Analysis
-
max time kernel
116s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
Ardamax Keylogger 4.0.2 + Serial/setup_akl.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ardamax Keylogger 4.0.2 + Serial/setup_akl.exe
Resource
win10v2004-20241007-en
General
-
Target
Ardamax Keylogger 4.0.2 + Serial/setup_akl.exe
-
Size
3.7MB
-
MD5
95a6c69fbfd7e0d1ac7690a0f30bc9a5
-
SHA1
1fa1f827c8d071c1acf4febdecc6bb69fc7b88a4
-
SHA256
a194ad107256b7783b2b82f512468c44743f708e57f1784b4e89b817b39ae019
-
SHA512
c79ced7b3f1a23e1bbdb4c05b9e319312b5d7e0044759a4b6f4bb16407920ed1329a865f08a1f98811c76a47937b6ba9d9209bd46a5c8466aedab0f5b7a5e922
-
SSDEEP
98304:2IMVXIWgIfWo92sB9W17iq99DOQxrBa9KSQh4xCd5wGBhIRkfYha:2L44fW+jB9UiC97Z4KSjx0wyO
Malware Config
Signatures
-
Ardamax family
-
Executes dropped EXE 64 IoCs
pid Process 2388 FJS.exe 2868 FJS.exe 2748 FJS.exe 2532 FJS.exe 1968 FJS.exe 1272 FJS.exe 848 FJS.exe 2760 FJS.exe 2992 FJS.exe 2476 FJS.exe 1292 FJS.exe 2972 FJS.exe 2816 FJS.exe 2924 FJS.exe 880 FJS.exe 1632 FJS.exe 2288 FJS.exe 3060 FJS.exe 2880 FJS.exe 2808 FJS.exe 2576 FJS.exe 2556 FJS.exe 2348 FJS.exe 2248 FJS.exe 1364 FJS.exe 1036 FJS.exe 2828 FJS.exe 2976 FJS.exe 2284 FJS.exe 692 FJS.exe 1640 FJS.exe 788 FJS.exe 1408 FJS.exe 1424 FJS.exe 1516 FJS.exe 2388 FJS.exe 2660 FJS.exe 2108 FJS.exe 2524 FJS.exe 3020 FJS.exe 2308 FJS.exe 1576 FJS.exe 1540 FJS.exe 1720 FJS.exe 3000 FJS.exe 2148 FJS.exe 3016 FJS.exe 1504 FJS.exe 884 FJS.exe 980 FJS.exe 2212 FJS.exe 3036 FJS.exe 1520 FJS.exe 1568 FJS.exe 2724 FJS.exe 1848 FJS.exe 2536 FJS.exe 2424 FJS.exe 2740 FJS.exe 1976 FJS.exe 316 FJS.exe 1864 FJS.exe 2860 FJS.exe 1980 FJS.exe -
Loads dropped DLL 64 IoCs
pid Process 2156 setup_akl.exe 2388 FJS.exe 2128 setup_akl.exe 2868 FJS.exe 2128 setup_akl.exe 2664 setup_akl.exe 2748 FJS.exe 2748 FJS.exe 2424 setup_akl.exe 2532 FJS.exe 2532 FJS.exe 2980 setup_akl.exe 1968 FJS.exe 1968 FJS.exe 1272 FJS.exe 1272 FJS.exe 1996 setup_akl.exe 848 FJS.exe 848 FJS.exe 2760 FJS.exe 2760 FJS.exe 1032 setup_akl.exe 2992 FJS.exe 2992 FJS.exe 2764 setup_akl.exe 2476 FJS.exe 2476 FJS.exe 2764 setup_akl.exe 2180 setup_akl.exe 1292 FJS.exe 1052 setup_akl.exe 2972 FJS.exe 1008 setup_akl.exe 2816 FJS.exe 588 setup_akl.exe 2924 FJS.exe 1964 setup_akl.exe 880 FJS.exe 1428 setup_akl.exe 1632 FJS.exe 1768 setup_akl.exe 2288 FJS.exe 2448 setup_akl.exe 3060 FJS.exe 2108 setup_akl.exe 2880 FJS.exe 2832 setup_akl.exe 2808 FJS.exe 2840 setup_akl.exe 2576 FJS.exe 2732 setup_akl.exe 2556 FJS.exe 1876 setup_akl.exe 2348 FJS.exe 896 setup_akl.exe 2248 FJS.exe 308 setup_akl.exe 1364 FJS.exe 1884 setup_akl.exe 1036 FJS.exe 1452 setup_akl.exe 2828 FJS.exe 1708 setup_akl.exe 2976 FJS.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJS Start = "C:\\ProgramData\\HQLGHD\\FJS.exe" FJS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_akl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2388 FJS.exe 2388 FJS.exe 2868 FJS.exe 2868 FJS.exe 2748 FJS.exe 2748 FJS.exe 2532 FJS.exe 2532 FJS.exe 1968 FJS.exe 1968 FJS.exe 1272 FJS.exe 1272 FJS.exe 848 FJS.exe 848 FJS.exe 2760 FJS.exe 2760 FJS.exe 2992 FJS.exe 2992 FJS.exe 2476 FJS.exe 2476 FJS.exe 1292 FJS.exe 1292 FJS.exe 2972 FJS.exe 2972 FJS.exe 2816 FJS.exe 2816 FJS.exe 2924 FJS.exe 2924 FJS.exe 880 FJS.exe 880 FJS.exe 1632 FJS.exe 1632 FJS.exe 2288 FJS.exe 2288 FJS.exe 3060 FJS.exe 3060 FJS.exe 2880 FJS.exe 2880 FJS.exe 2808 FJS.exe 2808 FJS.exe 2576 FJS.exe 2576 FJS.exe 2556 FJS.exe 2556 FJS.exe 2248 FJS.exe 2248 FJS.exe 1036 FJS.exe 1036 FJS.exe 2976 FJS.exe 2976 FJS.exe 692 FJS.exe 692 FJS.exe 1640 FJS.exe 1640 FJS.exe 788 FJS.exe 788 FJS.exe 1408 FJS.exe 1408 FJS.exe 1424 FJS.exe 1424 FJS.exe 1516 FJS.exe 1516 FJS.exe 2388 FJS.exe 2388 FJS.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 2748 FJS.exe 2748 FJS.exe 2532 FJS.exe 2532 FJS.exe 1968 FJS.exe 1968 FJS.exe 1272 FJS.exe 1272 FJS.exe 848 FJS.exe 848 FJS.exe 2760 FJS.exe 2760 FJS.exe 2992 FJS.exe 2992 FJS.exe 2476 FJS.exe 2476 FJS.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2748 FJS.exe 2748 FJS.exe 2532 FJS.exe 2532 FJS.exe 1968 FJS.exe 1968 FJS.exe 1272 FJS.exe 1272 FJS.exe 848 FJS.exe 848 FJS.exe 2760 FJS.exe 2760 FJS.exe 2992 FJS.exe 2992 FJS.exe 2476 FJS.exe 2476 FJS.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2388 FJS.exe 2388 FJS.exe 2388 FJS.exe 2388 FJS.exe 2868 FJS.exe 2868 FJS.exe 2868 FJS.exe 2868 FJS.exe 2748 FJS.exe 2748 FJS.exe 2748 FJS.exe 2748 FJS.exe 2532 FJS.exe 2532 FJS.exe 2532 FJS.exe 2532 FJS.exe 1968 FJS.exe 1968 FJS.exe 1968 FJS.exe 1968 FJS.exe 1272 FJS.exe 1272 FJS.exe 1272 FJS.exe 1272 FJS.exe 848 FJS.exe 848 FJS.exe 848 FJS.exe 848 FJS.exe 2760 FJS.exe 2760 FJS.exe 2760 FJS.exe 2760 FJS.exe 2992 FJS.exe 2992 FJS.exe 2992 FJS.exe 2992 FJS.exe 2476 FJS.exe 2476 FJS.exe 2476 FJS.exe 2476 FJS.exe 1292 FJS.exe 1292 FJS.exe 1292 FJS.exe 1292 FJS.exe 2972 FJS.exe 2972 FJS.exe 2972 FJS.exe 2972 FJS.exe 2816 FJS.exe 2816 FJS.exe 2816 FJS.exe 2816 FJS.exe 2924 FJS.exe 2924 FJS.exe 2924 FJS.exe 2924 FJS.exe 880 FJS.exe 880 FJS.exe 880 FJS.exe 880 FJS.exe 1632 FJS.exe 1632 FJS.exe 1632 FJS.exe 1632 FJS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2388 2156 setup_akl.exe 30 PID 2156 wrote to memory of 2388 2156 setup_akl.exe 30 PID 2156 wrote to memory of 2388 2156 setup_akl.exe 30 PID 2156 wrote to memory of 2388 2156 setup_akl.exe 30 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2156 wrote to memory of 2128 2156 setup_akl.exe 31 PID 2128 wrote to memory of 2868 2128 setup_akl.exe 32 PID 2128 wrote to memory of 2868 2128 setup_akl.exe 32 PID 2128 wrote to memory of 2868 2128 setup_akl.exe 32 PID 2128 wrote to memory of 2868 2128 setup_akl.exe 32 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 2128 wrote to memory of 344 2128 setup_akl.exe 33 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 344 wrote to memory of 2736 344 setup_akl.exe 34 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2736 wrote to memory of 2664 2736 setup_akl.exe 35 PID 2664 wrote to memory of 2748 2664 setup_akl.exe 36 PID 2664 wrote to memory of 2748 2664 setup_akl.exe 36 PID 2664 wrote to memory of 2748 2664 setup_akl.exe 36 PID 2664 wrote to memory of 2748 2664 setup_akl.exe 36 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2664 wrote to memory of 2424 2664 setup_akl.exe 37 PID 2424 wrote to memory of 2532 2424 setup_akl.exe 38 PID 2424 wrote to memory of 2532 2424 setup_akl.exe 38 PID 2424 wrote to memory of 2532 2424 setup_akl.exe 38 PID 2424 wrote to memory of 2532 2424 setup_akl.exe 38 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2424 wrote to memory of 2980 2424 setup_akl.exe 39 PID 2980 wrote to memory of 1968 2980 setup_akl.exe 40 PID 2980 wrote to memory of 1968 2980 setup_akl.exe 40 PID 2980 wrote to memory of 1968 2980 setup_akl.exe 40 PID 2980 wrote to memory of 1968 2980 setup_akl.exe 40 PID 2980 wrote to memory of 2420 2980 setup_akl.exe 41 PID 2980 wrote to memory of 2420 2980 setup_akl.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"8⤵PID:2420
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"9⤵
- Loads dropped DLL
PID:1996 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"10⤵PID:1860
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"11⤵
- Loads dropped DLL
PID:1032 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"12⤵
- Loads dropped DLL
PID:2764 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"13⤵
- Loads dropped DLL
PID:2180 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"14⤵
- Loads dropped DLL
PID:1052 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"15⤵
- Loads dropped DLL
PID:1008 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"16⤵
- Loads dropped DLL
PID:588 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"17⤵
- Loads dropped DLL
PID:1964 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:880
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"18⤵
- Loads dropped DLL
PID:1428 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"19⤵
- Loads dropped DLL
PID:1768 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2448 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"21⤵
- Loads dropped DLL
PID:2108 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"22⤵
- Loads dropped DLL
PID:2832 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"23⤵
- Loads dropped DLL
PID:2840 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"24⤵
- Loads dropped DLL
PID:2732 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"25⤵
- Loads dropped DLL
PID:1876 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"26⤵
- Loads dropped DLL
PID:896 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"27⤵
- Loads dropped DLL
PID:308 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"28⤵
- Loads dropped DLL
PID:1884 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"29⤵
- Loads dropped DLL
PID:1452 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"30⤵
- Loads dropped DLL
PID:1708 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"31⤵PID:2756
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"32⤵
- Executes dropped EXE
PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"32⤵PID:2764
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"33⤵PID:1280
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"34⤵PID:980
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"35⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:788
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"35⤵PID:1008
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1408
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"36⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"37⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"37⤵PID:2232
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"38⤵PID:1568
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"39⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"39⤵PID:2440
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"40⤵
- Executes dropped EXE
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"40⤵PID:3060
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"41⤵
- Executes dropped EXE
PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"41⤵PID:2636
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"42⤵
- Executes dropped EXE
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"42⤵PID:2516
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"43⤵
- Executes dropped EXE
PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"43⤵PID:1136
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"44⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"44⤵PID:672
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"45⤵
- Executes dropped EXE
PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"45⤵PID:1972
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"46⤵
- Executes dropped EXE
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"46⤵
- System Location Discovery: System Language Discovery
PID:308 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"47⤵
- Executes dropped EXE
PID:1720
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"47⤵PID:1188
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"48⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"48⤵PID:2012
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"49⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"49⤵PID:2160
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"50⤵
- Executes dropped EXE
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"50⤵PID:2476
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"51⤵
- Executes dropped EXE
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"51⤵PID:1536
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"52⤵
- Executes dropped EXE
- Adds Run key to start application
PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"52⤵PID:1640
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"53⤵
- Executes dropped EXE
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"53⤵PID:788
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"54⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"54⤵PID:3052
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"55⤵
- Executes dropped EXE
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"55⤵PID:2276
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"56⤵
- Executes dropped EXE
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"56⤵PID:2232
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"57⤵
- Executes dropped EXE
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"57⤵PID:2384
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"58⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"58⤵PID:2728
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"59⤵
- Executes dropped EXE
PID:1848
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"59⤵PID:2676
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"60⤵
- Executes dropped EXE
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"60⤵PID:2512
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"61⤵
- Executes dropped EXE
PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"61⤵PID:2848
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"62⤵
- Executes dropped EXE
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"62⤵PID:2680
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"63⤵
- Executes dropped EXE
PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"63⤵PID:1664
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"64⤵
- Executes dropped EXE
- Adds Run key to start application
PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"64⤵PID:1996
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"65⤵
- Executes dropped EXE
PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"65⤵PID:1728
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"66⤵
- Executes dropped EXE
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"66⤵PID:2036
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"67⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"67⤵PID:2600
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"68⤵PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"68⤵PID:1744
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"69⤵PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"69⤵PID:408
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"70⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"70⤵PID:1504
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"71⤵
- System Location Discovery: System Language Discovery
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"71⤵PID:884
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"72⤵PID:596
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"72⤵PID:2416
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"73⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"73⤵PID:1604
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"74⤵PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"74⤵PID:2872
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"75⤵PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"75⤵PID:2592
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"76⤵PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"76⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"77⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"77⤵PID:2660
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"78⤵PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"78⤵PID:2832
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"79⤵PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"79⤵PID:2524
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"80⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"80⤵PID:2988
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"81⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"81⤵PID:1616
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"82⤵PID:1928
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"82⤵PID:1652
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"83⤵PID:1664
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"83⤵PID:1972
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"84⤵
- Adds Run key to start application
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"84⤵PID:1732
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"85⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"85⤵PID:2964
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"86⤵
- Adds Run key to start application
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"86⤵PID:2284
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"87⤵
- Adds Run key to start application
PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"87⤵PID:1980
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"88⤵PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"88⤵PID:692
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"89⤵
- System Location Discovery: System Language Discovery
PID:1220
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"89⤵PID:1456
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"90⤵PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"90⤵
- System Location Discovery: System Language Discovery
PID:596 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"91⤵PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"91⤵PID:1008
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"92⤵PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"92⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"93⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"93⤵
- System Location Discovery: System Language Discovery
PID:1520 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"94⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"94⤵PID:1516
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"95⤵PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"95⤵PID:2448
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"96⤵PID:2372
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"96⤵PID:2656
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"97⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"97⤵PID:2568
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"98⤵PID:284
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"98⤵PID:2632
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"99⤵PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"99⤵PID:2840
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"100⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"100⤵PID:1944
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"101⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"101⤵PID:1616
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"102⤵PID:292
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"102⤵PID:1988
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"103⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"103⤵PID:1720
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"104⤵
- Adds Run key to start application
PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"104⤵PID:2860
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"105⤵PID:1552
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"105⤵PID:2176
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"106⤵PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"106⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"107⤵PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"107⤵PID:2180
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"108⤵PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"108⤵PID:912
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"109⤵PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"109⤵PID:1692
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"110⤵PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"110⤵PID:1688
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"111⤵
- System Location Discovery: System Language Discovery
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"111⤵PID:984
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"112⤵PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"112⤵PID:1428
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"113⤵PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"113⤵PID:2260
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"114⤵PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"114⤵PID:2724
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"115⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"115⤵PID:376
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"116⤵
- Adds Run key to start application
PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"116⤵PID:3008
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"117⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"117⤵PID:2584
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"118⤵
- Adds Run key to start application
PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"118⤵PID:2488
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"119⤵PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"119⤵PID:844
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"120⤵PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"120⤵PID:1724
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"121⤵
- Adds Run key to start application
PID:1664
-
-
C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0.2 + Serial\setup_akl.exe"121⤵PID:1728
-
C:\ProgramData\HQLGHD\FJS.exe"C:\ProgramData\HQLGHD\FJS.exe"122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-