Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows7_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
6s -
max time network
214s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-07-2021 17:51
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
setup_x86_x64_install - копия (3).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
Errors
General
-
Target
setup_x86_x64_install - копия (22).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
resource yara_rule behavioral28/memory/1272-363-0x0000000005710000-0x0000000005D16000-memory.dmp Discord_stealer behavioral28/memory/3192-368-0x00000000052C0000-0x00000000058C6000-memory.dmp Discord_stealer -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 4928 rUNdlL32.eXe 104 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 9 IoCs
resource yara_rule behavioral28/memory/32-216-0x0000000000417F26-mapping.dmp family_redline behavioral28/memory/32-210-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral28/memory/1088-240-0x0000000002C10000-0x0000000002C48000-memory.dmp family_redline behavioral28/memory/1272-363-0x0000000005710000-0x0000000005D16000-memory.dmp family_redline behavioral28/memory/3192-368-0x00000000052C0000-0x00000000058C6000-memory.dmp family_redline behavioral28/memory/3112-365-0x0000000000417E4A-mapping.dmp family_redline behavioral28/memory/3192-358-0x0000000000417E96-mapping.dmp family_redline behavioral28/memory/3736-356-0x0000000000417E8E-mapping.dmp family_redline behavioral28/memory/1272-353-0x0000000000418392-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral28/memory/3076-298-0x0000000000400000-0x0000000000949000-memory.dmp Vidar -
resource yara_rule behavioral28/files/0x000100000001ab87-118.dat aspack_v212_v242 behavioral28/files/0x000100000001ab83-120.dat aspack_v212_v242 behavioral28/files/0x000100000001ab83-122.dat aspack_v212_v242 behavioral28/files/0x000100000001ab85-129.dat aspack_v212_v242 behavioral28/files/0x000100000001ab85-127.dat aspack_v212_v242 behavioral28/files/0x000100000001ab82-124.dat aspack_v212_v242 behavioral28/files/0x000100000001ab82-121.dat aspack_v212_v242 behavioral28/files/0x000100000001ab87-119.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 2688 setup_installer.exe 2392 setup_install.exe 3672 arnatic_3.exe 3464 arnatic_4.exe 3076 arnatic_1.exe 1144 arnatic_2.exe 1040 arnatic_5.exe 1504 arnatic_7.exe 1768 arnatic_6.exe -
resource yara_rule behavioral28/files/0x000100000001ab8b-175.dat upx behavioral28/files/0x000100000001ab8b-174.dat upx behavioral28/files/0x000200000001ab8a-289.dat upx behavioral28/files/0x000200000001ab8a-290.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_3.exe -
Loads dropped DLL 5 IoCs
pid Process 2392 setup_install.exe 2392 setup_install.exe 2392 setup_install.exe 2392 setup_install.exe 2392 setup_install.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2080 icacls.exe -
resource yara_rule behavioral28/files/0x000100000001abd8-326.dat themida behavioral28/files/0x000100000001abd8-325.dat themida behavioral28/files/0x000100000001abcf-324.dat themida behavioral28/files/0x000100000001abcf-323.dat themida behavioral28/files/0x000100000001abcc-320.dat themida behavioral28/files/0x000100000001abcc-319.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 54 ipinfo.io 215 checkip.amazonaws.com 236 api.2ip.ua 237 api.2ip.ua 275 api.2ip.ua 10 ip-api.com 53 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5536 3736 WerFault.exe 138 -
Delays execution with timeout.exe 3 IoCs
pid Process 5848 timeout.exe 5436 timeout.exe 5632 timeout.exe -
Kills process with taskkill 3 IoCs
pid Process 5584 taskkill.exe 4748 taskkill.exe 1920 taskkill.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4044 wrote to memory of 2688 4044 setup_x86_x64_install - копия (22).exe 76 PID 4044 wrote to memory of 2688 4044 setup_x86_x64_install - копия (22).exe 76 PID 4044 wrote to memory of 2688 4044 setup_x86_x64_install - копия (22).exe 76 PID 2688 wrote to memory of 2392 2688 setup_installer.exe 77 PID 2688 wrote to memory of 2392 2688 setup_installer.exe 77 PID 2688 wrote to memory of 2392 2688 setup_installer.exe 77 PID 2392 wrote to memory of 2864 2392 setup_install.exe 80 PID 2392 wrote to memory of 2864 2392 setup_install.exe 80 PID 2392 wrote to memory of 2864 2392 setup_install.exe 80 PID 2392 wrote to memory of 2312 2392 setup_install.exe 81 PID 2392 wrote to memory of 2312 2392 setup_install.exe 81 PID 2392 wrote to memory of 2312 2392 setup_install.exe 81 PID 2392 wrote to memory of 1920 2392 setup_install.exe 95 PID 2392 wrote to memory of 1920 2392 setup_install.exe 95 PID 2392 wrote to memory of 1920 2392 setup_install.exe 95 PID 2392 wrote to memory of 1116 2392 setup_install.exe 82 PID 2392 wrote to memory of 1116 2392 setup_install.exe 82 PID 2392 wrote to memory of 1116 2392 setup_install.exe 82 PID 2392 wrote to memory of 1276 2392 setup_install.exe 83 PID 2392 wrote to memory of 1276 2392 setup_install.exe 83 PID 2392 wrote to memory of 1276 2392 setup_install.exe 83 PID 2392 wrote to memory of 3976 2392 setup_install.exe 94 PID 2392 wrote to memory of 3976 2392 setup_install.exe 94 PID 2392 wrote to memory of 3976 2392 setup_install.exe 94 PID 2392 wrote to memory of 4016 2392 setup_install.exe 84 PID 2392 wrote to memory of 4016 2392 setup_install.exe 84 PID 2392 wrote to memory of 4016 2392 setup_install.exe 84 PID 1920 wrote to memory of 3672 1920 cmd.exe 85 PID 1920 wrote to memory of 3672 1920 cmd.exe 85 PID 1920 wrote to memory of 3672 1920 cmd.exe 85 PID 1116 wrote to memory of 3464 1116 cmd.exe 90 PID 1116 wrote to memory of 3464 1116 cmd.exe 90 PID 1116 wrote to memory of 3464 1116 cmd.exe 90 PID 2864 wrote to memory of 3076 2864 cmd.exe 92 PID 2864 wrote to memory of 3076 2864 cmd.exe 92 PID 2864 wrote to memory of 3076 2864 cmd.exe 92 PID 2312 wrote to memory of 1144 2312 cmd.exe 89 PID 2312 wrote to memory of 1144 2312 cmd.exe 89 PID 2312 wrote to memory of 1144 2312 cmd.exe 89 PID 1276 wrote to memory of 1040 1276 cmd.exe 88 PID 1276 wrote to memory of 1040 1276 cmd.exe 88 PID 4016 wrote to memory of 1504 4016 cmd.exe 87 PID 4016 wrote to memory of 1504 4016 cmd.exe 87 PID 4016 wrote to memory of 1504 4016 cmd.exe 87 PID 3976 wrote to memory of 1768 3976 cmd.exe 86 PID 3976 wrote to memory of 1768 3976 cmd.exe 86 PID 3976 wrote to memory of 1768 3976 cmd.exe 86 PID 1504 wrote to memory of 32 1504 arnatic_7.exe 91 PID 1504 wrote to memory of 32 1504 arnatic_7.exe 91 PID 1504 wrote to memory of 32 1504 arnatic_7.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (22).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (22).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS08A76914\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
PID:3076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵PID:4296
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
PID:5584
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:5848
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
PID:1144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5004
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Roaming\1955124.exe"C:\Users\Admin\AppData\Roaming\1955124.exe"6⤵PID:2156
-
-
C:\Users\Admin\AppData\Roaming\4772732.exe"C:\Users\Admin\AppData\Roaming\4772732.exe"6⤵PID:1348
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:4652
-
-
-
C:\Users\Admin\AppData\Roaming\2600560.exe"C:\Users\Admin\AppData\Roaming\2600560.exe"6⤵PID:4228
-
-
C:\Users\Admin\AppData\Roaming\7364241.exe"C:\Users\Admin\AppData\Roaming\7364241.exe"6⤵PID:1088
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_7.exe6⤵PID:32
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_3.exearnatic_3.exe1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3672 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub2⤵PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\7zS08A76914\arnatic_6.exearnatic_6.exe1⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"2⤵PID:4208
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exeC:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe3⤵PID:5276
-
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exeC:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe3⤵PID:1840
-
-
-
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"2⤵PID:692
-
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exeC:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe3⤵PID:3192
-
-
-
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"2⤵PID:4676
-
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exeC:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe3⤵PID:1272
-
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"2⤵PID:4648
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe3⤵PID:2600
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe3⤵PID:3112
-
-
-
C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"2⤵PID:3080
-
-
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"2⤵PID:4604
-
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"3⤵PID:5800
-
-
-
C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"2⤵PID:4780
-
-
C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"2⤵PID:4140
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 0_XSTRGW2QmRpZsbH5IoFNSD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe" & del C:\ProgramData\*.dll & exit3⤵PID:5152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 0_XSTRGW2QmRpZsbH5IoFNSD.exe /f4⤵
- Kills process with taskkill
PID:1920
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5632
-
-
-
-
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"2⤵PID:152
-
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exeC:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe3⤵PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 244⤵
- Program crash
PID:5536
-
-
-
-
C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"2⤵PID:192
-
-
C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"2⤵PID:4820
-
-
C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"2⤵PID:4792
-
-
C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"2⤵PID:3088
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵PID:4744
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5808
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:744
-
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"3⤵PID:4392
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl4⤵PID:4188
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:4840
-
-
-
C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"2⤵PID:5016
-
-
C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"2⤵PID:5012
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru3⤵PID:4304
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ff8428c4f50,0x7ff8428c4f60,0x7ff8428c4f704⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1536 /prefetch:24⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2092 /prefetch:84⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 /prefetch:84⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:14⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:14⤵PID:5280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:14⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:14⤵PID:5384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:14⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4120 /prefetch:84⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:14⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:84⤵PID:152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1864 /prefetch:84⤵PID:5952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:84⤵PID:5164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:84⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵PID:2128
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff64932a890,0x7ff64932a8a0,0x7ff64932a8b05⤵PID:5112
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:84⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:84⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6140 /prefetch:84⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5992 /prefetch:84⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:84⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3792 /prefetch:84⤵PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:84⤵PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4068 /prefetch:84⤵PID:5468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:84⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6136 /prefetch:84⤵PID:5192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1412 /prefetch:84⤵PID:5404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:84⤵PID:5524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:84⤵PID:5516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:84⤵PID:5444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1864 /prefetch:84⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3584 /prefetch:84⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 /prefetch:84⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7084 /prefetch:84⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6948 /prefetch:84⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6812 /prefetch:84⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5272 /prefetch:84⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7264 /prefetch:84⤵PID:956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7252 /prefetch:84⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7240 /prefetch:84⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7228 /prefetch:84⤵PID:5992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6172 /prefetch:84⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1784 /prefetch:84⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6932 /prefetch:84⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7080 /prefetch:84⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,16303566309468708983,6455704166652998295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:84⤵PID:4748
-
-
-
-
C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe"C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe"2⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im jMY7GilChxHnK0oIK3nl4cxV.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe" & del C:\ProgramData\*.dll & exit3⤵PID:2156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im jMY7GilChxHnK0oIK3nl4cxV.exe /f4⤵
- Kills process with taskkill
PID:4748
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5436
-
-
-
-
C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"2⤵PID:4000
-
C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe" -a3⤵PID:5948
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:3116
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:5616
-
-
C:\Users\Admin\AppData\Local\Temp\7C8F.exeC:\Users\Admin\AppData\Local\Temp\7C8F.exe1⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7C8F.exeC:\Users\Admin\AppData\Local\Temp\7C8F.exe2⤵PID:1708
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\aebceafa-4db1-4972-b517-634c9fe65b53" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\7C8F.exe"C:\Users\Admin\AppData\Local\Temp\7C8F.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7C8F.exe"C:\Users\Admin\AppData\Local\Temp\7C8F.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:4112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8F3D.exeC:\Users\Admin\AppData\Local\Temp\8F3D.exe1⤵PID:4388