Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
688s -
max time network
692s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
VaporWaveX2.1.rar
Resource
win7-20240903-en
General
-
Target
VaporWaveX2.1.rar
-
Size
72.5MB
-
MD5
c1b8933cfb2e489e8601d151bb291fb1
-
SHA1
fa62983e1a63940f55a25cd6f872b2f0206a94ad
-
SHA256
ffd1d3a0e43ff0ba827e83fccc2515392e2d08719338219d200b8a310c5acdb6
-
SHA512
e501a5a88047e0f974355c1a703303edba46c187c0c8bb24be6bcdaffc3c357923d982797cae82cd1f5c89fd8bb40391b0995093da9be18d428700b3a4a23eed
-
SSDEEP
1572864:OPWU7/Jq6WgiEaArvFfrdpT/3BTkwHmkuiH09i4h5gmIKTv6yjZOE:Oftq6W7A7xLTfBTgkuAjm5rz1OE
Malware Config
Extracted
quasar
1.3.0.0
general1
servicehos.zapto.org:4444
QSR_MUTEX_ksxWAP4ziOqMlreofU
-
encryption_key
i9HUVkY4QNExDOHIMtIX
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
description flow ioc Process 64 ip-api.com Process not Found 80 ip-api.com Process not Found 92 ip-api.com Process not Found 136 ip-api.com Process not Found 34 ip-api.com Process not Found 104 ip-api.com Process not Found 113 ip-api.com Process not Found 121 ip-api.com Process not Found 129 ip-api.com Process not Found 143 ip-api.com Process not Found 150 ip-api.com Process not Found Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 7zFM.exe -
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/5112-13-0x0000000000D70000-0x0000000000DCE000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 64 IoCs
pid Process 5112 VaporWave2-1.exe 684 svchost.exe 768 svchost.exe 3948 svchost.exe 4724 VaporWave2-1.exe 3156 svchost.exe 3792 svchost.exe 2224 svchost.exe 2288 VaporWave2-1.exe 2876 VaporWave2-1.exe 4012 svchost.exe 4460 VaporWave2-1.exe 4048 svchost.exe 452 VaporWave2-1.exe 3232 VaporWave2-1.exe 2992 svchost.exe 4692 VaporWave2-1.exe 1392 VaporWave2-1.exe 3752 VaporWave2-1.exe 680 svchost.exe 2336 VaporWave2-1.exe 1156 VaporWave2-1.exe 3544 VaporWave2-1.exe 3296 svchost.exe 2604 svchost.exe 1504 svchost.exe 1316 svchost.exe 1308 svchost.exe 4688 svchost.exe 1664 svchost.exe 4964 svchost.exe 4048 svchost.exe 2736 svchost.exe 2396 svchost.exe 4708 svchost.exe 5052 svchost.exe 180 svchost.exe 3632 svchost.exe 1936 svchost.exe 2304 svchost.exe 4260 svchost.exe 5032 svchost.exe 1396 svchost.exe 3548 svchost.exe 3188 svchost.exe 1388 svchost.exe 2592 svchost.exe 4312 svchost.exe 1088 svchost.exe 2960 svchost.exe 2840 svchost.exe 400 svchost.exe 5048 svchost.exe 4164 svchost.exe 4500 svchost.exe 3884 svchost.exe 3276 svchost.exe 4552 svchost.exe 3728 svchost.exe 4700 svchost.exe 2604 svchost.exe 2356 svchost.exe 1868 svchost.exe 5064 svchost.exe -
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 64 ip-api.com 80 ip-api.com 92 ip-api.com 136 ip-api.com 143 ip-api.com 150 ip-api.com 34 ip-api.com 104 ip-api.com 113 ip-api.com 121 ip-api.com 129 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 4436 684 WerFault.exe 106 2732 768 WerFault.exe 120 3736 3948 WerFault.exe 133 3512 3156 WerFault.exe 149 2556 3792 WerFault.exe 160 2420 2224 WerFault.exe 172 4776 4048 WerFault.exe 190 1112 2992 WerFault.exe 206 2524 680 WerFault.exe 221 1664 2604 WerFault.exe 225 2876 1504 WerFault.exe 245 4384 1316 WerFault.exe 256 2452 4688 WerFault.exe 267 4560 1664 WerFault.exe 278 4192 4964 WerFault.exe 289 4488 4048 WerFault.exe 300 2104 2736 WerFault.exe 311 2296 2396 WerFault.exe 322 4252 4708 WerFault.exe 333 1072 5052 WerFault.exe 344 2440 180 WerFault.exe 355 1524 3632 WerFault.exe 366 444 1936 WerFault.exe 377 2288 2304 WerFault.exe 392 4396 4260 WerFault.exe 405 632 5032 WerFault.exe 417 1712 1396 WerFault.exe 429 3416 3548 WerFault.exe 441 264 3188 WerFault.exe 452 2420 1388 WerFault.exe 463 3416 2592 WerFault.exe 474 4476 4312 WerFault.exe 485 1952 1088 WerFault.exe 496 112 2960 WerFault.exe 507 2368 2840 WerFault.exe 518 4532 400 WerFault.exe 529 3496 5048 WerFault.exe 541 3940 4164 WerFault.exe 552 3856 4500 WerFault.exe 563 664 3884 WerFault.exe 574 4400 3276 WerFault.exe 585 2360 4552 WerFault.exe 596 3068 3728 WerFault.exe 607 2776 4700 WerFault.exe 618 4388 2604 WerFault.exe 629 4248 2356 WerFault.exe 640 3816 1868 WerFault.exe 651 4844 5064 WerFault.exe 662 3940 4248 WerFault.exe 673 436 1404 WerFault.exe 684 3584 776 WerFault.exe 695 944 1556 WerFault.exe 707 1104 1212 WerFault.exe 718 3280 3164 WerFault.exe 729 3156 4872 WerFault.exe 740 4684 2260 WerFault.exe 751 4296 2520 WerFault.exe 762 4424 2968 WerFault.exe 773 364 4388 WerFault.exe 784 3584 4580 WerFault.exe 795 4000 5012 WerFault.exe 806 2456 1820 WerFault.exe 817 4464 4104 WerFault.exe 828 3788 2452 WerFault.exe 839 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VaporWave2-1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VaporWave2-1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VaporWave2-1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2256 PING.EXE 5052 PING.EXE 2372 PING.EXE 3436 PING.EXE 3608 PING.EXE 632 PING.EXE 2308 PING.EXE 3152 PING.EXE 1680 PING.EXE 4480 PING.EXE 4532 PING.EXE 4252 PING.EXE 2944 PING.EXE 3516 PING.EXE 3700 PING.EXE 1836 PING.EXE 3912 PING.EXE 64 PING.EXE 4640 PING.EXE 1276 PING.EXE 1400 PING.EXE 3884 PING.EXE 4000 PING.EXE 4840 PING.EXE 2104 PING.EXE 4840 PING.EXE 3312 PING.EXE 3684 PING.EXE 1480 PING.EXE 4492 PING.EXE 2752 PING.EXE 3308 PING.EXE 1708 PING.EXE 1644 PING.EXE 4116 PING.EXE 3756 PING.EXE 4168 PING.EXE 3788 PING.EXE 3704 PING.EXE 4316 PING.EXE 1216 PING.EXE 2792 PING.EXE 4156 PING.EXE 4324 PING.EXE 2760 PING.EXE 4300 PING.EXE 2448 PING.EXE 2052 PING.EXE 4932 PING.EXE 2416 PING.EXE 1388 PING.EXE 1756 PING.EXE 4336 PING.EXE 436 PING.EXE 5068 PING.EXE 3200 PING.EXE 3484 PING.EXE 3632 PING.EXE 4128 PING.EXE 3248 PING.EXE 2384 PING.EXE 3856 PING.EXE 3472 PING.EXE 4420 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 64 IoCs
pid Process 2052 PING.EXE 3700 PING.EXE 1528 PING.EXE 4128 PING.EXE 4324 PING.EXE 3436 PING.EXE 3484 PING.EXE 2256 PING.EXE 1480 PING.EXE 2104 PING.EXE 972 PING.EXE 2752 PING.EXE 5084 PING.EXE 632 PING.EXE 3684 PING.EXE 3632 PING.EXE 1836 PING.EXE 1644 PING.EXE 4156 PING.EXE 2416 PING.EXE 5068 PING.EXE 4168 PING.EXE 1388 PING.EXE 4336 PING.EXE 3856 PING.EXE 3516 PING.EXE 4840 PING.EXE 1400 PING.EXE 1708 PING.EXE 3152 PING.EXE 3472 PING.EXE 4492 PING.EXE 3704 PING.EXE 4316 PING.EXE 4932 PING.EXE 1216 PING.EXE 3788 PING.EXE 3312 PING.EXE 3200 PING.EXE 1948 PING.EXE 2308 PING.EXE 2988 PING.EXE 4092 PING.EXE 4252 PING.EXE 4820 PING.EXE 4000 PING.EXE 2520 PING.EXE 3604 PING.EXE 4916 PING.EXE 436 PING.EXE 2436 PING.EXE 2384 PING.EXE 4640 PING.EXE 4840 PING.EXE 1276 PING.EXE 4480 PING.EXE 3308 PING.EXE 1756 PING.EXE 2792 PING.EXE 4532 PING.EXE 3248 PING.EXE 4420 PING.EXE 4468 PING.EXE 2944 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2352 schtasks.exe 5092 schtasks.exe 4788 schtasks.exe 3040 schtasks.exe 1812 schtasks.exe 744 schtasks.exe 4568 schtasks.exe 5116 schtasks.exe 3500 schtasks.exe 2480 schtasks.exe 1524 schtasks.exe 3788 schtasks.exe 1836 schtasks.exe 2432 schtasks.exe 428 schtasks.exe 4672 schtasks.exe 720 schtasks.exe 4428 schtasks.exe 4028 schtasks.exe 1212 schtasks.exe 1856 schtasks.exe 2104 schtasks.exe 5056 schtasks.exe 1748 schtasks.exe 996 schtasks.exe 3732 schtasks.exe 4296 schtasks.exe 4688 schtasks.exe 1276 schtasks.exe 3032 schtasks.exe 4540 schtasks.exe 1852 schtasks.exe 2092 schtasks.exe 712 schtasks.exe 1128 schtasks.exe 3268 schtasks.exe 3516 schtasks.exe 1976 schtasks.exe 2740 schtasks.exe 4044 schtasks.exe 3016 schtasks.exe 2088 schtasks.exe 5040 schtasks.exe 4540 schtasks.exe 2120 schtasks.exe 3156 schtasks.exe 392 schtasks.exe 4092 schtasks.exe 3248 schtasks.exe 2524 schtasks.exe 372 schtasks.exe 2868 schtasks.exe 1468 schtasks.exe 2760 schtasks.exe 3460 schtasks.exe 4972 schtasks.exe 1452 schtasks.exe 2260 schtasks.exe 3156 schtasks.exe 4352 schtasks.exe 1896 schtasks.exe 2368 schtasks.exe 5000 schtasks.exe 1940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 872 7zFM.exe 960 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 872 7zFM.exe Token: 35 872 7zFM.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 5112 VaporWave2-1.exe Token: SeDebugPrivilege 684 svchost.exe Token: SeDebugPrivilege 768 svchost.exe Token: SeDebugPrivilege 3948 svchost.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 4724 VaporWave2-1.exe Token: SeDebugPrivilege 3156 svchost.exe Token: SeDebugPrivilege 3792 svchost.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 2224 svchost.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 4460 VaporWave2-1.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 4048 svchost.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 3232 VaporWave2-1.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 2992 svchost.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 3752 VaporWave2-1.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeSecurityPrivilege 872 7zFM.exe Token: SeDebugPrivilege 680 svchost.exe Token: SeDebugPrivilege 2604 svchost.exe Token: SeDebugPrivilege 1504 svchost.exe Token: SeDebugPrivilege 1316 svchost.exe Token: SeDebugPrivilege 4688 svchost.exe Token: SeDebugPrivilege 1664 svchost.exe Token: SeDebugPrivilege 4964 svchost.exe Token: SeDebugPrivilege 4048 svchost.exe Token: SeDebugPrivilege 2736 svchost.exe Token: SeDebugPrivilege 2396 svchost.exe Token: SeDebugPrivilege 4708 svchost.exe Token: SeDebugPrivilege 5052 svchost.exe Token: SeDebugPrivilege 180 svchost.exe Token: SeDebugPrivilege 3632 svchost.exe Token: SeDebugPrivilege 1936 svchost.exe Token: SeDebugPrivilege 2304 svchost.exe Token: SeDebugPrivilege 960 taskmgr.exe Token: SeSystemProfilePrivilege 960 taskmgr.exe Token: SeCreateGlobalPrivilege 960 taskmgr.exe Token: SeDebugPrivilege 4260 svchost.exe Token: SeDebugPrivilege 5032 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 3548 svchost.exe Token: SeDebugPrivilege 3188 svchost.exe Token: SeDebugPrivilege 1388 svchost.exe Token: SeDebugPrivilege 2592 svchost.exe Token: SeDebugPrivilege 4312 svchost.exe Token: SeDebugPrivilege 1088 svchost.exe Token: SeDebugPrivilege 2960 svchost.exe Token: SeDebugPrivilege 2840 svchost.exe Token: SeDebugPrivilege 400 svchost.exe Token: SeDebugPrivilege 5048 svchost.exe Token: SeDebugPrivilege 4164 svchost.exe Token: SeDebugPrivilege 4500 svchost.exe Token: SeDebugPrivilege 3884 svchost.exe Token: SeDebugPrivilege 3276 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 4412 NOTEPAD.EXE 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 872 7zFM.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe 960 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 684 svchost.exe 768 svchost.exe 3948 svchost.exe 3156 svchost.exe 3792 svchost.exe 2224 svchost.exe 4048 svchost.exe 2992 svchost.exe 680 svchost.exe 2604 svchost.exe 1504 svchost.exe 1316 svchost.exe 4688 svchost.exe 1664 svchost.exe 4964 svchost.exe 4048 svchost.exe 2736 svchost.exe 2396 svchost.exe 4708 svchost.exe 5052 svchost.exe 180 svchost.exe 3632 svchost.exe 1936 svchost.exe 2304 svchost.exe 4260 svchost.exe 5032 svchost.exe 1396 svchost.exe 3548 svchost.exe 3188 svchost.exe 1388 svchost.exe 2592 svchost.exe 4312 svchost.exe 1088 svchost.exe 2960 svchost.exe 2840 svchost.exe 400 svchost.exe 5048 svchost.exe 4164 svchost.exe 4500 svchost.exe 3884 svchost.exe 3276 svchost.exe 4552 svchost.exe 3728 svchost.exe 4700 svchost.exe 2604 svchost.exe 2356 svchost.exe 1868 svchost.exe 5064 svchost.exe 4248 svchost.exe 1404 svchost.exe 776 svchost.exe 1556 svchost.exe 1212 svchost.exe 3164 svchost.exe 4872 svchost.exe 2260 svchost.exe 2520 svchost.exe 2968 svchost.exe 4388 svchost.exe 4580 svchost.exe 5012 svchost.exe 1820 svchost.exe 4104 svchost.exe 2452 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 5112 872 7zFM.exe 99 PID 872 wrote to memory of 5112 872 7zFM.exe 99 PID 872 wrote to memory of 5112 872 7zFM.exe 99 PID 5112 wrote to memory of 2088 5112 VaporWave2-1.exe 104 PID 5112 wrote to memory of 2088 5112 VaporWave2-1.exe 104 PID 5112 wrote to memory of 2088 5112 VaporWave2-1.exe 104 PID 5112 wrote to memory of 684 5112 VaporWave2-1.exe 106 PID 5112 wrote to memory of 684 5112 VaporWave2-1.exe 106 PID 5112 wrote to memory of 684 5112 VaporWave2-1.exe 106 PID 684 wrote to memory of 4688 684 svchost.exe 109 PID 684 wrote to memory of 4688 684 svchost.exe 109 PID 684 wrote to memory of 4688 684 svchost.exe 109 PID 684 wrote to memory of 4456 684 svchost.exe 111 PID 684 wrote to memory of 4456 684 svchost.exe 111 PID 684 wrote to memory of 4456 684 svchost.exe 111 PID 4456 wrote to memory of 3200 4456 cmd.exe 116 PID 4456 wrote to memory of 3200 4456 cmd.exe 116 PID 4456 wrote to memory of 3200 4456 cmd.exe 116 PID 4456 wrote to memory of 3436 4456 cmd.exe 117 PID 4456 wrote to memory of 3436 4456 cmd.exe 117 PID 4456 wrote to memory of 3436 4456 cmd.exe 117 PID 4456 wrote to memory of 768 4456 cmd.exe 120 PID 4456 wrote to memory of 768 4456 cmd.exe 120 PID 4456 wrote to memory of 768 4456 cmd.exe 120 PID 768 wrote to memory of 1276 768 svchost.exe 122 PID 768 wrote to memory of 1276 768 svchost.exe 122 PID 768 wrote to memory of 1276 768 svchost.exe 122 PID 768 wrote to memory of 2944 768 svchost.exe 124 PID 768 wrote to memory of 2944 768 svchost.exe 124 PID 768 wrote to memory of 2944 768 svchost.exe 124 PID 2944 wrote to memory of 3604 2944 cmd.exe 128 PID 2944 wrote to memory of 3604 2944 cmd.exe 128 PID 2944 wrote to memory of 3604 2944 cmd.exe 128 PID 2944 wrote to memory of 2052 2944 cmd.exe 129 PID 2944 wrote to memory of 2052 2944 cmd.exe 129 PID 2944 wrote to memory of 2052 2944 cmd.exe 129 PID 2944 wrote to memory of 3948 2944 cmd.exe 133 PID 2944 wrote to memory of 3948 2944 cmd.exe 133 PID 2944 wrote to memory of 3948 2944 cmd.exe 133 PID 3948 wrote to memory of 4092 3948 svchost.exe 135 PID 3948 wrote to memory of 4092 3948 svchost.exe 135 PID 3948 wrote to memory of 4092 3948 svchost.exe 135 PID 3948 wrote to memory of 1392 3948 svchost.exe 137 PID 3948 wrote to memory of 1392 3948 svchost.exe 137 PID 3948 wrote to memory of 1392 3948 svchost.exe 137 PID 1392 wrote to memory of 2104 1392 cmd.exe 140 PID 1392 wrote to memory of 2104 1392 cmd.exe 140 PID 1392 wrote to memory of 2104 1392 cmd.exe 140 PID 1392 wrote to memory of 2760 1392 cmd.exe 142 PID 1392 wrote to memory of 2760 1392 cmd.exe 142 PID 1392 wrote to memory of 2760 1392 cmd.exe 142 PID 872 wrote to memory of 4724 872 7zFM.exe 145 PID 872 wrote to memory of 4724 872 7zFM.exe 145 PID 872 wrote to memory of 4724 872 7zFM.exe 145 PID 4724 wrote to memory of 2352 4724 VaporWave2-1.exe 147 PID 4724 wrote to memory of 2352 4724 VaporWave2-1.exe 147 PID 4724 wrote to memory of 2352 4724 VaporWave2-1.exe 147 PID 4724 wrote to memory of 3156 4724 VaporWave2-1.exe 149 PID 4724 wrote to memory of 3156 4724 VaporWave2-1.exe 149 PID 4724 wrote to memory of 3156 4724 VaporWave2-1.exe 149 PID 3156 wrote to memory of 3460 3156 svchost.exe 151 PID 3156 wrote to memory of 3460 3156 svchost.exe 151 PID 3156 wrote to memory of 3460 3156 svchost.exe 151 PID 3156 wrote to memory of 3172 3156 svchost.exe 153
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VaporWaveX2.1.rar"1⤵
- Quasar RAT
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\7zO863B67F7\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863B67F7\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7zO863B67F7\VaporWave2-1.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2088
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:4688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fgcq2xrANJVV.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3200
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3436
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmWApshI3nxX.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
- System Location Discovery: System Language Discovery
PID:3604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2052
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:4092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jHjQBfRH6d9C.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\chcp.comchcp 650019⤵PID:2104
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2760
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3792 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f10⤵
- Scheduled Task/Job: Scheduled Task
PID:3248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hVES4Zjk16c4.bat" "10⤵PID:1008
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵PID:2720
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3312
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"11⤵
- Executes dropped EXE
PID:4012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 225210⤵
- Program crash
PID:2556
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 22168⤵
- Program crash
PID:3736
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 22086⤵
- Program crash
PID:2732
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 19764⤵
- Program crash
PID:4436
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8638E148\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO8638E148\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7zO8638E148\VaporWave2-1.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2352
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:3460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0GlNKftrj36w.bat" "4⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4460
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1276
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3GoxMhPkpGAb.bat" "6⤵PID:4836
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
- System Location Discovery: System Language Discovery
PID:4128
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1388
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 22366⤵
- Program crash
PID:2420
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 22324⤵
- Program crash
PID:3512
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863C10B8\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863C10B8\VaporWave2-1.exe"2⤵
- Executes dropped EXE
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863077B8\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863077B8\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\7zO86380D88\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO86380D88\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7zO86380D88\VaporWave2-1.exe" /rl HIGHEST /f3⤵PID:1912
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4048 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WcRtpUTMoxCx.bat" "4⤵PID:4608
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
- System Location Discovery: System Language Discovery
PID:4684
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3704
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yBZvGjOmlsNH.bat" "6⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4316
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"7⤵
- Executes dropped EXE
PID:1308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 22326⤵
- Program crash
PID:1664
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 22364⤵
- Program crash
PID:4776
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8633F388\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO8633F388\VaporWave2-1.exe"2⤵
- Executes dropped EXE
PID:452
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863EF998\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863EF998\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7zO863EF998\VaporWave2-1.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:5040
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f4⤵PID:2820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A7gEMobxX92A.bat" "4⤵PID:2624
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:2556
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3700
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f6⤵PID:3584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uiv7YmZB7F2E.bat" "6⤵PID:4868
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3608
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4688 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5YlhTKIRhz9I.bat" "8⤵PID:768
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵PID:2472
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4932
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4964 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f10⤵
- Scheduled Task/Job: Scheduled Task
PID:3516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eZvVN3ooxavm.bat" "10⤵PID:3760
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2752
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f12⤵
- Scheduled Task/Job: Scheduled Task
PID:2524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foEH3iFbOq5Y.bat" "12⤵
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵PID:2600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4480
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4708 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f14⤵PID:4656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9JQXPVzaRgHD.bat" "14⤵PID:1228
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵PID:3604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost15⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:64
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:180 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f16⤵
- Scheduled Task/Job: Scheduled Task
PID:2120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nyEBqpnYE2Ij.bat" "16⤵PID:4900
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵PID:3348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1400
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f18⤵
- Scheduled Task/Job: Scheduled Task
PID:4972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2Mw5PmTfvcxI.bat" "18⤵PID:3292
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1756
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4260 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f20⤵
- System Location Discovery: System Language Discovery
PID:4776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ex0ExuwsI5IF.bat" "20⤵PID:3784
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵PID:2088
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost21⤵
- Runs ping.exe
PID:5084
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f22⤵
- Scheduled Task/Job: Scheduled Task
PID:5092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HzymeObY4Umc.bat" "22⤵PID:4696
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵PID:2480
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2792
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3188 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f24⤵
- Scheduled Task/Job: Scheduled Task
PID:372
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SpoLZwKpeDsg.bat" "24⤵PID:1808
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵PID:1576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost25⤵PID:4644
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f26⤵
- Scheduled Task/Job: Scheduled Task
PID:2480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glbqzXoSxrPp.bat" "26⤵PID:4384
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵PID:1748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost27⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:632
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f28⤵PID:1644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKYwExFXv2T0.bat" "28⤵PID:2376
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵PID:1452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost29⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4640
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2840 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f30⤵
- Scheduled Task/Job: Scheduled Task
PID:1452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tHfbi5BzNpo5.bat" "30⤵PID:2756
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵PID:836
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost31⤵
- Runs ping.exe
PID:1948
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5048 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f32⤵PID:4980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lj7LBfaC0lKA.bat" "32⤵PID:3416
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵PID:4168
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost33⤵PID:2380
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4500 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f34⤵
- Scheduled Task/Job: Scheduled Task
PID:2868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EsZFfzIl7PLe.bat" "34⤵
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵PID:1212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost35⤵
- System Location Discovery: System Language Discovery
- Runs ping.exe
PID:1528
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3276 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f36⤵
- Scheduled Task/Job: Scheduled Task
PID:3040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mha5mmrhBKlo.bat" "36⤵PID:1800
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵PID:1952
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost37⤵
- Runs ping.exe
PID:4916
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3728 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f38⤵
- Scheduled Task/Job: Scheduled Task
PID:2260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o83pFMFvoGIt.bat" "38⤵PID:4012
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost39⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2308
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f40⤵
- Scheduled Task/Job: Scheduled Task
PID:1212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWeVxcwYLTEe.bat" "40⤵PID:3988
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵PID:4416
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost41⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3152
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f42⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsFMCrbWemdR.bat" "42⤵PID:3980
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵PID:5068
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost43⤵PID:3488
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"43⤵
- Suspicious use of SetWindowsHookEx
PID:4248 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f44⤵
- Scheduled Task/Job: Scheduled Task
PID:4044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umh2aujkiuFF.bat" "44⤵PID:5016
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵PID:4468
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost45⤵
- Runs ping.exe
PID:2988
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"45⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:776 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f46⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwLp9VLIlWgk.bat" "46⤵PID:1612
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵PID:3448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost47⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2256
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"47⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f48⤵
- Scheduled Task/Job: Scheduled Task
PID:4540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kL4jiS2PS7LJ.bat" "48⤵PID:3680
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵PID:3976
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost49⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3472
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"49⤵
- Suspicious use of SetWindowsHookEx
PID:1212 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f50⤵
- Scheduled Task/Job: Scheduled Task
PID:1852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\viytUeYCeuJx.bat" "50⤵PID:3752
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵PID:3308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost51⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3632
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"51⤵
- Suspicious use of SetWindowsHookEx
PID:3164 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f52⤵
- Scheduled Task/Job: Scheduled Task
PID:2092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pBFBCz8N0X6u.bat" "52⤵PID:4372
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵PID:3740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost53⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2448
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"53⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4872 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f54⤵PID:3544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fOdrll2O2G53.bat" "54⤵PID:4948
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵PID:2760
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost55⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:436
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"55⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2260 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f56⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L0Vj6dfuvX7u.bat" "56⤵PID:3936
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
- System Location Discovery: System Language Discovery
PID:2100
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost57⤵
- Runs ping.exe
PID:4092
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"57⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f58⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e71fvVEgMyjh.bat" "58⤵PID:2152
-
C:\Windows\SysWOW64\chcp.comchcp 6500159⤵PID:3684
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost59⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1644
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"59⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f60⤵
- Scheduled Task/Job: Scheduled Task
PID:3788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pUwphhkTXlhL.bat" "60⤵PID:3832
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵PID:4228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost61⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2104
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"61⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4388 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f62⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bgVlUjU93gza.bat" "62⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵PID:1392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost63⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5052
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"63⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4580 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f64⤵
- Scheduled Task/Job: Scheduled Task
PID:5000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q4Ef3gBGkHe8.bat" "64⤵PID:4620
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵PID:2156
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost65⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4156
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"65⤵
- Suspicious use of SetWindowsHookEx
PID:5012 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f66⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wg6XOYnndXg0.bat" "66⤵PID:4504
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵PID:4448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost67⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3756
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"67⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1820 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f68⤵
- Scheduled Task/Job: Scheduled Task
PID:1896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h30iAkKapKee.bat" "68⤵PID:1744
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵PID:4684
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost69⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5068
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"69⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4104 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f70⤵
- Scheduled Task/Job: Scheduled Task
PID:2368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IruKQrt3irL1.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\chcp.comchcp 6500171⤵PID:1216
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost71⤵
- Runs ping.exe
PID:3248
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"71⤵
- Suspicious use of SetWindowsHookEx
PID:2452 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f72⤵
- Scheduled Task/Job: Scheduled Task
PID:392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pv0uQ2assY69.bat" "72⤵PID:3168
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵PID:4192
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost73⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4116
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"73⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f74⤵
- Scheduled Task/Job: Scheduled Task
PID:3500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cUK1WYNeYY8Y.bat" "74⤵PID:5112
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵PID:1444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost75⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4168
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"75⤵PID:812
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f76⤵
- Scheduled Task/Job: Scheduled Task
PID:4672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nrEBIktRjL5C.bat" "76⤵PID:508
-
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵PID:5060
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost77⤵
- Runs ping.exe
PID:2436
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"77⤵PID:3112
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f78⤵PID:736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TT64edWxcb83.bat" "78⤵PID:2164
-
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵PID:3644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost79⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3884
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"79⤵PID:1448
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f80⤵
- Scheduled Task/Job: Scheduled Task
PID:3732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3Y0NRYN6I6a6.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵PID:3316
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost81⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2416
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"81⤵
- Checks computer location settings
PID:1248 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f82⤵
- Scheduled Task/Job: Scheduled Task
PID:4296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S6Kg538CjD3W.bat" "82⤵PID:4508
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵PID:5056
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost83⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3516
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"83⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f84⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R5YWLLUmJcQI.bat" "84⤵PID:2832
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵PID:3228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost85⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2372
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"85⤵
- Checks computer location settings
PID:3732 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f86⤵
- Scheduled Task/Job: Scheduled Task
PID:720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZjFwuyJIvZi1.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Windows\SysWOW64\chcp.comchcp 6500187⤵PID:2168
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost87⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4420
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"87⤵
- Checks computer location settings
PID:3192 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f88⤵
- Scheduled Task/Job: Scheduled Task
PID:3156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BJI5T6lVI13y.bat" "88⤵PID:4524
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost89⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3788
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"89⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3868 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f90⤵
- Scheduled Task/Job: Scheduled Task
PID:4352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72eJboRtXWdw.bat" "90⤵PID:4436
-
C:\Windows\SysWOW64\chcp.comchcp 6500191⤵PID:4664
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost91⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4840
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"91⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f92⤵PID:4464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xE1yAaLuZGc5.bat" "92⤵PID:3304
-
C:\Windows\SysWOW64\chcp.comchcp 6500193⤵
- System Location Discovery: System Language Discovery
PID:3644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost93⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4252
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"93⤵PID:1476
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f94⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yTLkrFnh0Wls.bat" "94⤵PID:372
-
C:\Windows\SysWOW64\chcp.comchcp 6500195⤵PID:3204
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost95⤵
- Runs ping.exe
PID:972
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"95⤵
- System Location Discovery: System Language Discovery
PID:960 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f96⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgjEr1jMG9Jz.bat" "96⤵PID:5000
-
C:\Windows\SysWOW64\chcp.comchcp 6500197⤵PID:3644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost97⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"97⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f98⤵
- Scheduled Task/Job: Scheduled Task
PID:712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umkvy5xxpNEl.bat" "98⤵PID:2616
-
C:\Windows\SysWOW64\chcp.comchcp 6500199⤵PID:868
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost99⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4000
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"99⤵
- Checks computer location settings
PID:1884 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f100⤵
- Scheduled Task/Job: Scheduled Task
PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0ehXCMiMoOca.bat" "100⤵PID:2092
-
C:\Windows\SysWOW64\chcp.comchcp 65001101⤵PID:4656
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost101⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4324
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"101⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f102⤵
- Scheduled Task/Job: Scheduled Task
PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q854lOH1LP7L.bat" "102⤵PID:4536
-
C:\Windows\SysWOW64\chcp.comchcp 65001103⤵PID:444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost103⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1480
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"103⤵
- Checks computer location settings
PID:4020 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f104⤵PID:2236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1EzNXK891uZO.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\chcp.comchcp 65001105⤵PID:3412
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost105⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4492
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"105⤵
- Checks computer location settings
PID:1708 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f106⤵
- System Location Discovery: System Language Discovery
PID:3096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xUPCXhb4rS0w.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Windows\SysWOW64\chcp.comchcp 65001107⤵PID:2588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost107⤵
- System Location Discovery: System Language Discovery
- Runs ping.exe
PID:4468
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"107⤵
- Checks computer location settings
PID:224 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f108⤵
- Scheduled Task/Job: Scheduled Task
PID:1128
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y0JxoWVtFhBh.bat" "108⤵PID:3628
-
C:\Windows\SysWOW64\chcp.comchcp 65001109⤵PID:4928
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost109⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2944
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"109⤵
- Checks computer location settings
PID:2384 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f110⤵
- Scheduled Task/Job: Scheduled Task
PID:2760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lLnbC3BONcrg.bat" "110⤵PID:3644
-
C:\Windows\SysWOW64\chcp.comchcp 65001111⤵
- System Location Discovery: System Language Discovery
PID:4476
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost111⤵
- Runs ping.exe
PID:4820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 2228110⤵PID:4540
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 2216108⤵PID:3028
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2200106⤵PID:2960
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 2216104⤵PID:4664
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 2216102⤵PID:5008
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1960100⤵PID:1388
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 222098⤵PID:2168
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 222496⤵PID:1716
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 219694⤵PID:3280
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 225692⤵PID:2748
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 221290⤵PID:3008
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 222088⤵PID:4564
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 220086⤵PID:2460
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 225284⤵PID:4532
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 222082⤵PID:868
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 219680⤵PID:4352
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 221278⤵PID:5064
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 96076⤵PID:808
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 221274⤵PID:4180
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 222472⤵
- Program crash
PID:3788
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 222070⤵
- Program crash
PID:4464
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 221668⤵
- Program crash
PID:2456
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 220066⤵
- Program crash
PID:4000
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 198064⤵
- Program crash
PID:3584
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 217662⤵
- Program crash
PID:364
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 223260⤵
- Program crash
PID:4424
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 224058⤵
- Program crash
PID:4296
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 96856⤵
- Program crash
PID:4684
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 226054⤵
- Program crash
PID:3156
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 221652⤵
- Program crash
PID:3280
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 196850⤵
- Program crash
PID:1104
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 221648⤵
- Program crash
PID:944
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 221246⤵
- Program crash
PID:3584
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 221244⤵
- Program crash
PID:3940
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 222442⤵
- Program crash
PID:3816
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 222040⤵
- Program crash
PID:4388
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 222038⤵
- Program crash
PID:3068
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 221236⤵
- Program crash
PID:4400
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 220834⤵
- Program crash
PID:3856
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 191632⤵
- Program crash
PID:3496
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 220030⤵
- Program crash
PID:2368
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 220428⤵
- Program crash
PID:1952
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 219626⤵
- Program crash
PID:3416
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 223224⤵
- Program crash
PID:264
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 220022⤵
- Program crash
PID:1712
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 226020⤵
- Program crash
PID:4396
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 221618⤵
- Program crash
PID:444
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 222016⤵
- Program crash
PID:2440
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 222814⤵
- Program crash
PID:4252
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 222812⤵
- Program crash
PID:2104
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 223610⤵
- Program crash
PID:4192
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 22168⤵
- Program crash
PID:2452
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 22366⤵
- Program crash
PID:2876
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 22524⤵
- Program crash
PID:1112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863FFC98\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863FFC98\VaporWave2-1.exe"2⤵
- Executes dropped EXE
PID:4692
-
-
C:\Users\Admin\AppData\Local\Temp\7zO86310398\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO86310398\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8630A698\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO8630A698\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7zO8630A698\VaporWave2-1.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3268
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:680 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:4540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\moKKgS2CySV6.bat" "4⤵PID:2052
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:1748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3200
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f6⤵PID:3548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZztGSUmtUOnL.bat" "6⤵PID:4716
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:3008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1680
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f8⤵
- System Location Discovery: System Language Discovery
PID:4872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8134MDHGkzao.bat" "8⤵PID:4464
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵PID:4400
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1836
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4048 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f10⤵PID:4300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKv6ioE87x64.bat" "10⤵PID:2648
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵PID:4252
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3912
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2396 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f12⤵PID:4840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fpJcHroneybp.bat" "12⤵PID:1104
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵PID:2756
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3308
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5052 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f14⤵
- Scheduled Task/Job: Scheduled Task
PID:2432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2kooBUQb49X5.bat" "14⤵PID:2160
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵PID:1812
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost15⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3248
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3632 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f16⤵
- Scheduled Task/Job: Scheduled Task
PID:1976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsdE5JpWABAl.bat" "16⤵PID:1876
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵PID:3544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3484
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f18⤵PID:2360
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3QGqGmRSUlD3.bat" "18⤵PID:1620
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1216
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5032 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f20⤵
- Scheduled Task/Job: Scheduled Task
PID:4028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMl1AQ3GuwAK.bat" "20⤵PID:972
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵PID:4252
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost21⤵PID:744
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3548 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f22⤵
- Scheduled Task/Job: Scheduled Task
PID:2104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ekUvjNjNbWps.bat" "22⤵PID:3792
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵PID:4440
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost23⤵
- Runs ping.exe
PID:2520
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f24⤵
- Scheduled Task/Job: Scheduled Task
PID:3032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h3XDIEWvSheE.bat" "24⤵PID:2224
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵PID:1136
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost25⤵PID:3512
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4312 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f26⤵
- Scheduled Task/Job: Scheduled Task
PID:4788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G4h1Cx2IiIQh.bat" "26⤵PID:3164
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵PID:2092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost27⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2384
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f28⤵PID:4404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\azNUJqUoceg4.bat" "28⤵PID:3112
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵PID:444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost29⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1708
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:400 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f30⤵
- Scheduled Task/Job: Scheduled Task
PID:3156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jr8qKrOW7Tko.bat" "30⤵PID:3412
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵PID:3936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost31⤵
- Runs ping.exe
PID:3604
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4164 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f32⤵PID:2272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GwEQK25KHAVw.bat" "32⤵PID:3868
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵PID:5036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost33⤵PID:264
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3884 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f34⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OkFGRqeHL6u7.bat" "34⤵PID:2272
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵PID:2348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost35⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4336
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4552 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f36⤵
- Scheduled Task/Job: Scheduled Task
PID:1468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6JBMhG5MKGyI.bat" "36⤵PID:4444
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵PID:4980
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost37⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3856
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4700 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f38⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H80vbopdu05N.bat" "38⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵PID:512
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost39⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4300
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2356 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f40⤵
- Scheduled Task/Job: Scheduled Task
PID:4568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9qYQwmKichxQ.bat" "40⤵PID:4028
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵PID:1924
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost41⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3684
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f42⤵
- Scheduled Task/Job: Scheduled Task
PID:5056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u438pGGq3iDL.bat" "42⤵PID:3184
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
- System Location Discovery: System Language Discovery
PID:868
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost43⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4840
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"43⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1404 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f44⤵PID:4184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ysFEAJfTbqwb.bat" "44⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵PID:2892
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost45⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4532
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"45⤵PID:1644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 222444⤵
- Program crash
PID:436
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 111242⤵
- Program crash
PID:4844
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 222440⤵
- Program crash
PID:4248
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 222438⤵
- Program crash
PID:2776
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 221636⤵
- Program crash
PID:2360
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 223634⤵
- Program crash
PID:664
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 222032⤵
- Program crash
PID:3940
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 222030⤵
- Program crash
PID:4532
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 223228⤵
- Program crash
PID:112
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 220826⤵
- Program crash
PID:4476
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 220024⤵
- Program crash
PID:2420
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 224422⤵
- Program crash
PID:3416
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 220820⤵
- Program crash
PID:632
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 222818⤵
- Program crash
PID:2288
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 217216⤵
- Program crash
PID:1524
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 225214⤵
- Program crash
PID:1072
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 222412⤵
- Program crash
PID:2296
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 195610⤵
- Program crash
PID:4488
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 22048⤵
- Program crash
PID:4560
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 22326⤵
- Program crash
PID:4384
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 22244⤵
- Program crash
PID:2524
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO86358FE8\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO86358FE8\VaporWave2-1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863500E8\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863500E8\VaporWave2-1.exe"2⤵
- Executes dropped EXE
PID:1156
-
-
C:\Users\Admin\AppData\Local\Temp\7zO863565E8\VaporWave2-1.exe"C:\Users\Admin\AppData\Local\Temp\7zO863565E8\VaporWave2-1.exe"2⤵
- Executes dropped EXE
PID:3544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 684 -ip 6841⤵PID:912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 768 -ip 7681⤵PID:3544
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ur a skid.txt1⤵
- Suspicious use of FindShellTrayWindow
PID:4412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3948 -ip 39481⤵PID:3496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3156 -ip 31561⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3792 -ip 37921⤵PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2224 -ip 22241⤵PID:3608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4048 -ip 40481⤵PID:2832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2992 -ip 29921⤵PID:3032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 680 -ip 6801⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2604 -ip 26041⤵PID:2960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1504 -ip 15041⤵PID:1296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1316 -ip 13161⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4688 -ip 46881⤵PID:2736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1664 -ip 16641⤵PID:4296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4964 -ip 49641⤵PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4048 -ip 40481⤵PID:1200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2736 -ip 27361⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2396 -ip 23961⤵PID:2448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4708 -ip 47081⤵PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5052 -ip 50521⤵PID:2748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 180 -ip 1801⤵PID:2088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 36321⤵PID:1388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1936 -ip 19361⤵PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2304 -ip 23041⤵PID:4532
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4260 -ip 42601⤵PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5032 -ip 50321⤵PID:3548
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1396 -ip 13961⤵PID:2776
-
C:\Windows\System32\ip2t47.exe"C:\Windows\System32\ip2t47.exe"1⤵PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3548 -ip 35481⤵PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3188 -ip 31881⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1388 -ip 13881⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2592 -ip 25921⤵PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4312 -ip 43121⤵PID:2260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1088 -ip 10881⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2960 -ip 29601⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2840 -ip 28401⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 400 -ip 4001⤵PID:1344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5048 -ip 50481⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4164 -ip 41641⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4500 -ip 45001⤵PID:428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3884 -ip 38841⤵PID:776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3276 -ip 32761⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4552 -ip 45521⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3728 -ip 37281⤵PID:4588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4700 -ip 47001⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2604 -ip 26041⤵PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2356 -ip 23561⤵PID:1748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1868 -ip 18681⤵PID:4128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5064 -ip 50641⤵PID:3860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4248 -ip 42481⤵PID:2668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1404 -ip 14041⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 776 -ip 7761⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1556 -ip 15561⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1212 -ip 12121⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3164 -ip 31641⤵PID:4056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4872 -ip 48721⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2260 -ip 22601⤵PID:3860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2520 -ip 25201⤵PID:3856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2968 -ip 29681⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4388 -ip 43881⤵PID:2456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4580 -ip 45801⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5012 -ip 50121⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1820 -ip 18201⤵PID:224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4104 -ip 41041⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2452 -ip 24521⤵PID:4448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1676 -ip 16761⤵PID:4324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 812 -ip 8121⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3112 -ip 31121⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1448 -ip 14481⤵PID:1108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1248 -ip 12481⤵PID:1104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1052 -ip 10521⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3732 -ip 37321⤵PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3192 -ip 31921⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3868 -ip 38681⤵PID:3484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1704 -ip 17041⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1476 -ip 14761⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 960 -ip 9601⤵PID:1008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1900 -ip 19001⤵PID:3040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1884 -ip 18841⤵PID:2420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3532 -ip 35321⤵PID:1060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4020 -ip 40201⤵PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1708 -ip 17081⤵PID:3620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 224 -ip 2241⤵PID:3068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2384 -ip 23841⤵PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
701B
MD55de8527438c860bfa3140dc420a03e52
SHA1235af682986b3292f20d8d71a8671353f5d6e16d
SHA256d9d92cd6e7a4507912965138b8d1eabb3f188f4dfcb61115ee99dc2c0fd43a92
SHA51277c3a774a2235c55ad520f1bf0c71fa3d3f0e7cf478a78e0d4dd6d253ee12a9859acc9ee822664467387788a2655a18373c8fcf08ea0d001549d3d4391b00bf8
-
Filesize
208B
MD59bcf210785e3770e10b0be2d6189763f
SHA16bd9e868796c99002b9cba61687112b860c1beff
SHA2562fc3ae5c8c4b1efa651018b4038a9524ef17de1bbecfd4ed89895a24ee99245a
SHA5129f020dd9f3e0c4003eeb14baae6a73c2e1820366cef05f1a551597a9c63cf574447e8bdde3b905966dba53e1734ed141554f3f0e34f2c77620c6297eac1f66b1
-
Filesize
208B
MD5a1358b8d33679c4fb9e5f33e9ff560a9
SHA1f960ac37959b7ad70dcdb48cee53dceb0b73c7f4
SHA256927836e7d20b7617320c785f301beee56088feb666346410ea529b0184f9f362
SHA51285620d5d905d57dca358134cf8568acb9e208114913da090d54628519eeb4da42b262a6875b5e3c90febb486bdcb6fcf61d3a1a1514a457d714c46cba8397b12
-
Filesize
208B
MD52469b4312bf74e25fe710efaca7fcec4
SHA122218db94726a9abbea7a822a2e7aa3a6ad441b2
SHA2564b1b770a11b9539e090b5c365eae0e57e9197005435038c1815f1a4f328f2007
SHA512c73c64b26c03fa9bf4beb9fae727fccd66c594c3b6ae65bf09723abfd395cfb3181a3b0c6d1b31c610ff47488f3c8f52211b1aa930c78c5fc191a760b343194b
-
Filesize
208B
MD551808e86fb31c5eed37dcdd3315b8de9
SHA116946188601e19bba017de3cb554dcdc9a5d2217
SHA2564bb5882a1083c82da18fa69051901785d9f81a86dd7923b3112032eda3652f1c
SHA51261e8af8d67f6d164684059fcb6c872f3434beb34bbf12f99b859097234ef0df59f76f9c1064dda59fcf73289bfd49465dbdf983ae84f792b4a84dd9073fcc6bb
-
Filesize
208B
MD5a25d67c4707b6e07bc4977215da1ef0d
SHA13f460f81e4cd59926c01e5ce75b8f96bbb319d9c
SHA256a268e577908155866e0c90735554788d7d9ce2aa1eb84ee1ab46345e6f852846
SHA512f3f18c2db0441f749bb37b1554196ee7ef03299264bed8f0bb3b09f3e9b07b52207a6fefc9940fa9a080d1a87131b25319a196f4eb573237abaae1bd2ce7ac26
-
Filesize
208B
MD5a8dd47e3420c7fbc5c998bf4790a3074
SHA15409af543788ef86383545891361ef50b83011f6
SHA25684a13c0f09e1dac6f98459c07fb1e82b5ca939ccd1c8db827500ecda88adee01
SHA5120454d8581e481651cecaf0c76d8799c2f32afabec26531859b3e993d8865b77e29a97ebcf36497e397c330acfe648ca97a86c7dcfc400cbb245c1616d234855a
-
Filesize
208B
MD581389779a7a53cac73877aaa15e8de4c
SHA1500cf7fa51bb779e86494dfdb9cab56fefd5eba3
SHA25680d5f4eaffbf6b845a6c4f8888135568c22df5c196dcdd066549252e41f56134
SHA51270458a5391f40493ba1e33e6fe2dda74647dd5bc1826a9e31a8209187cbe9a0706728e58cc023767f613f05cba02a4f4a54cc165dd70db2c1d4e4d48489776a9
-
Filesize
208B
MD564b7c2d604ee3b6d78750f3bafab5c38
SHA1e3c3adb7349e7b7fef346d467cf0a5b55aabb7d8
SHA256bbb7bc5a76ea25b78c99cfac669cd50b743cb65dcdbf2a09e730ece9fc350233
SHA512eb674d5478c70b5305f2b9305564c3119b14d4ff0a196f29093af7c5b8e684b107b0a3a112eefb0fd87e01b1a19e9ed9b4d5a8578f3409c5d5888b6127d9e773
-
Filesize
208B
MD5705847f3d461dbf1b7c883ea41015071
SHA15ceea492434d711e80b6d79c93d57d63bc214e56
SHA25619ad78f40582910bd3ee67d84df538e77b46ec5b0744f761298230ff42ed970e
SHA5123f789b0407d885147c452aec43ce2dcc574828340919296a82679f5002adc3449c7c96c3262e6cf4eff865b9716c9cd92c852055cb2c739c085a9d28ce8b9cf5
-
Filesize
208B
MD52a8edadbba4290e809a0a88dcd832a46
SHA1a5d6f66400b1c5654ede6a3e01274e00561a9c7d
SHA25616f67c6d8bee9f7a7b1d24ec2a9a3e2b3d36e6d059c26b090b2e614cffd55fd7
SHA512d6551ee68f62444da45af62525dfcc13a4202d0b22bf50a2f2eff1fd99f92fb1b9a320133c12cd23b84a135cd37cc876d16754a0ffa3ea202744af581c7b5c6d
-
Filesize
224B
MD5e13ab6d6f781a59b97e6f45d21a6f310
SHA1d5cdaea2d63697e3b91780d3343f3217066fda03
SHA256baaf5c264312434e4aff3edccbe696f558f26b4156e8c8509e991389ea268344
SHA51265a8c0fc006736b7c3ceb456d36de4c0571a760da5da2b798d311e0b23d77bb58c8acd11d2c7a1067bbe6c42303e1f062dd8a88e605f1355dc34611846956d16
-
Filesize
224B
MD58d77d8ddbed5ddcb08b61159e7df8d3f
SHA1109b7085808169109e39c6074fff2452aab26384
SHA256c4cfa6b990d50fe1c1c7c8657a3b6179e15508b397848684cd55db36f6cc1000
SHA5125a22a6414e66235d28578ac76193c38ab73b88f6e5366f3718813be21dba459d517b3ff455d1936a67bf0d462b9d3d2f82610de5aefd9107ad675516969af619
-
Filesize
224B
MD57eeb7719f687a72a349517f338652bd8
SHA1eb956280ccc8725a0387dc24000c027786c1f547
SHA25673aa857c5a23be558230722696336a67daa273cac24ca5ad6259b502bd9eb076
SHA51292ffd50352f18150d7a924d649393242e417c0fe967716b62be1e652d6a45fd2c2d7d17c6f510c5763c580099c01d05a2c0594f6dacd8bd42146e2343275ca1e
-
Filesize
224B
MD57892f6f186a9e7ada74888d6f79f1c39
SHA10d99b9ac9feae24f275910a9430a148b9285cf95
SHA2566349e776c02c2a0dc61e0bd4959167559fbd79fe271effd2e43a0edd07483702
SHA512275193c3e0d6327572bfd47277a0691e62034dd33728608ddcad85c791ea9a4b33680d7f78ea9c8cf124040de95d519f7af12c39986df6172af970b5d202dcf9
-
Filesize
224B
MD5466303d53f5f686d74476d9b01114d86
SHA1216b86377af06b516f23a934c2e056ba0911c16a
SHA25683683e03caa1cb95f8d3cb7a9505bacead032bad6e5ba1d5b0e560de7bb87a29
SHA512477286f4e3da825a3f84b4ed236b9db58d7e4f0da2a26575222d7dee3fadbd5de27f20c7f8cf82e33ed56dc8ccc9b321b8ff7323697c1700145621fcc14bfd9b
-
Filesize
224B
MD5d8d1b665f25f2b24fe905a322c73abbb
SHA11ded7a161bb2877a0608cfef51751b66aea6afbb
SHA256378ea49952997086c6b0c44189864557ab5cb83d0f8d3b6fbb87269a15d7fff2
SHA5125a0ad6c019eff79b7c9543f10fb0a126b66ee7ff6a9d45274ae9bef8179530dd9617ae219aeb57a1d699f711850b2204f122fca506d96afe78c36ecf613cde2b
-
Filesize
224B
MD5ff77fadb802a9770602b3114a338fd52
SHA1ac3d845f8ac07c7e7507849422a5ac8d74ef8460
SHA256738adc090382224b58a1f79e2fd40690883c9f72247655c42d6f2a502e372a77
SHA5127fabe18919cd87927d8d11e4ab264b00361778148a377d2f67d96cc5d23ef67327ae236c1bf35858f2506710dccc7a137804316dce89867acf18cb2035dfae5d
-
Filesize
224B
MD5748121da7702d495a7b839e5f23f0fff
SHA1bc6b60fa1f68d0b3302693d105b194378757c4f9
SHA2561956ba29dc792d2679fdb5ec4f0690b7dffae9993529520a4ea2e768348bd461
SHA5120249d4a61eb52e5004e54c979ceb1e1f4e88da01d86ea318abb8996dc196bb31471f15caabb802360cb691135700a223fbeed2b4565f47190aaf27bd66d9667c
-
Filesize
224B
MD59808b0860a35d7a066ab6c3520ab160e
SHA1e9c93d2d7d000df33e3b4b7ef922558b43c02843
SHA256900f1954c229b25f8a88bdc5f2755df57cd09b88430df5fbe1597d29f8123132
SHA5124547ab79db7b27d7466d242ecfa658892d25357f6c186ade7a24ca2204646e5d884fb6ab79736b80a5469360f83428544419277326a4c3d04fb2d3bd3d2c18ee