7f7ec27fa019564213fa1e506b17c451f298c7b6a09ba614a6a92a81bcb2a0f3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

323397f3967b998c748e0111ec1b6780N.exe
Size

1.2MB
MD5

323397f3967b998c748e0111ec1b6780
SHA1

6bcdff206537eed61e8182bd5a2654b650be9e6f
SHA256

7f7ec27fa019564213fa1e506b17c451f298c7b6a09ba614a6a92a81bcb2a0f3
SHA512

5d221597c633bce724d0da9dc7e30d66672b0c8ad421c7affd32b01265152d3d0b11a33bf73a31dd5cfd11f75a15fa577455cffd1726e764846d66478a484430
SSDEEP

24576:aAHnh+eWsN3skA4RV1Hom2KXMmHagb4KCfAnCdy6K5z5:th+ZkldoPK8Yagb4KMDdMb

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silvexes.vbs	silvexes.exe

Executes dropped EXE 64 IoCs

pid	Process
2016	silvexes.exe
2684	silvexes.exe
2956	silvexes.exe
2580	silvexes.exe
2592	silvexes.exe
292	silvexes.exe
1032	silvexes.exe
2728	silvexes.exe
2776	silvexes.exe
2872	silvexes.exe
1136	silvexes.exe
2892	silvexes.exe
2116	silvexes.exe
1088	silvexes.exe
964	silvexes.exe
2052	silvexes.exe
2976	silvexes.exe
1680	silvexes.exe
560	silvexes.exe
2304	silvexes.exe
1272	silvexes.exe
1616	silvexes.exe
2516	silvexes.exe
2128	silvexes.exe
2804	silvexes.exe
2676	silvexes.exe
2856	silvexes.exe
2540	silvexes.exe
2596	silvexes.exe
1708	silvexes.exe
2368	silvexes.exe
876	silvexes.exe
1500	silvexes.exe
1460	silvexes.exe
2228	silvexes.exe
2260	silvexes.exe
3040	silvexes.exe
1960	silvexes.exe
712	silvexes.exe
1748	silvexes.exe
1980	silvexes.exe
892	silvexes.exe
3004	silvexes.exe
1852	silvexes.exe
1828	silvexes.exe
1580	silvexes.exe
592	silvexes.exe
2416	silvexes.exe
2192	silvexes.exe
2952	silvexes.exe
2680	silvexes.exe
2620	silvexes.exe
2588	silvexes.exe
1508	silvexes.exe
1184	silvexes.exe
1648	silvexes.exe
3036	silvexes.exe
2392	silvexes.exe
2088	silvexes.exe
1484	silvexes.exe
600	silvexes.exe
1516	silvexes.exe
1348	silvexes.exe
3020	silvexes.exe

Loads dropped DLL 1 IoCs

pid	Process
784	323397f3967b998c748e0111ec1b6780N.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000019080-13.dat	autoit_exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	323397f3967b998c748e0111ec1b6780N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silvexes.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
784	323397f3967b998c748e0111ec1b6780N.exe
784	323397f3967b998c748e0111ec1b6780N.exe
2016	silvexes.exe
2016	silvexes.exe
2684	silvexes.exe
2684	silvexes.exe
2956	silvexes.exe
2956	silvexes.exe
2580	silvexes.exe
2580	silvexes.exe
2592	silvexes.exe
2592	silvexes.exe
292	silvexes.exe
292	silvexes.exe
1032	silvexes.exe
1032	silvexes.exe
2728	silvexes.exe
2728	silvexes.exe
2776	silvexes.exe
2776	silvexes.exe
2872	silvexes.exe
2872	silvexes.exe
1136	silvexes.exe
1136	silvexes.exe
2892	silvexes.exe
2892	silvexes.exe
2116	silvexes.exe
2116	silvexes.exe
1088	silvexes.exe
1088	silvexes.exe
964	silvexes.exe
964	silvexes.exe
2052	silvexes.exe
2052	silvexes.exe
2976	silvexes.exe
2976	silvexes.exe
1680	silvexes.exe
1680	silvexes.exe
560	silvexes.exe
560	silvexes.exe
2304	silvexes.exe
2304	silvexes.exe
1272	silvexes.exe
1272	silvexes.exe
1616	silvexes.exe
1616	silvexes.exe
2516	silvexes.exe
2516	silvexes.exe
2128	silvexes.exe
2128	silvexes.exe
2804	silvexes.exe
2804	silvexes.exe
2676	silvexes.exe
2676	silvexes.exe
2856	silvexes.exe
2856	silvexes.exe
2540	silvexes.exe
2540	silvexes.exe
2596	silvexes.exe
2596	silvexes.exe
1708	silvexes.exe
1708	silvexes.exe
2368	silvexes.exe
2368	silvexes.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
784	323397f3967b998c748e0111ec1b6780N.exe
784	323397f3967b998c748e0111ec1b6780N.exe
2016	silvexes.exe
2016	silvexes.exe
2684	silvexes.exe
2684	silvexes.exe
2956	silvexes.exe
2956	silvexes.exe
2580	silvexes.exe
2580	silvexes.exe
2592	silvexes.exe
2592	silvexes.exe
292	silvexes.exe
292	silvexes.exe
1032	silvexes.exe
1032	silvexes.exe
2728	silvexes.exe
2728	silvexes.exe
2776	silvexes.exe
2776	silvexes.exe
2872	silvexes.exe
2872	silvexes.exe
1136	silvexes.exe
1136	silvexes.exe
2892	silvexes.exe
2892	silvexes.exe
2116	silvexes.exe
2116	silvexes.exe
1088	silvexes.exe
1088	silvexes.exe
964	silvexes.exe
964	silvexes.exe
2052	silvexes.exe
2052	silvexes.exe
2976	silvexes.exe
2976	silvexes.exe
1680	silvexes.exe
1680	silvexes.exe
560	silvexes.exe
560	silvexes.exe
2304	silvexes.exe
2304	silvexes.exe
1272	silvexes.exe
1272	silvexes.exe
1616	silvexes.exe
1616	silvexes.exe
2516	silvexes.exe
2516	silvexes.exe
2128	silvexes.exe
2128	silvexes.exe
2804	silvexes.exe
2804	silvexes.exe
2676	silvexes.exe
2676	silvexes.exe
2856	silvexes.exe
2856	silvexes.exe
2540	silvexes.exe
2540	silvexes.exe
2596	silvexes.exe
2596	silvexes.exe
1708	silvexes.exe
1708	silvexes.exe
2368	silvexes.exe
2368	silvexes.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2016	784	323397f3967b998c748e0111ec1b6780N.exe	31
PID 784 wrote to memory of 2016	784	323397f3967b998c748e0111ec1b6780N.exe	31
PID 784 wrote to memory of 2016	784	323397f3967b998c748e0111ec1b6780N.exe	31
PID 784 wrote to memory of 2016	784	323397f3967b998c748e0111ec1b6780N.exe	31
PID 2016 wrote to memory of 2684	2016	silvexes.exe	32
PID 2016 wrote to memory of 2684	2016	silvexes.exe	32
PID 2016 wrote to memory of 2684	2016	silvexes.exe	32
PID 2016 wrote to memory of 2684	2016	silvexes.exe	32
PID 2684 wrote to memory of 2956	2684	silvexes.exe	33
PID 2684 wrote to memory of 2956	2684	silvexes.exe	33
PID 2684 wrote to memory of 2956	2684	silvexes.exe	33
PID 2684 wrote to memory of 2956	2684	silvexes.exe	33
PID 2956 wrote to memory of 2580	2956	silvexes.exe	34
PID 2956 wrote to memory of 2580	2956	silvexes.exe	34
PID 2956 wrote to memory of 2580	2956	silvexes.exe	34
PID 2956 wrote to memory of 2580	2956	silvexes.exe	34
PID 2580 wrote to memory of 2592	2580	silvexes.exe	35
PID 2580 wrote to memory of 2592	2580	silvexes.exe	35
PID 2580 wrote to memory of 2592	2580	silvexes.exe	35
PID 2580 wrote to memory of 2592	2580	silvexes.exe	35
PID 2592 wrote to memory of 292	2592	silvexes.exe	36
PID 2592 wrote to memory of 292	2592	silvexes.exe	36
PID 2592 wrote to memory of 292	2592	silvexes.exe	36
PID 2592 wrote to memory of 292	2592	silvexes.exe	36
PID 292 wrote to memory of 1032	292	silvexes.exe	37
PID 292 wrote to memory of 1032	292	silvexes.exe	37
PID 292 wrote to memory of 1032	292	silvexes.exe	37
PID 292 wrote to memory of 1032	292	silvexes.exe	37
PID 1032 wrote to memory of 2728	1032	silvexes.exe	38
PID 1032 wrote to memory of 2728	1032	silvexes.exe	38
PID 1032 wrote to memory of 2728	1032	silvexes.exe	38
PID 1032 wrote to memory of 2728	1032	silvexes.exe	38
PID 2728 wrote to memory of 2776	2728	silvexes.exe	39
PID 2728 wrote to memory of 2776	2728	silvexes.exe	39
PID 2728 wrote to memory of 2776	2728	silvexes.exe	39
PID 2728 wrote to memory of 2776	2728	silvexes.exe	39
PID 2776 wrote to memory of 2872	2776	silvexes.exe	40
PID 2776 wrote to memory of 2872	2776	silvexes.exe	40
PID 2776 wrote to memory of 2872	2776	silvexes.exe	40
PID 2776 wrote to memory of 2872	2776	silvexes.exe	40
PID 2872 wrote to memory of 1136	2872	silvexes.exe	41
PID 2872 wrote to memory of 1136	2872	silvexes.exe	41
PID 2872 wrote to memory of 1136	2872	silvexes.exe	41
PID 2872 wrote to memory of 1136	2872	silvexes.exe	41
PID 1136 wrote to memory of 2892	1136	silvexes.exe	42
PID 1136 wrote to memory of 2892	1136	silvexes.exe	42
PID 1136 wrote to memory of 2892	1136	silvexes.exe	42
PID 1136 wrote to memory of 2892	1136	silvexes.exe	42
PID 2892 wrote to memory of 2116	2892	silvexes.exe	43
PID 2892 wrote to memory of 2116	2892	silvexes.exe	43
PID 2892 wrote to memory of 2116	2892	silvexes.exe	43
PID 2892 wrote to memory of 2116	2892	silvexes.exe	43
PID 2116 wrote to memory of 1088	2116	silvexes.exe	44
PID 2116 wrote to memory of 1088	2116	silvexes.exe	44
PID 2116 wrote to memory of 1088	2116	silvexes.exe	44
PID 2116 wrote to memory of 1088	2116	silvexes.exe	44
PID 1088 wrote to memory of 964	1088	silvexes.exe	45
PID 1088 wrote to memory of 964	1088	silvexes.exe	45
PID 1088 wrote to memory of 964	1088	silvexes.exe	45
PID 1088 wrote to memory of 964	1088	silvexes.exe	45
PID 964 wrote to memory of 2052	964	silvexes.exe	46
PID 964 wrote to memory of 2052	964	silvexes.exe	46
PID 964 wrote to memory of 2052	964	silvexes.exe	46
PID 964 wrote to memory of 2052	964	silvexes.exe	46

C:\Users\Admin\AppData\Local\Temp\323397f3967b998c748e0111ec1b6780N.exe
"C:\Users\Admin\AppData\Local\Temp\323397f3967b998c748e0111ec1b6780N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
  "C:\Users\Admin\AppData\Local\Temp\323397f3967b998c748e0111ec1b6780N.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
    "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
      "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:560
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        33⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        34⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        35⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        36⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        40⤵
        Executes dropped EXE
        
        PID:712
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        41⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        42⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        47⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:592
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        49⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        50⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        51⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        56⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        59⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        61⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        62⤵
        Executes dropped EXE
        
        PID:600
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        63⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        65⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        68⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        69⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        70⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        71⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        73⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        75⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        79⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        82⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        83⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        85⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        88⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        89⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        90⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        92⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        94⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        95⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        96⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        97⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        98⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        99⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        100⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        101⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        102⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        103⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        107⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        108⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        109⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        110⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        111⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        112⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        116⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        117⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        118⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        119⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        120⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        125⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        126⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        128⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        131⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        132⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        134⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        135⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        136⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        138⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        139⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        140⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        143⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        145⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        146⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        147⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe
        
        "C:\Users\Admin\AppData\Local\unfatigued\silvexes.exe"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Aaberg

Filesize
196KB

MD5
6588c63871313b36d201516ae1c764e8

SHA1
46ffb71844c6227197a56c3e680b9ce9b51689ae

SHA256
f03cb4a116a5b74618c042b0a41f78dab02158387b185f8980c2900bb67f7652

SHA512
fb83bbdb5bfa40aa2514113a387b9b1edf5deceb557693257e428347a8dc59bff23b715604a602e82f0fe30f427e5087d5df3e5092db558f97e17ec7c90f47a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aaberg

Filesize
128KB

MD5
828113d9d7d9858e08cf4c3edd4b68df

SHA1
2641c78cdeec82213632f72ad8a2095cc058be06

SHA256
1b3661956d978ed6facc8712c6d92050ba974bc616c62361d110b29521f8e64d

SHA512
88bf96a0acb6abeb342fc78466f0a285a56f4b9b4af73266c7715b414fa656abd07d16859591a15d2c95efc2a0587e16eae102d858d6508369d9f2b5a4e91bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\autDC0D.tmp

Filesize
389KB

MD5
820958ca619ef8b285787b041437e570

SHA1
56ff558795607b2a49722cef0f10123b19a6f547

SHA256
d081e0ae40cf93f61e4ff6668308107734a9132f861f88d56d0c43d3796ac3e2

SHA512
7c901be12282e7306a96e50acab1984edc4ee89c22fd6a233fde3cdfcf472f5052cc40cc5d66422d8878ba60316f7f958b193205778a2b1267372d765d27adf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\autDC3C.tmp

Filesize
14KB

MD5
5cbf4cb83cc279e182036f5d09d823cb

SHA1
2968db371b5cf08d936730c1547263bf6292f115

SHA256
c6ce8f461b7d1b6c682eafd6ce68f3955c6d7e8472869234df23c28ef96d9317

SHA512
61b94ede3976983712a12ec681092a0a6b404f64754ae5c92b986bbf5fa82651b1d58848ad4dc576ffffb540450357c289ba36389af392a352ceed1316ce613f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uncolorable

Filesize
483KB

MD5
ddd875fa932f71f83eddd25122f23af7

SHA1
130bf13369263a189bf13a0394bf8e5196c2cb95

SHA256
a65a931571aafd000abc9800349e21200883d31d18b4d4178116608f80483ba2

SHA512
636c1e7216d42e6b6690a3459f6e35c0ab793f83eb27eb03e2955c2774e4f6c52efd252bd393f4e49e7adcfd985b9a7f2a33fbb09f67dfba451acf5095f3e91e

Download Submit
\Users\Admin\AppData\Local\unfatigued\silvexes.exe

Filesize
1.2MB

MD5
323397f3967b998c748e0111ec1b6780

SHA1
6bcdff206537eed61e8182bd5a2654b650be9e6f

SHA256
7f7ec27fa019564213fa1e506b17c451f298c7b6a09ba614a6a92a81bcb2a0f3

SHA512
5d221597c633bce724d0da9dc7e30d66672b0c8ad421c7affd32b01265152d3d0b11a33bf73a31dd5cfd11f75a15fa577455cffd1726e764846d66478a484430

Download Submit
memory/784-11-0x0000000000330000-0x0000000000334000-memory.dmp

Filesize
16KB

Download