Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
1034d765717a...e4.exe
windows10-2004-x64
1034f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
30s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:09
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
-
Size
446KB
-
MD5
68e298b36db386382e7dfbe5bd784699
-
SHA1
123700bc8004ee6c9967a6818689658c23cf4996
-
SHA256
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875
-
SHA512
879f41008ddd3464026b5c93338246fddfcc640e2790bf3d106555e22103dde1bfc33e23125e891a676daa263635518142cbf481f91b0671adfadce63222a562
-
SSDEEP
12288:CEgwe8+6XzGT4DaHK8mzQz9vIQozyiScxvN4HZwujQ:C1wjDaq5zOgRzyQvNKh
Malware Config
Extracted
xworm
127.0.0.1:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral13/files/0x00090000000120f1-5.dat family_xworm behavioral13/memory/2428-10-0x0000000000360000-0x0000000000372000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 64 IoCs
pid Process 2428 XClient.exe 1296 Output.exe 2868 Output.exe 2740 XClient.exe 2900 Output.exe 3044 XClient.exe 2956 XClient.exe 2836 Output.exe 2664 Output.exe 2632 XClient.exe 2156 Output.exe 2516 XClient.exe 2960 XClient.exe 2788 Output.exe 2992 XClient.exe 3008 Output.exe 1824 Output.exe 1612 XClient.exe 2328 XClient.exe 2080 Output.exe 592 XClient.exe 2508 Output.exe 1756 Output.exe 2320 XClient.exe 3068 Output.exe 352 XClient.exe 268 XClient.exe 1588 Output.exe 1156 Output.exe 2484 XClient.exe 2356 Output.exe 2352 XClient.exe 2856 Output.exe 2712 XClient.exe 2432 XClient.exe 2340 Output.exe 2752 Output.exe 1412 XClient.exe 768 XClient.exe 2864 Output.exe 2764 Output.exe 2940 XClient.exe 2608 Output.exe 2612 XClient.exe 2868 Output.exe 2344 XClient.exe 1676 Output.exe 2924 XClient.exe 2932 XClient.exe 1864 Output.exe 1408 XClient.exe 1600 Output.exe 1960 Output.exe 2132 XClient.exe 700 XClient.exe 1064 Output.exe 440 Output.exe 2056 XClient.exe 2588 Output.exe 2148 XClient.exe 1684 Output.exe 2424 XClient.exe 2280 Output.exe 2052 XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2428 XClient.exe Token: SeDebugPrivilege 2740 XClient.exe Token: SeDebugPrivilege 3044 XClient.exe Token: SeDebugPrivilege 2956 XClient.exe Token: SeDebugPrivilege 2632 XClient.exe Token: SeDebugPrivilege 2516 XClient.exe Token: SeDebugPrivilege 2960 XClient.exe Token: SeDebugPrivilege 2992 XClient.exe Token: SeDebugPrivilege 1612 XClient.exe Token: SeDebugPrivilege 2328 XClient.exe Token: SeDebugPrivilege 592 XClient.exe Token: SeDebugPrivilege 2320 XClient.exe Token: SeDebugPrivilege 352 XClient.exe Token: SeDebugPrivilege 268 XClient.exe Token: SeDebugPrivilege 2484 XClient.exe Token: SeDebugPrivilege 2352 XClient.exe Token: SeDebugPrivilege 2712 XClient.exe Token: SeDebugPrivilege 2432 XClient.exe Token: SeDebugPrivilege 1412 XClient.exe Token: SeDebugPrivilege 768 XClient.exe Token: SeDebugPrivilege 2940 XClient.exe Token: SeDebugPrivilege 2612 XClient.exe Token: SeDebugPrivilege 2344 XClient.exe Token: SeDebugPrivilege 2924 XClient.exe Token: SeDebugPrivilege 2932 XClient.exe Token: SeDebugPrivilege 1408 XClient.exe Token: SeDebugPrivilege 2132 XClient.exe Token: SeDebugPrivilege 700 XClient.exe Token: SeDebugPrivilege 2056 XClient.exe Token: SeDebugPrivilege 2148 XClient.exe Token: SeDebugPrivilege 2424 XClient.exe Token: SeDebugPrivilege 2052 XClient.exe Token: SeDebugPrivilege 2356 XClient.exe Token: SeDebugPrivilege 2912 XClient.exe Token: SeDebugPrivilege 2736 XClient.exe Token: SeDebugPrivilege 2768 XClient.exe Token: SeDebugPrivilege 2620 XClient.exe Token: SeDebugPrivilege 1848 XClient.exe Token: SeDebugPrivilege 1700 XClient.exe Token: SeDebugPrivilege 2708 XClient.exe Token: SeDebugPrivilege 772 XClient.exe Token: SeDebugPrivilege 2592 XClient.exe Token: SeDebugPrivilege 2500 XClient.exe Token: SeDebugPrivilege 1520 XClient.exe Token: SeDebugPrivilege 2920 XClient.exe Token: SeDebugPrivilege 988 XClient.exe Token: SeDebugPrivilege 2908 XClient.exe Token: SeDebugPrivilege 1736 XClient.exe Token: SeDebugPrivilege 1568 XClient.exe Token: SeDebugPrivilege 2508 XClient.exe Token: SeDebugPrivilege 440 XClient.exe Token: SeDebugPrivilege 2800 XClient.exe Token: SeDebugPrivilege 2732 XClient.exe Token: SeDebugPrivilege 2868 XClient.exe Token: SeDebugPrivilege 2860 XClient.exe Token: SeDebugPrivilege 2892 XClient.exe Token: SeDebugPrivilege 2564 XClient.exe Token: SeDebugPrivilege 2772 XClient.exe Token: SeDebugPrivilege 1800 XClient.exe Token: SeDebugPrivilege 2844 XClient.exe Token: SeDebugPrivilege 2568 XClient.exe Token: SeDebugPrivilege 304 XClient.exe Token: SeDebugPrivilege 2792 XClient.exe Token: SeDebugPrivilege 1612 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 2428 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 30 PID 768 wrote to memory of 2428 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 30 PID 768 wrote to memory of 2428 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 30 PID 768 wrote to memory of 1296 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 31 PID 768 wrote to memory of 1296 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 31 PID 768 wrote to memory of 1296 768 342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe 31 PID 1296 wrote to memory of 2740 1296 Output.exe 32 PID 1296 wrote to memory of 2740 1296 Output.exe 32 PID 1296 wrote to memory of 2740 1296 Output.exe 32 PID 1296 wrote to memory of 2868 1296 Output.exe 33 PID 1296 wrote to memory of 2868 1296 Output.exe 33 PID 1296 wrote to memory of 2868 1296 Output.exe 33 PID 2868 wrote to memory of 3044 2868 Output.exe 34 PID 2868 wrote to memory of 3044 2868 Output.exe 34 PID 2868 wrote to memory of 3044 2868 Output.exe 34 PID 2868 wrote to memory of 2900 2868 Output.exe 35 PID 2868 wrote to memory of 2900 2868 Output.exe 35 PID 2868 wrote to memory of 2900 2868 Output.exe 35 PID 2900 wrote to memory of 2956 2900 Output.exe 36 PID 2900 wrote to memory of 2956 2900 Output.exe 36 PID 2900 wrote to memory of 2956 2900 Output.exe 36 PID 2900 wrote to memory of 2836 2900 Output.exe 37 PID 2900 wrote to memory of 2836 2900 Output.exe 37 PID 2900 wrote to memory of 2836 2900 Output.exe 37 PID 2836 wrote to memory of 2632 2836 Output.exe 38 PID 2836 wrote to memory of 2632 2836 Output.exe 38 PID 2836 wrote to memory of 2632 2836 Output.exe 38 PID 2836 wrote to memory of 2664 2836 Output.exe 39 PID 2836 wrote to memory of 2664 2836 Output.exe 39 PID 2836 wrote to memory of 2664 2836 Output.exe 39 PID 2664 wrote to memory of 2516 2664 Output.exe 40 PID 2664 wrote to memory of 2516 2664 Output.exe 40 PID 2664 wrote to memory of 2516 2664 Output.exe 40 PID 2664 wrote to memory of 2156 2664 Output.exe 41 PID 2664 wrote to memory of 2156 2664 Output.exe 41 PID 2664 wrote to memory of 2156 2664 Output.exe 41 PID 2156 wrote to memory of 2960 2156 Output.exe 42 PID 2156 wrote to memory of 2960 2156 Output.exe 42 PID 2156 wrote to memory of 2960 2156 Output.exe 42 PID 2156 wrote to memory of 2788 2156 Output.exe 43 PID 2156 wrote to memory of 2788 2156 Output.exe 43 PID 2156 wrote to memory of 2788 2156 Output.exe 43 PID 2788 wrote to memory of 2992 2788 Output.exe 44 PID 2788 wrote to memory of 2992 2788 Output.exe 44 PID 2788 wrote to memory of 2992 2788 Output.exe 44 PID 2788 wrote to memory of 3008 2788 Output.exe 45 PID 2788 wrote to memory of 3008 2788 Output.exe 45 PID 2788 wrote to memory of 3008 2788 Output.exe 45 PID 3008 wrote to memory of 1612 3008 Output.exe 46 PID 3008 wrote to memory of 1612 3008 Output.exe 46 PID 3008 wrote to memory of 1612 3008 Output.exe 46 PID 3008 wrote to memory of 1824 3008 Output.exe 47 PID 3008 wrote to memory of 1824 3008 Output.exe 47 PID 3008 wrote to memory of 1824 3008 Output.exe 47 PID 1824 wrote to memory of 2328 1824 Output.exe 48 PID 1824 wrote to memory of 2328 1824 Output.exe 48 PID 1824 wrote to memory of 2328 1824 Output.exe 48 PID 1824 wrote to memory of 2080 1824 Output.exe 49 PID 1824 wrote to memory of 2080 1824 Output.exe 49 PID 1824 wrote to memory of 2080 1824 Output.exe 49 PID 2080 wrote to memory of 592 2080 Output.exe 50 PID 2080 wrote to memory of 592 2080 Output.exe 50 PID 2080 wrote to memory of 592 2080 Output.exe 50 PID 2080 wrote to memory of 2508 2080 Output.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe"C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"12⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"13⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:352
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"14⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"15⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"16⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"17⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"18⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"19⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"20⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"21⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"22⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"23⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"24⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"25⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"26⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"27⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"28⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"29⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"30⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"31⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"32⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"33⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"34⤵PID:2704
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"35⤵PID:1672
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"36⤵PID:2872
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"37⤵PID:2144
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"38⤵PID:2848
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"39⤵PID:2852
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"40⤵PID:780
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"41⤵PID:972
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"42⤵PID:2256
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"43⤵PID:880
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"44⤵PID:2276
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"45⤵PID:876
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"46⤵PID:2804
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"47⤵PID:2868
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"48⤵PID:2680
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"49⤵PID:2848
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"50⤵PID:1100
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"51⤵PID:2792
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"52⤵PID:1792
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"53⤵PID:1140
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"54⤵PID:1448
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"55⤵PID:2672
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"56⤵PID:2244
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"57⤵PID:2172
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"58⤵PID:2640
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"59⤵PID:1396
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"60⤵PID:1448
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"61⤵PID:1364
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"62⤵PID:1660
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:304
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"63⤵PID:2880
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"64⤵PID:2288
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"65⤵PID:2640
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"66⤵PID:1812
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"66⤵PID:636
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"67⤵PID:1448
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"67⤵PID:1696
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"68⤵PID:268
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"68⤵PID:2552
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"69⤵PID:2076
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"69⤵PID:2960
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"70⤵PID:1064
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"70⤵PID:944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"71⤵PID:2420
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"71⤵PID:2972
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"72⤵PID:2848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"72⤵PID:1712
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"73⤵PID:2672
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"73⤵PID:2536
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"74⤵PID:1412
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"74⤵PID:872
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"75⤵PID:2096
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"75⤵PID:2164
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"76⤵PID:1924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"76⤵PID:1396
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"77⤵PID:672
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"77⤵PID:2312
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"78⤵PID:1928
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"78⤵PID:844
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"79⤵PID:1988
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"79⤵PID:2124
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"80⤵PID:2816
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"80⤵PID:292
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"81⤵PID:2376
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"81⤵PID:700
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"82⤵PID:2364
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"82⤵PID:796
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"83⤵PID:1244
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"83⤵PID:944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"84⤵PID:2968
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"84⤵PID:2132
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"85⤵PID:2756
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"85⤵PID:884
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"86⤵PID:1976
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"86⤵PID:636
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"87⤵PID:2432
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"87⤵PID:1592
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"88⤵PID:1640
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"88⤵PID:2228
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"89⤵PID:1636
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"89⤵PID:2092
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"90⤵PID:808
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"90⤵PID:1496
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"91⤵PID:1756
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"91⤵PID:1184
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"92⤵PID:2304
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"92⤵PID:1652
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"93⤵PID:884
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"93⤵PID:2648
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"94⤵PID:1592
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"94⤵PID:2660
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"95⤵PID:3028
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"95⤵PID:2500
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"96⤵PID:2344
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"96⤵PID:2684
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"97⤵PID:960
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"97⤵PID:1156
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"98⤵PID:848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"98⤵PID:944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"99⤵PID:1616
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"99⤵PID:1184
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"100⤵PID:1484
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"100⤵PID:2748
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"101⤵PID:1580
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"101⤵PID:2084
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"102⤵PID:3060
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"102⤵PID:2888
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"103⤵PID:1852
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"103⤵PID:2044
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"104⤵PID:992
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"104⤵PID:2868
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"105⤵PID:2092
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"105⤵PID:2540
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"106⤵PID:2904
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"106⤵PID:2184
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"107⤵PID:1444
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"107⤵PID:2588
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"108⤵PID:2784
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"108⤵PID:2676
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"109⤵PID:1272
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"109⤵PID:1760
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"110⤵PID:2500
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"110⤵PID:2348
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"111⤵PID:2928
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"111⤵PID:900
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"112⤵PID:2540
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"112⤵PID:2456
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"113⤵PID:2104
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"113⤵PID:2444
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"114⤵PID:2060
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"114⤵PID:2892
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"115⤵PID:1496
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"115⤵PID:2508
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"116⤵PID:2888
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"116⤵PID:1560
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"117⤵PID:2764
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"117⤵PID:1760
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"118⤵PID:1576
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"118⤵PID:2600
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"119⤵PID:2624
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"119⤵PID:2200
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"120⤵PID:2012
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"120⤵PID:264
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"121⤵PID:2444
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"121⤵PID:1960
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-