Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
734d765717a...e4.exe
windows10-2004-x64
634f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
37s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20250207-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
-
Size
446KB
-
MD5
68e298b36db386382e7dfbe5bd784699
-
SHA1
123700bc8004ee6c9967a6818689658c23cf4996
-
SHA256
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875
-
SHA512
879f41008ddd3464026b5c93338246fddfcc640e2790bf3d106555e22103dde1bfc33e23125e891a676daa263635518142cbf481f91b0671adfadce63222a562
-
SSDEEP
12288:CEgwe8+6XzGT4DaHK8mzQz9vIQozyiScxvN4HZwujQ:C1wjDaq5zOgRzyQvNKh
Malware Config
Extracted
xworm
127.0.0.1:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral14/files/0x000a0000000227cb-6.dat family_xworm behavioral14/memory/2672-24-0x0000000000C10000-0x0000000000C22000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe -
Executes dropped EXE 64 IoCs
pid Process 2672 XClient.exe 2396 Output.exe 5460 XClient.exe 5056 Output.exe 4676 XClient.exe 4740 Output.exe 4692 XClient.exe 2112 Output.exe 2600 XClient.exe 2384 Output.exe 4388 XClient.exe 4860 Output.exe 2536 XClient.exe 4004 Output.exe 4560 XClient.exe 5096 Output.exe 4628 XClient.exe 4532 Output.exe 4356 XClient.exe 5520 Output.exe 1196 XClient.exe 1068 Output.exe 1440 XClient.exe 5808 Output.exe 5580 XClient.exe 1168 Output.exe 656 XClient.exe 1744 Output.exe 5956 XClient.exe 544 Output.exe 3228 XClient.exe 5796 Output.exe 924 XClient.exe 5444 Output.exe 3300 XClient.exe 3472 Output.exe 1364 XClient.exe 2244 Output.exe 5800 XClient.exe 1908 Output.exe 2676 XClient.exe 3240 Output.exe 5156 XClient.exe 5264 Output.exe 1348 XClient.exe 4372 Output.exe 920 XClient.exe 2016 Output.exe 1332 XClient.exe 316 Output.exe 5056 XClient.exe 4760 Output.exe 2596 XClient.exe 6008 Output.exe 5084 XClient.exe 6052 Output.exe 2748 XClient.exe 2664 Output.exe 3144 XClient.exe 832 Output.exe 3924 XClient.exe 1184 Output.exe 3032 XClient.exe 6108 Output.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2672 XClient.exe Token: SeDebugPrivilege 5460 XClient.exe Token: SeDebugPrivilege 4676 XClient.exe Token: SeDebugPrivilege 4692 XClient.exe Token: SeDebugPrivilege 2600 XClient.exe Token: SeDebugPrivilege 4388 XClient.exe Token: SeDebugPrivilege 2536 XClient.exe Token: SeDebugPrivilege 4560 XClient.exe Token: SeDebugPrivilege 4628 XClient.exe Token: SeDebugPrivilege 4356 XClient.exe Token: SeDebugPrivilege 1196 XClient.exe Token: SeDebugPrivilege 1440 XClient.exe Token: SeDebugPrivilege 5580 XClient.exe Token: SeDebugPrivilege 656 XClient.exe Token: SeDebugPrivilege 5956 XClient.exe Token: SeDebugPrivilege 3228 XClient.exe Token: SeDebugPrivilege 924 XClient.exe Token: SeDebugPrivilege 3300 XClient.exe Token: SeDebugPrivilege 1364 XClient.exe Token: SeDebugPrivilege 5800 XClient.exe Token: SeDebugPrivilege 2676 XClient.exe Token: SeDebugPrivilege 5156 XClient.exe Token: SeDebugPrivilege 1348 XClient.exe Token: SeDebugPrivilege 920 XClient.exe Token: SeDebugPrivilege 1332 XClient.exe Token: SeDebugPrivilege 5056 XClient.exe Token: SeDebugPrivilege 2596 XClient.exe Token: SeDebugPrivilege 5084 XClient.exe Token: SeDebugPrivilege 2748 XClient.exe Token: SeDebugPrivilege 3144 XClient.exe Token: SeDebugPrivilege 3924 XClient.exe Token: SeDebugPrivilege 3032 XClient.exe Token: SeDebugPrivilege 2808 XClient.exe Token: SeDebugPrivilege 4588 XClient.exe Token: SeDebugPrivilege 1756 XClient.exe Token: SeDebugPrivilege 808 XClient.exe Token: SeDebugPrivilege 5968 XClient.exe Token: SeDebugPrivilege 4548 XClient.exe Token: SeDebugPrivilege 3772 XClient.exe Token: SeDebugPrivilege 372 XClient.exe Token: SeDebugPrivilege 2560 XClient.exe Token: SeDebugPrivilege 1304 XClient.exe Token: SeDebugPrivilege 4600 XClient.exe Token: SeDebugPrivilege 4736 XClient.exe Token: SeDebugPrivilege 5052 XClient.exe Token: SeDebugPrivilege 4992 XClient.exe Token: SeDebugPrivilege 2944 XClient.exe Token: SeDebugPrivilege 3112 XClient.exe Token: SeDebugPrivilege 1196 XClient.exe Token: SeDebugPrivilege 5380 XClient.exe Token: SeDebugPrivilege 4268 XClient.exe Token: SeDebugPrivilege 4684 XClient.exe Token: SeDebugPrivilege 2556 XClient.exe Token: SeDebugPrivilege 1712 XClient.exe Token: SeDebugPrivilege 2884 XClient.exe Token: SeDebugPrivilege 4348 XClient.exe Token: SeDebugPrivilege 2332 XClient.exe Token: SeDebugPrivilege 1868 XClient.exe Token: SeDebugPrivilege 4080 XClient.exe Token: SeDebugPrivilege 2416 XClient.exe Token: SeDebugPrivilege 4848 XClient.exe Token: SeDebugPrivilege 4948 XClient.exe Token: SeDebugPrivilege 6008 XClient.exe Token: SeDebugPrivilege 2888 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 2672 3128 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 88 PID 3128 wrote to memory of 2672 3128 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 88 PID 3128 wrote to memory of 2396 3128 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 89 PID 3128 wrote to memory of 2396 3128 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 89 PID 2396 wrote to memory of 5460 2396 Output.exe 90 PID 2396 wrote to memory of 5460 2396 Output.exe 90 PID 2396 wrote to memory of 5056 2396 Output.exe 91 PID 2396 wrote to memory of 5056 2396 Output.exe 91 PID 5056 wrote to memory of 4676 5056 Output.exe 92 PID 5056 wrote to memory of 4676 5056 Output.exe 92 PID 5056 wrote to memory of 4740 5056 Output.exe 93 PID 5056 wrote to memory of 4740 5056 Output.exe 93 PID 4740 wrote to memory of 4692 4740 Output.exe 95 PID 4740 wrote to memory of 4692 4740 Output.exe 95 PID 4740 wrote to memory of 2112 4740 Output.exe 96 PID 4740 wrote to memory of 2112 4740 Output.exe 96 PID 2112 wrote to memory of 2600 2112 Output.exe 97 PID 2112 wrote to memory of 2600 2112 Output.exe 97 PID 2112 wrote to memory of 2384 2112 Output.exe 98 PID 2112 wrote to memory of 2384 2112 Output.exe 98 PID 2384 wrote to memory of 4388 2384 Output.exe 99 PID 2384 wrote to memory of 4388 2384 Output.exe 99 PID 2384 wrote to memory of 4860 2384 Output.exe 100 PID 2384 wrote to memory of 4860 2384 Output.exe 100 PID 4860 wrote to memory of 2536 4860 Output.exe 101 PID 4860 wrote to memory of 2536 4860 Output.exe 101 PID 4860 wrote to memory of 4004 4860 Output.exe 102 PID 4860 wrote to memory of 4004 4860 Output.exe 102 PID 4004 wrote to memory of 4560 4004 Output.exe 183 PID 4004 wrote to memory of 4560 4004 Output.exe 183 PID 4004 wrote to memory of 5096 4004 Output.exe 104 PID 4004 wrote to memory of 5096 4004 Output.exe 104 PID 5096 wrote to memory of 4628 5096 Output.exe 105 PID 5096 wrote to memory of 4628 5096 Output.exe 105 PID 5096 wrote to memory of 4532 5096 Output.exe 106 PID 5096 wrote to memory of 4532 5096 Output.exe 106 PID 4532 wrote to memory of 4356 4532 Output.exe 107 PID 4532 wrote to memory of 4356 4532 Output.exe 107 PID 4532 wrote to memory of 5520 4532 Output.exe 108 PID 4532 wrote to memory of 5520 4532 Output.exe 108 PID 5520 wrote to memory of 1196 5520 Output.exe 190 PID 5520 wrote to memory of 1196 5520 Output.exe 190 PID 5520 wrote to memory of 1068 5520 Output.exe 110 PID 5520 wrote to memory of 1068 5520 Output.exe 110 PID 1068 wrote to memory of 1440 1068 Output.exe 111 PID 1068 wrote to memory of 1440 1068 Output.exe 111 PID 1068 wrote to memory of 5808 1068 Output.exe 112 PID 1068 wrote to memory of 5808 1068 Output.exe 112 PID 5808 wrote to memory of 5580 5808 Output.exe 113 PID 5808 wrote to memory of 5580 5808 Output.exe 113 PID 5808 wrote to memory of 1168 5808 Output.exe 114 PID 5808 wrote to memory of 1168 5808 Output.exe 114 PID 1168 wrote to memory of 656 1168 Output.exe 115 PID 1168 wrote to memory of 656 1168 Output.exe 115 PID 1168 wrote to memory of 1744 1168 Output.exe 193 PID 1168 wrote to memory of 1744 1168 Output.exe 193 PID 1744 wrote to memory of 5956 1744 Output.exe 117 PID 1744 wrote to memory of 5956 1744 Output.exe 117 PID 1744 wrote to memory of 544 1744 Output.exe 162 PID 1744 wrote to memory of 544 1744 Output.exe 162 PID 544 wrote to memory of 3228 544 Output.exe 120 PID 544 wrote to memory of 3228 544 Output.exe 120 PID 544 wrote to memory of 5796 544 Output.exe 121 PID 544 wrote to memory of 5796 544 Output.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe"C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5580
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"17⤵
- Executes dropped EXE
PID:5796 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
PID:5444 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"19⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"21⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"22⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"23⤵
- Executes dropped EXE
PID:5264 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"24⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"25⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"26⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"28⤵
- Executes dropped EXE
PID:6008 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"29⤵
- Executes dropped EXE
PID:6052 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"30⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"31⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"32⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:6108 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"34⤵
- Checks computer location settings
PID:1316 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"35⤵PID:3828
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"36⤵PID:544
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"37⤵PID:3428
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:5968
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"38⤵
- Checks computer location settings
PID:3268 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"39⤵PID:5468
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"40⤵PID:1428
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"41⤵PID:2308
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"42⤵PID:1652
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"43⤵PID:4596
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"44⤵PID:316
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"45⤵
- Checks computer location settings
PID:4760 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"46⤵
- Checks computer location settings
PID:4828 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"47⤵
- Checks computer location settings
PID:4800 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"48⤵PID:636
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"49⤵PID:408
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"50⤵PID:4452
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:5380
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"51⤵
- Checks computer location settings
PID:1744 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"52⤵PID:1468
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"53⤵PID:2604
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"54⤵PID:2480
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"55⤵
- Checks computer location settings
PID:536 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"56⤵PID:4068
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"57⤵
- Checks computer location settings
PID:2192 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"58⤵PID:3300
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"59⤵PID:1364
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"60⤵PID:2252
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"61⤵
- Checks computer location settings
PID:5880 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"62⤵PID:4904
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"63⤵PID:5976
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:6008
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"64⤵PID:3416
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"65⤵PID:2280
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"66⤵PID:1696
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"66⤵PID:1640
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"67⤵PID:1948
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"67⤵PID:5708
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"68⤵PID:4516
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"68⤵PID:1440
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"69⤵PID:1864
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"69⤵
- Checks computer location settings
PID:1936 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"70⤵PID:2360
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"70⤵PID:840
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"71⤵PID:3088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"71⤵PID:3828
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"72⤵PID:3696
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"72⤵PID:5960
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"73⤵PID:4472
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"73⤵PID:1532
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"74⤵PID:4588
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"74⤵
- Checks computer location settings
PID:5132 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"75⤵PID:536
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"75⤵PID:2272
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"76⤵PID:916
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"76⤵PID:5968
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"77⤵PID:1900
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"77⤵PID:4548
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"78⤵PID:1284
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"78⤵PID:4392
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"79⤵PID:3772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"79⤵PID:5088
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"80⤵PID:4180
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"80⤵PID:4928
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"81⤵PID:5896
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"81⤵
- Checks computer location settings
PID:4904 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"82⤵PID:4232
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"82⤵PID:2112
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"83⤵PID:3620
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"83⤵
- Checks computer location settings
PID:2384 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"84⤵PID:5824
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"84⤵
- Checks computer location settings
PID:4628 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"85⤵PID:4856
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"85⤵
- Checks computer location settings
PID:1188 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"86⤵PID:3712
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"86⤵PID:2664
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"87⤵PID:2916
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"87⤵PID:5820
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"88⤵PID:5736
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"88⤵PID:3944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"89⤵PID:840
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"89⤵PID:3312
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"90⤵PID:3828
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"90⤵PID:3872
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"91⤵PID:772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"91⤵
- Checks computer location settings
PID:4796 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"92⤵PID:4712
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"92⤵
- Checks computer location settings
PID:2244 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"93⤵PID:5452
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"93⤵PID:1700
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"94⤵PID:2868
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"94⤵PID:3240
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"95⤵PID:2308
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"95⤵PID:4372
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"96⤵PID:392
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"96⤵PID:4632
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"97⤵PID:4080
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"97⤵
- Checks computer location settings
PID:400 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"98⤵PID:5088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"98⤵
- Checks computer location settings
PID:4960 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"99⤵PID:4760
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"99⤵PID:3748
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"100⤵PID:3596
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"100⤵
- Checks computer location settings
PID:1476 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"101⤵PID:4876
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"101⤵PID:2888
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"102⤵PID:920
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"102⤵PID:1332
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"103⤵PID:3084
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"103⤵PID:1612
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"104⤵PID:5908
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"104⤵PID:2944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"105⤵PID:1184
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"105⤵PID:640
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"106⤵PID:5912
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"106⤵
- Checks computer location settings
PID:2220 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"107⤵PID:4464
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"107⤵PID:5208
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"108⤵PID:2808
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"108⤵PID:2176
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"109⤵PID:968
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"109⤵
- Checks computer location settings
PID:1684 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"110⤵PID:5784
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"110⤵
- Checks computer location settings
PID:1712 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"111⤵PID:2244
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"111⤵PID:1908
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"112⤵PID:4660
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"112⤵PID:3728
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"113⤵PID:3784
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"113⤵PID:1420
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"114⤵PID:4404
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"114⤵
- Checks computer location settings
PID:4480 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"115⤵PID:1772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"115⤵PID:4632
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"116⤵PID:372
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"116⤵PID:4728
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"117⤵PID:728
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"117⤵PID:1776
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"118⤵PID:1960
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"118⤵PID:2328
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"119⤵PID:2816
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"119⤵PID:4904
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"120⤵PID:4736
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"120⤵PID:2888
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"121⤵PID:3132
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"121⤵PID:2280
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"122⤵PID:5280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-