵PID:4584
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"93⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"94⤵PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"94⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 27695⤵PID:4668
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"94⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"95⤵PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"95⤵PID:4712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 27696⤵PID:4736
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"95⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"96⤵
- System Location Discovery: System Language Discovery
PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"96⤵PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 27697⤵PID:4848
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"96⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"97⤵PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"97⤵PID:4876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 27698⤵PID:4912
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"97⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"98⤵PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"98⤵PID:4944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 27699⤵PID:4968
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"98⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"99⤵PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"99⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 276100⤵PID:5052
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"100⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"100⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 276101⤵PID:5112
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"100⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"101⤵PID:4112
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"101⤵PID:1200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 276102⤵PID:4212
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"101⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"102⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"102⤵PID:4288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 276103⤵PID:4436
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"102⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"103⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"103⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 276104⤵PID:4496
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"103⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"104⤵PID:4424
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"104⤵PID:4596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 276105⤵PID:4520
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"104⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"105⤵
- System Location Discovery: System Language Discovery
PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"105⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 276106⤵PID:4728
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"105⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"106⤵PID:4676
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"106⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 276107⤵PID:4844
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"106⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"107⤵PID:4964
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"107⤵PID:4888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 276108⤵PID:4956
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"107⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"108⤵PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"108⤵PID:5060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 276109⤵PID:4124
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"108⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"109⤵PID:4324
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"109⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 276110⤵PID:4368
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"109⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"110⤵PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"110⤵PID:4508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 276111⤵PID:4836
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"110⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"111⤵
- System Location Discovery: System Language Discovery
PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"111⤵PID:4564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 276112⤵PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"111⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"112⤵PID:4208
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"112⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 276113⤵PID:4592
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"112⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"113⤵
- System Location Discovery: System Language Discovery
PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"113⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 276114⤵PID:4832
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"113⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"114⤵PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"114⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 276115⤵PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"114⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"115⤵PID:5132
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"115⤵PID:5144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 276116⤵PID:5164
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"115⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"116⤵PID:5200
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"116⤵
- System Location Discovery: System Language Discovery
PID:5212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 276117⤵PID:5256
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"116⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"117⤵PID:5276
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"117⤵PID:5284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 276118⤵PID:5328
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"117⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"118⤵
- System Location Discovery: System Language Discovery
PID:5340
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"118⤵PID:5352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 276119⤵PID:5384
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"118⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"119⤵PID:5416
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"119⤵PID:5424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 276120⤵PID:5460
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"119⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"120⤵PID:5476
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"120⤵PID:5488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 276121⤵PID:5524
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"120⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"121⤵PID:5548
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"121⤵PID:5556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 276122⤵PID:5592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-