Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows7_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
7s -
max time network
263s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-07-2021 17:51
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
setup_x86_x64_install - копия (3).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
Errors
General
-
Target
setup_x86_x64_install - копия (21).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral25/memory/2400-294-0x0000000002E40000-0x0000000003766000-memory.dmp family_glupteba behavioral25/memory/2400-295-0x0000000000400000-0x0000000000DE1000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral25/memory/2256-182-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2256-183-0x0000000000417F26-mapping.dmp family_redline behavioral25/memory/2256-187-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2428-208-0x0000000000A00000-0x0000000000A38000-memory.dmp family_redline behavioral25/memory/1336-259-0x0000000000418392-mapping.dmp family_redline behavioral25/memory/2492-257-0x0000000000417E8E-mapping.dmp family_redline behavioral25/memory/304-264-0x0000000000417E4A-mapping.dmp family_redline behavioral25/memory/2900-256-0x0000000000417E96-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral25/memory/1612-200-0x00000000022F0000-0x000000000238D000-memory.dmp Vidar behavioral25/memory/1612-202-0x0000000000400000-0x0000000000949000-memory.dmp Vidar behavioral25/memory/2352-287-0x0000000000400000-0x00000000009C0000-memory.dmp Vidar behavioral25/memory/2352-286-0x0000000000270000-0x000000000029F000-memory.dmp Vidar -
resource yara_rule behavioral25/files/0x0003000000013110-69.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-71.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-70.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-73.dat aspack_v212_v242 behavioral25/files/0x000300000001310c-74.dat aspack_v212_v242 behavioral25/files/0x000300000001310c-75.dat aspack_v212_v242 behavioral25/files/0x000300000001310b-76.dat aspack_v212_v242 behavioral25/files/0x000300000001310b-77.dat aspack_v212_v242 behavioral25/files/0x000300000001310e-83.dat aspack_v212_v242 behavioral25/files/0x000300000001310e-82.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-88.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-87.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-86.dat aspack_v212_v242 behavioral25/files/0x0003000000013110-85.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 1756 setup_installer.exe 1296 setup_install.exe 1612 arnatic_1.exe 1304 arnatic_2.exe 1724 arnatic_3.exe 1628 arnatic_7.exe 1348 arnatic_5.exe 432 arnatic_6.exe -
Loads dropped DLL 30 IoCs
pid Process 108 setup_x86_x64_install - копия (21).exe 1756 setup_installer.exe 1756 setup_installer.exe 1756 setup_installer.exe 1756 setup_installer.exe 1756 setup_installer.exe 1756 setup_installer.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1296 setup_install.exe 1504 cmd.exe 948 cmd.exe 704 cmd.exe 948 cmd.exe 1504 cmd.exe 1612 arnatic_1.exe 1612 arnatic_1.exe 1304 arnatic_2.exe 1304 arnatic_2.exe 1520 cmd.exe 1724 arnatic_3.exe 1724 arnatic_3.exe 1796 cmd.exe 1520 cmd.exe 1992 cmd.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3688 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 282 api.2ip.ua 22 ipinfo.io 24 ipinfo.io 128 ip-api.com 226 checkip.amazonaws.com 281 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2576 1612 WerFault.exe 43 2056 2932 WerFault.exe 88 -
Kills process with taskkill 1 IoCs
pid Process 4004 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3460 PING.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 108 wrote to memory of 1756 108 setup_x86_x64_install - копия (21).exe 29 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1756 wrote to memory of 1296 1756 setup_installer.exe 30 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 948 1296 setup_install.exe 32 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 1504 1296 setup_install.exe 33 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 704 1296 setup_install.exe 34 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 436 1296 setup_install.exe 44 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1796 1296 setup_install.exe 35 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1992 1296 setup_install.exe 36 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 1296 wrote to memory of 1520 1296 setup_install.exe 37 PID 948 wrote to memory of 1612 948 cmd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (21).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 8726⤵
- Program crash
PID:2576
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵PID:2200
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Roaming\5993310.exe"C:\Users\Admin\AppData\Roaming\5993310.exe"6⤵PID:2340
-
-
C:\Users\Admin\AppData\Roaming\7475541.exe"C:\Users\Admin\AppData\Roaming\7475541.exe"6⤵PID:2392
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:2736
-
-
-
C:\Users\Admin\AppData\Roaming\1848023.exe"C:\Users\Admin\AppData\Roaming\1848023.exe"6⤵PID:2448
-
-
C:\Users\Admin\AppData\Roaming\7449125.exe"C:\Users\Admin\AppData\Roaming\7449125.exe"6⤵PID:2428
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"6⤵PID:1512
-
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exeC:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe7⤵PID:2492
-
-
-
C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"6⤵PID:932
-
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"6⤵PID:1648
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exeC:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe7⤵PID:3700
-
-
-
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"6⤵PID:1716
-
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"7⤵PID:3144
-
-
-
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"6⤵PID:2264
-
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exeC:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe7⤵PID:2900
-
-
-
C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"6⤵PID:2268
-
-
C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"6⤵PID:2228
-
-
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"6⤵PID:2232
-
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exeC:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe7⤵PID:1336
-
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"6⤵PID:1356
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe7⤵PID:1996
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe7⤵PID:304
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe7⤵PID:2500
-
-
-
C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"6⤵PID:2012
-
-
C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"6⤵PID:2200
-
-
C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"6⤵PID:2244
-
-
C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"6⤵PID:2608
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"7⤵PID:2168
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:3344
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:3124
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 2928⤵
- Program crash
PID:2056
-
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"7⤵PID:1076
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl8⤵PID:1220
-
-
-
-
C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"6⤵PID:2400
-
C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"7⤵PID:2556
-
-
-
C:\Users\Admin\Documents\8tamvkF3JGOozRcpkn7K4IZ2.exe"C:\Users\Admin\Documents\8tamvkF3JGOozRcpkn7K4IZ2.exe"6⤵PID:2352
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\48598974652.exe"7⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\48598974652.exe"C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\48598974652.exe"8⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Via.pst9⤵PID:3524
-
C:\Windows\SysWOW64\cmd.execmd10⤵PID:1076
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^tlSemPfKKHtYeILMlybXZRBSYbGlJvqJVEjBXzlIAbUyXeesdcOhdyxhJqrwptqgHxrnclOQUPvBXvUWcfUgHMzPlZSXdomcbFbDZDVyGX$" Uso.pst11⤵PID:3832
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comTuoi.exe.com T11⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T12⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T13⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tuoi.exe.com T14⤵PID:1804
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3011⤵
- Runs ping.exe
PID:3460
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\96336288529.exe" /mix7⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\96336288529.exe"C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\96336288529.exe" /mix8⤵PID:1836
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\06543750708.exe" /mix7⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\06543750708.exe"C:\Users\Admin\AppData\Local\Temp\{g3iH-FbfJJ-arqH-x6feq}\06543750708.exe" /mix8⤵PID:1828
-
C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exeedspolishpp.exe9⤵PID:3132
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "8tamvkF3JGOozRcpkn7K4IZ2.exe" /f & erase "C:\Users\Admin\Documents\8tamvkF3JGOozRcpkn7K4IZ2.exe" & exit7⤵PID:972
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "8tamvkF3JGOozRcpkn7K4IZ2.exe" /f8⤵
- Kills process with taskkill
PID:4004
-
-
-
-
C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"6⤵PID:2420
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru7⤵PID:1988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5b84f50,0x7fef5b84f60,0x7fef5b84f708⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:28⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1396 /prefetch:88⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 /prefetch:88⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:18⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:18⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:18⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:18⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:18⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:18⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3400 /prefetch:88⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,13203917393399529584,3984624746113846788,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1156 /prefetch:28⤵PID:3432
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSCD656F24\arnatic_7.exe6⤵PID:2256
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵PID:436
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\54D4.exeC:\Users\Admin\AppData\Local\Temp\54D4.exe1⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\54D4.exeC:\Users\Admin\AppData\Local\Temp\54D4.exe2⤵PID:3956
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\c0cb9949-6fde-4b30-93b7-616d58c04f3b" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3688
-
-
-
C:\Users\Admin\AppData\Local\Temp\5929.exeC:\Users\Admin\AppData\Local\Temp\5929.exe1⤵PID:2404