Overview
overview
10Static
static
105a6af1e38c...72.exe
windows7-x64
105a6af1e38c...72.exe
windows10-2004-x64
105aa23263dd...98.exe
windows7-x64
105aa23263dd...98.exe
windows10-2004-x64
105ab4e24c19...29.exe
windows7-x64
105ab4e24c19...29.exe
windows10-2004-x64
105aba888925...87.exe
windows7-x64
105aba888925...87.exe
windows10-2004-x64
105af4910e24...d0.exe
windows7-x64
15af4910e24...d0.exe
windows10-2004-x64
15b286cfa62...21.exe
windows7-x64
105b286cfa62...21.exe
windows10-2004-x64
105b4ca84a7e...6d.exe
windows7-x64
105b4ca84a7e...6d.exe
windows10-2004-x64
105b62e114e9...9d.exe
windows7-x64
105b62e114e9...9d.exe
windows10-2004-x64
105b70645dfb...94.exe
windows7-x64
105b70645dfb...94.exe
windows10-2004-x64
105bc9cb6ad0...0b.exe
windows7-x64
105bc9cb6ad0...0b.exe
windows10-2004-x64
85bd53b90c9...e5.exe
windows7-x64
105bd53b90c9...e5.exe
windows10-2004-x64
105be338c227...47.exe
windows7-x64
105be338c227...47.exe
windows10-2004-x64
105bf9504e15...35.exe
windows7-x64
55bf9504e15...35.exe
windows10-2004-x64
75c267be2da...25.exe
windows7-x64
35c267be2da...25.exe
windows10-2004-x64
35c4c8e3473...e2.exe
windows7-x64
105c4c8e3473...e2.exe
windows10-2004-x64
105c55fbcb2e...2a.exe
windows7-x64
105c55fbcb2e...2a.exe
windows10-2004-x64
10Analysis
-
max time kernel
31s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:11
Behavioral task
behavioral1
Sample
5a6af1e38c007c3572a78c7fe575e08674cfcea126ef351ce83f213af9aa8772.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5a6af1e38c007c3572a78c7fe575e08674cfcea126ef351ce83f213af9aa8772.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
5aa23263dd63c1541c3d7e776e5f8f98.exe
Resource
win7-20250207-en
Behavioral task
behavioral4
Sample
5aa23263dd63c1541c3d7e776e5f8f98.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
5ab4e24c19920bf215f60ccceeb4a0641f6ac404665f99abcea4eec4aa2aa529.exe
Resource
win7-20250207-en
Behavioral task
behavioral6
Sample
5ab4e24c19920bf215f60ccceeb4a0641f6ac404665f99abcea4eec4aa2aa529.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
5aba8889254015bbafbba1cca9d776bb318bd21a60106974f250dceefbfe2987.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
5aba8889254015bbafbba1cca9d776bb318bd21a60106974f250dceefbfe2987.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
5af4910e242c77f6b6e68a0ac29292d0.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
5af4910e242c77f6b6e68a0ac29292d0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
5b286cfa6293d55ebb9adf9591836714279b8032e91bd9794f1f37c02fa50321.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
5b286cfa6293d55ebb9adf9591836714279b8032e91bd9794f1f37c02fa50321.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
5b4ca84a7ecc5e29784e9ab2f73a1d242a4b52768134018c3498688f286f986d.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
5b4ca84a7ecc5e29784e9ab2f73a1d242a4b52768134018c3498688f286f986d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
5b62e114e9c9713eda5a0e6b5d9d889d.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
5b62e114e9c9713eda5a0e6b5d9d889d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral19
Sample
5bc9cb6ad0fa3859ec1f5aa542d9350b.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
5bc9cb6ad0fa3859ec1f5aa542d9350b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
5bd53b90c9a087f62175a657969ca112ea270bf5677a4a0dfb8eb383c2d1f4e5.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
5bd53b90c9a087f62175a657969ca112ea270bf5677a4a0dfb8eb383c2d1f4e5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
5be338c227e46f56eb13670ecc6ba26209097332f30411531456d5d829cbf547.exe
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
5be338c227e46f56eb13670ecc6ba26209097332f30411531456d5d829cbf547.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
5bf9504e15f844a8d96c9b05341934f0ccb027ad5ab74cbc28c1678cd7e91b35.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
5bf9504e15f844a8d96c9b05341934f0ccb027ad5ab74cbc28c1678cd7e91b35.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
5c267be2da7a03e076603b32034d402c1cbe54ec38a6742cbeeabb5186de3125.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
5c267be2da7a03e076603b32034d402c1cbe54ec38a6742cbeeabb5186de3125.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral29
Sample
5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe
Resource
win7-20240903-en
General
-
Target
5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe
-
Size
770KB
-
MD5
512de90549a0ffd01db566d4e69afa97
-
SHA1
193cce38892758314db86d16fbc1e6a07008729c
-
SHA256
5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2
-
SHA512
fdbe1b71231057d8b1c25c9a152a846d0860f5f9a3e1942a877f691d5f39e702fafe14b0e9a2e7e21dfa427fed6d20b6fe33109dd82a53fda7b2271ed9c7b177
-
SSDEEP
12288:2Cg/vC4AAY6NkAI9gNoDUCvUMMyRx0E6eKJQ0qnkf29Bq:2C4vCNAEAwgNIUUz0E1KJQBnkMq
Malware Config
Extracted
xworm
127.0.0.1:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral30/files/0x000500000002176d-14.dat family_xworm behavioral30/memory/640-21-0x0000000000690000-0x00000000006A2000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation 5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe -
Executes dropped EXE 64 IoCs
pid Process 640 XClient.exe 1492 Output.exe 4424 XClient.exe 4532 Output.exe 4656 XClient.exe 4540 Output.exe 2632 XClient.exe 1524 Output.exe 2304 XClient.exe 2400 Output.exe 1280 XClient.exe 4924 Output.exe 452 XClient.exe 4748 Output.exe 1088 XClient.exe 1300 Output.exe 3728 XClient.exe 4308 Output.exe 1700 XClient.exe 1464 Output.exe 1156 XClient.exe 5532 Output.exe 3084 XClient.exe 3376 Output.exe 1136 XClient.exe 2464 Output.exe 972 XClient.exe 3860 Output.exe 5868 XClient.exe 5972 Output.exe 1692 XClient.exe 3304 Output.exe 3632 XClient.exe 3464 Output.exe 3888 XClient.exe 1212 Output.exe 1512 XClient.exe 5528 Output.exe 3732 XClient.exe 4184 Output.exe 5668 XClient.exe 5772 Output.exe 1812 XClient.exe 1900 Output.exe 4968 XClient.exe 5320 Output.exe 6108 XClient.exe 5204 Output.exe 2848 XClient.exe 3244 Output.exe 4356 XClient.exe 464 Output.exe 2284 XClient.exe 948 Output.exe 1620 XClient.exe 4964 Output.exe 4640 XClient.exe 1996 Output.exe 4936 XClient.exe 4872 Output.exe 4796 XClient.exe 3744 Output.exe 4748 XClient.exe 688 Output.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 640 XClient.exe Token: SeDebugPrivilege 4424 XClient.exe Token: SeDebugPrivilege 4656 XClient.exe Token: SeDebugPrivilege 2632 XClient.exe Token: SeDebugPrivilege 2304 XClient.exe Token: SeDebugPrivilege 1280 XClient.exe Token: SeDebugPrivilege 452 XClient.exe Token: SeDebugPrivilege 1088 XClient.exe Token: SeDebugPrivilege 3728 XClient.exe Token: SeDebugPrivilege 1700 XClient.exe Token: SeDebugPrivilege 1156 XClient.exe Token: SeDebugPrivilege 3084 XClient.exe Token: SeDebugPrivilege 1136 XClient.exe Token: SeDebugPrivilege 972 XClient.exe Token: SeDebugPrivilege 5868 XClient.exe Token: SeDebugPrivilege 1692 XClient.exe Token: SeDebugPrivilege 3632 XClient.exe Token: SeDebugPrivilege 3888 XClient.exe Token: SeDebugPrivilege 1512 XClient.exe Token: SeDebugPrivilege 3732 XClient.exe Token: SeDebugPrivilege 5668 XClient.exe Token: SeDebugPrivilege 1812 XClient.exe Token: SeDebugPrivilege 4968 XClient.exe Token: SeDebugPrivilege 6108 XClient.exe Token: SeDebugPrivilege 2848 XClient.exe Token: SeDebugPrivilege 4356 XClient.exe Token: SeDebugPrivilege 2284 XClient.exe Token: SeDebugPrivilege 1620 XClient.exe Token: SeDebugPrivilege 4640 XClient.exe Token: SeDebugPrivilege 4936 XClient.exe Token: SeDebugPrivilege 4796 XClient.exe Token: SeDebugPrivilege 4748 XClient.exe Token: SeDebugPrivilege 4692 XClient.exe Token: SeDebugPrivilege 848 XClient.exe Token: SeDebugPrivilege 2840 XClient.exe Token: SeDebugPrivilege 728 XClient.exe Token: SeDebugPrivilege 376 XClient.exe Token: SeDebugPrivilege 5512 XClient.exe Token: SeDebugPrivilege 1352 XClient.exe Token: SeDebugPrivilege 4040 XClient.exe Token: SeDebugPrivilege 5772 XClient.exe Token: SeDebugPrivilege 4960 XClient.exe Token: SeDebugPrivilege 1232 XClient.exe Token: SeDebugPrivilege 5204 XClient.exe Token: SeDebugPrivilege 2028 XClient.exe Token: SeDebugPrivilege 5524 XClient.exe Token: SeDebugPrivilege 4592 XClient.exe Token: SeDebugPrivilege 4516 XClient.exe Token: SeDebugPrivilege 4964 XClient.exe Token: SeDebugPrivilege 1524 XClient.exe Token: SeDebugPrivilege 1700 XClient.exe Token: SeDebugPrivilege 3744 XClient.exe Token: SeDebugPrivilege 2076 XClient.exe Token: SeDebugPrivilege 1668 XClient.exe Token: SeDebugPrivilege 2084 XClient.exe Token: SeDebugPrivilege 6096 XClient.exe Token: SeDebugPrivilege 3364 XClient.exe Token: SeDebugPrivilege 5464 XClient.exe Token: SeDebugPrivilege 4856 XClient.exe Token: SeDebugPrivilege 5116 XClient.exe Token: SeDebugPrivilege 5796 XClient.exe Token: SeDebugPrivilege 4992 XClient.exe Token: SeDebugPrivilege 5228 XClient.exe Token: SeDebugPrivilege 3024 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 640 2812 5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe 89 PID 2812 wrote to memory of 640 2812 5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe 89 PID 2812 wrote to memory of 1492 2812 5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe 90 PID 2812 wrote to memory of 1492 2812 5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe 90 PID 1492 wrote to memory of 4424 1492 Output.exe 91 PID 1492 wrote to memory of 4424 1492 Output.exe 91 PID 1492 wrote to memory of 4532 1492 Output.exe 92 PID 1492 wrote to memory of 4532 1492 Output.exe 92 PID 4532 wrote to memory of 4656 4532 Output.exe 93 PID 4532 wrote to memory of 4656 4532 Output.exe 93 PID 4532 wrote to memory of 4540 4532 Output.exe 94 PID 4532 wrote to memory of 4540 4532 Output.exe 94 PID 4540 wrote to memory of 2632 4540 Output.exe 95 PID 4540 wrote to memory of 2632 4540 Output.exe 95 PID 4540 wrote to memory of 1524 4540 Output.exe 187 PID 4540 wrote to memory of 1524 4540 Output.exe 187 PID 1524 wrote to memory of 2304 1524 Output.exe 333 PID 1524 wrote to memory of 2304 1524 Output.exe 333 PID 1524 wrote to memory of 2400 1524 Output.exe 98 PID 1524 wrote to memory of 2400 1524 Output.exe 98 PID 2400 wrote to memory of 1280 2400 Output.exe 99 PID 2400 wrote to memory of 1280 2400 Output.exe 99 PID 2400 wrote to memory of 4924 2400 Output.exe 323 PID 2400 wrote to memory of 4924 2400 Output.exe 323 PID 4924 wrote to memory of 452 4924 Output.exe 101 PID 4924 wrote to memory of 452 4924 Output.exe 101 PID 4924 wrote to memory of 4748 4924 Output.exe 151 PID 4924 wrote to memory of 4748 4924 Output.exe 151 PID 4748 wrote to memory of 1088 4748 Output.exe 103 PID 4748 wrote to memory of 1088 4748 Output.exe 103 PID 4748 wrote to memory of 1300 4748 Output.exe 232 PID 4748 wrote to memory of 1300 4748 Output.exe 232 PID 1300 wrote to memory of 3728 1300 Output.exe 105 PID 1300 wrote to memory of 3728 1300 Output.exe 105 PID 1300 wrote to memory of 4308 1300 Output.exe 396 PID 1300 wrote to memory of 4308 1300 Output.exe 396 PID 4308 wrote to memory of 1700 4308 Output.exe 189 PID 4308 wrote to memory of 1700 4308 Output.exe 189 PID 4308 wrote to memory of 1464 4308 Output.exe 108 PID 4308 wrote to memory of 1464 4308 Output.exe 108 PID 1464 wrote to memory of 1156 1464 Output.exe 109 PID 1464 wrote to memory of 1156 1464 Output.exe 109 PID 1464 wrote to memory of 5532 1464 Output.exe 236 PID 1464 wrote to memory of 5532 1464 Output.exe 236 PID 5532 wrote to memory of 3084 5532 Output.exe 111 PID 5532 wrote to memory of 3084 5532 Output.exe 111 PID 5532 wrote to memory of 3376 5532 Output.exe 112 PID 5532 wrote to memory of 3376 5532 Output.exe 112 PID 3376 wrote to memory of 1136 3376 Output.exe 113 PID 3376 wrote to memory of 1136 3376 Output.exe 113 PID 3376 wrote to memory of 2464 3376 Output.exe 114 PID 3376 wrote to memory of 2464 3376 Output.exe 114 PID 2464 wrote to memory of 972 2464 Output.exe 431 PID 2464 wrote to memory of 972 2464 Output.exe 431 PID 2464 wrote to memory of 3860 2464 Output.exe 116 PID 2464 wrote to memory of 3860 2464 Output.exe 116 PID 3860 wrote to memory of 5868 3860 Output.exe 117 PID 3860 wrote to memory of 5868 3860 Output.exe 117 PID 3860 wrote to memory of 5972 3860 Output.exe 118 PID 3860 wrote to memory of 5972 3860 Output.exe 118 PID 5972 wrote to memory of 1692 5972 Output.exe 119 PID 5972 wrote to memory of 1692 5972 Output.exe 119 PID 5972 wrote to memory of 3304 5972 Output.exe 120 PID 5972 wrote to memory of 3304 5972 Output.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe"C:\Users\Admin\AppData\Local\Temp\5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5868
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"18⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"19⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"20⤵
- Executes dropped EXE
PID:5528 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"21⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5668
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"22⤵
- Executes dropped EXE
PID:5772 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"23⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"24⤵
- Executes dropped EXE
PID:5320 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6108
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:5204 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"27⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"28⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"29⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"30⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"31⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"32⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"33⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"34⤵PID:3252
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"35⤵PID:5056
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"36⤵
- Checks computer location settings
PID:1132 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:728
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"37⤵PID:3696
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"38⤵PID:4972
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"39⤵PID:4712
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"40⤵PID:2308
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"41⤵PID:5916
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"42⤵PID:4488
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"43⤵PID:4620
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"44⤵PID:3960
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:5204
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"45⤵
- Checks computer location settings
PID:2116 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"46⤵
- Checks computer location settings
PID:4720 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:5524
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"47⤵
- Checks computer location settings
PID:1796 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"48⤵PID:5904
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"49⤵PID:724
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"50⤵PID:3076
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"51⤵PID:2656
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"52⤵PID:4716
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"53⤵
- Checks computer location settings
PID:1364 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"54⤵PID:4996
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"55⤵PID:4244
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"56⤵PID:2720
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"57⤵
- Checks computer location settings
PID:4248 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"58⤵PID:1168
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:5464
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"59⤵PID:4972
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"60⤵PID:1016
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"61⤵PID:5756
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"62⤵PID:2396
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"63⤵PID:2624
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5228
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"64⤵
- Checks computer location settings
PID:5644 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"65⤵PID:1800
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"66⤵PID:5196
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"66⤵PID:4664
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"67⤵PID:5740
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"67⤵
- Checks computer location settings
PID:4968 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"68⤵PID:3788
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"68⤵PID:6108
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"69⤵PID:4520
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"69⤵PID:2144
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"70⤵PID:5340
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"70⤵PID:4364
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"71⤵PID:4924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"71⤵
- Checks computer location settings
PID:3992 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"72⤵PID:2284
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"72⤵
- Checks computer location settings
PID:4348 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"73⤵PID:1620
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"73⤵
- Checks computer location settings
PID:1300 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"74⤵PID:3980
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"74⤵PID:868
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"75⤵PID:3512
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"75⤵
- Checks computer location settings
PID:5532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"76⤵PID:5056
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"76⤵PID:5616
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"77⤵PID:4832
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"77⤵PID:3700
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"78⤵PID:1112
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"78⤵
- Checks computer location settings
PID:1664 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"79⤵PID:2948
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"79⤵
- Checks computer location settings
PID:3888 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"80⤵PID:1376
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"80⤵PID:3656
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"81⤵PID:5084
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"81⤵PID:4512
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"82⤵PID:4804
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"82⤵PID:5568
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"83⤵PID:5836
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"83⤵
- Checks computer location settings
PID:3008 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"84⤵PID:2096
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"84⤵
- Checks computer location settings
PID:3056 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"85⤵PID:3456
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"85⤵
- Checks computer location settings
PID:3032 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"86⤵PID:3964
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"86⤵PID:5952
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"87⤵PID:5908
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"87⤵PID:1124
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"88⤵PID:3876
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"88⤵PID:3628
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"89⤵PID:5820
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"89⤵
- Checks computer location settings
PID:4668 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"90⤵PID:2756
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"90⤵PID:5000
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"91⤵PID:4640
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"91⤵PID:3400
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"92⤵PID:4816
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"92⤵PID:4064
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"93⤵PID:3696
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"93⤵PID:4248
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"94⤵PID:5176
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"94⤵PID:2540
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"95⤵PID:4980
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"95⤵PID:5516
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"96⤵PID:5816
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"96⤵PID:5636
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"97⤵PID:428
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"97⤵PID:5624
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"98⤵PID:2040
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"98⤵PID:1904
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"99⤵PID:4868
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"99⤵
- Checks computer location settings
PID:5024 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"100⤵PID:4688
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"100⤵
- Checks computer location settings
PID:1744 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"101⤵PID:5680
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"101⤵PID:5788
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"102⤵PID:1100
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"102⤵PID:1212
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"103⤵PID:5032
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"103⤵PID:4328
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"104⤵PID:4040
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"104⤵PID:5436
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"105⤵PID:3224
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"105⤵PID:4988
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"106⤵PID:4508
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"106⤵PID:5576
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"107⤵PID:3944
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"107⤵PID:3640
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"108⤵PID:436
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"108⤵PID:2140
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"109⤵PID:2032
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"109⤵
- Checks computer location settings
PID:5416 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"110⤵PID:3316
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"110⤵
- Checks computer location settings
PID:3920 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"111⤵PID:4964
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"111⤵
- Checks computer location settings
PID:4064 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"112⤵PID:2728
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"112⤵PID:4692
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"113⤵PID:2152
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"113⤵PID:5036
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"114⤵PID:2248
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"114⤵PID:2164
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"115⤵PID:1616
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"115⤵PID:4976
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"116⤵PID:688
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"116⤵PID:1164
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"117⤵PID:1060
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"117⤵PID:972
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"118⤵PID:6008
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"118⤵PID:5988
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"119⤵PID:3380
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"119⤵PID:5484
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"120⤵PID:3008
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"120⤵PID:3804
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"121⤵PID:4860
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"121⤵PID:2304
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"122⤵PID:4672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-