Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
84s -
max time network
640s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
01-09-2021 05:12
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
General
-
Target
Setup (13).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
31.08
95.181.152.47:15089
Extracted
redline
spnewportspectr
135.148.139.222:1594
Extracted
redline
NORMAN2
45.14.49.184:27587
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 14 IoCs
resource yara_rule behavioral9/memory/2548-183-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/2548-184-0x000000000041C6A6-mapping.dmp family_redline behavioral9/memory/2632-186-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/2580-181-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/2548-192-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/2696-194-0x000000000041C6A6-mapping.dmp family_redline behavioral9/memory/2580-189-0x000000000041C5CA-mapping.dmp family_redline behavioral9/memory/2580-200-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/2804-204-0x000000000041C6A6-mapping.dmp family_redline behavioral9/memory/2860-209-0x000000000041C5CA-mapping.dmp family_redline behavioral9/memory/2996-217-0x000000000041C5CA-mapping.dmp family_redline behavioral9/memory/1020-220-0x000000000041C5CA-mapping.dmp family_redline behavioral9/memory/2180-228-0x000000000041C5CA-mapping.dmp family_redline behavioral9/memory/1168-245-0x000000000041C5CA-mapping.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 864 csqtU6GxLZqxiqAT_AtoHLy7.exe 1728 i5GB1lXpvszF2qb56S2PbRIV.exe 1648 j2O6_XQNEUt_e2LUvCnISb2c.exe 1264 H0SmBgJRninCUuNu9w6Lb8Cb.exe 1564 4dk8O_Jr1bVxtzo3BcNtcpA3.exe 1768 bTVYoBWEtWK4hDQ7bBc9Mgfp.exe 944 QiY4uqtPEffuIM3Q4R_5sqUM.exe 980 YV3PMctqGBVTATt3wjSgYm08.exe 1488 L5jx_GwJd2XlK6fTZPqF0UYA.exe 568 BROH_hds3QN7adMpdfZEdMFm.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation Setup (13).exe -
Loads dropped DLL 18 IoCs
pid Process 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe 1828 Setup (13).exe -
resource yara_rule behavioral9/files/0x0003000000013135-94.dat themida behavioral9/files/0x0003000000013135-87.dat themida behavioral9/files/0x0003000000013158-101.dat themida behavioral9/files/0x0003000000013158-112.dat themida behavioral9/memory/1260-236-0x0000000001280000-0x0000000001281000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ipinfo.io 22 ipinfo.io 106 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1564 1768 WerFault.exe 39 -
Kills process with taskkill 1 IoCs
pid Process 2372 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (13).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (13).exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1828 Setup (13).exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1828 wrote to memory of 864 1828 Setup (13).exe 31 PID 1828 wrote to memory of 864 1828 Setup (13).exe 31 PID 1828 wrote to memory of 864 1828 Setup (13).exe 31 PID 1828 wrote to memory of 864 1828 Setup (13).exe 31 PID 1828 wrote to memory of 1728 1828 Setup (13).exe 32 PID 1828 wrote to memory of 1728 1828 Setup (13).exe 32 PID 1828 wrote to memory of 1728 1828 Setup (13).exe 32 PID 1828 wrote to memory of 1728 1828 Setup (13).exe 32 PID 1828 wrote to memory of 1648 1828 Setup (13).exe 33 PID 1828 wrote to memory of 1648 1828 Setup (13).exe 33 PID 1828 wrote to memory of 1648 1828 Setup (13).exe 33 PID 1828 wrote to memory of 1648 1828 Setup (13).exe 33 PID 1828 wrote to memory of 1264 1828 Setup (13).exe 40 PID 1828 wrote to memory of 1264 1828 Setup (13).exe 40 PID 1828 wrote to memory of 1264 1828 Setup (13).exe 40 PID 1828 wrote to memory of 1264 1828 Setup (13).exe 40 PID 1828 wrote to memory of 1768 1828 Setup (13).exe 39 PID 1828 wrote to memory of 1768 1828 Setup (13).exe 39 PID 1828 wrote to memory of 1768 1828 Setup (13).exe 39 PID 1828 wrote to memory of 1768 1828 Setup (13).exe 39 PID 1828 wrote to memory of 1564 1828 Setup (13).exe 38 PID 1828 wrote to memory of 1564 1828 Setup (13).exe 38 PID 1828 wrote to memory of 1564 1828 Setup (13).exe 38 PID 1828 wrote to memory of 1564 1828 Setup (13).exe 38 PID 1828 wrote to memory of 944 1828 Setup (13).exe 36 PID 1828 wrote to memory of 944 1828 Setup (13).exe 36 PID 1828 wrote to memory of 944 1828 Setup (13).exe 36 PID 1828 wrote to memory of 944 1828 Setup (13).exe 36 PID 1828 wrote to memory of 344 1828 Setup (13).exe 35 PID 1828 wrote to memory of 344 1828 Setup (13).exe 35 PID 1828 wrote to memory of 344 1828 Setup (13).exe 35 PID 1828 wrote to memory of 344 1828 Setup (13).exe 35 PID 1828 wrote to memory of 1488 1828 Setup (13).exe 37 PID 1828 wrote to memory of 1488 1828 Setup (13).exe 37 PID 1828 wrote to memory of 1488 1828 Setup (13).exe 37 PID 1828 wrote to memory of 1488 1828 Setup (13).exe 37 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 980 1828 Setup (13).exe 34 PID 1828 wrote to memory of 568 1828 Setup (13).exe 44 PID 1828 wrote to memory of 568 1828 Setup (13).exe 44 PID 1828 wrote to memory of 568 1828 Setup (13).exe 44 PID 1828 wrote to memory of 568 1828 Setup (13).exe 44 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46 PID 1828 wrote to memory of 1260 1828 Setup (13).exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\Documents\csqtU6GxLZqxiqAT_AtoHLy7.exe"C:\Users\Admin\Documents\csqtU6GxLZqxiqAT_AtoHLy7.exe"2⤵
- Executes dropped EXE
PID:864
-
-
C:\Users\Admin\Documents\i5GB1lXpvszF2qb56S2PbRIV.exe"C:\Users\Admin\Documents\i5GB1lXpvszF2qb56S2PbRIV.exe"2⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\Documents\i5GB1lXpvszF2qb56S2PbRIV.exe"C:\Users\Admin\Documents\i5GB1lXpvszF2qb56S2PbRIV.exe"3⤵PID:1612
-
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe"C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe"2⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:2580
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:2860
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:2996
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:1020
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:2180
-
-
C:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exeC:\Users\Admin\Documents\j2O6_XQNEUt_e2LUvCnISb2c.exe3⤵PID:1168
-
-
-
C:\Users\Admin\Documents\YV3PMctqGBVTATt3wjSgYm08.exe"C:\Users\Admin\Documents\YV3PMctqGBVTATt3wjSgYm08.exe"2⤵
- Executes dropped EXE
PID:980
-
-
C:\Users\Admin\Documents\rid51IgjxilquphvCQJcdqkS.exe"C:\Users\Admin\Documents\rid51IgjxilquphvCQJcdqkS.exe"2⤵PID:344
-
-
C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe"C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe"2⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exeC:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe3⤵PID:2548
-
-
C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exeC:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe3⤵PID:2912
-
-
C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exeC:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe3⤵PID:2804
-
-
C:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exeC:\Users\Admin\Documents\QiY4uqtPEffuIM3Q4R_5sqUM.exe3⤵PID:2696
-
-
-
C:\Users\Admin\Documents\L5jx_GwJd2XlK6fTZPqF0UYA.exe"C:\Users\Admin\Documents\L5jx_GwJd2XlK6fTZPqF0UYA.exe"2⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"3⤵PID:1628
-
-
-
C:\Users\Admin\Documents\4dk8O_Jr1bVxtzo3BcNtcpA3.exe"C:\Users\Admin\Documents\4dk8O_Jr1bVxtzo3BcNtcpA3.exe"2⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\79834990177.exe"3⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\79834990177.exe"C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\79834990177.exe"4⤵PID:2736
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\39652947978.exe" /mix3⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\39652947978.exe"C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\39652947978.exe" /mix4⤵PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\78627136551.exe" /mix3⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\78627136551.exe"C:\Users\Admin\AppData\Local\Temp\{wUTh-WmSfw-YKl7-L9M9p}\78627136551.exe" /mix4⤵PID:2724
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4dk8O_Jr1bVxtzo3BcNtcpA3.exe" /f & erase "C:\Users\Admin\Documents\4dk8O_Jr1bVxtzo3BcNtcpA3.exe" & exit3⤵PID:2052
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4dk8O_Jr1bVxtzo3BcNtcpA3.exe" /f4⤵
- Kills process with taskkill
PID:2372
-
-
-
-
C:\Users\Admin\Documents\bTVYoBWEtWK4hDQ7bBc9Mgfp.exe"C:\Users\Admin\Documents\bTVYoBWEtWK4hDQ7bBc9Mgfp.exe"2⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 7083⤵
- Program crash
PID:1564
-
-
-
C:\Users\Admin\Documents\H0SmBgJRninCUuNu9w6Lb8Cb.exe"C:\Users\Admin\Documents\H0SmBgJRninCUuNu9w6Lb8Cb.exe"2⤵
- Executes dropped EXE
PID:1264 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:1968
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵PID:1900
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.0.2103934690\1068854837" -parentBuildID 20200403170909 -prefsHandle 1144 -prefMapHandle 1136 -prefsLen 1 -prefMapSize 218938 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 1212 gpu5⤵PID:2220
-
-
-
-
-
C:\Users\Admin\Documents\BROH_hds3QN7adMpdfZEdMFm.exe"C:\Users\Admin\Documents\BROH_hds3QN7adMpdfZEdMFm.exe"2⤵
- Executes dropped EXE
PID:568
-
-
C:\Users\Admin\Documents\lqWdJDMWC61okcw9EKX8v97O.exe"C:\Users\Admin\Documents\lqWdJDMWC61okcw9EKX8v97O.exe"2⤵PID:1260
-
-
C:\Users\Admin\Documents\QhmX00NUQx8JeZVkujrZKt8S.exe"C:\Users\Admin\Documents\QhmX00NUQx8JeZVkujrZKt8S.exe"2⤵PID:920
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\27324791290.exe"3⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\27324791290.exe"C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\27324791290.exe"4⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\09538997937.exe" /mix3⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\09538997937.exe"C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\09538997937.exe" /mix4⤵PID:3040
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{UiKf-L1K0D-KObB-ZZ0OB}\03292338275.exe" /mix3⤵PID:2784
-
-
-
C:\Users\Admin\Documents\rULxTgt7b7hxcZQbfN9muGaa.exe"C:\Users\Admin\Documents\rULxTgt7b7hxcZQbfN9muGaa.exe"2⤵PID:1384
-
-
C:\Users\Admin\Documents\7lIUBOMZH1z4on3zYyVz3N53.exe"C:\Users\Admin\Documents\7lIUBOMZH1z4on3zYyVz3N53.exe"2⤵PID:1780
-
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe"C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe"2⤵PID:940
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exeC:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe3⤵PID:2572
-
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exeC:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe3⤵PID:2632
-
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exeC:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe3⤵PID:2704
-
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exeC:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe3⤵PID:2904
-
-
C:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exeC:\Users\Admin\Documents\YhBXusDL67xKDVvsQZBRqqV9.exe3⤵PID:1472
-
-
-
C:\Users\Admin\Documents\jgJV4TK3tjcyrkLVOuUlaaNb.exe"C:\Users\Admin\Documents\jgJV4TK3tjcyrkLVOuUlaaNb.exe"2⤵PID:1344
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵PID:1156
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:2072
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:2224
-
-
-
C:\Users\Admin\Documents\3cAp8kMhY9C4JXBa830EkeDS.exe"C:\Users\Admin\Documents\3cAp8kMhY9C4JXBa830EkeDS.exe"2⤵PID:1532
-
-
C:\Users\Admin\Documents\LIndFJgPiH13acTyQYXbnF0v.exe"C:\Users\Admin\Documents\LIndFJgPiH13acTyQYXbnF0v.exe"2⤵PID:320
-
-
C:\Users\Admin\Documents\JFhmuPRk4KTBFCyPfF_7rVMH.exe"C:\Users\Admin\Documents\JFhmuPRk4KTBFCyPfF_7rVMH.exe"2⤵PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\is-MVC35.tmp\JFhmuPRk4KTBFCyPfF_7rVMH.tmp"C:\Users\Admin\AppData\Local\Temp\is-MVC35.tmp\JFhmuPRk4KTBFCyPfF_7rVMH.tmp" /SL5="$10174,138429,56832,C:\Users\Admin\Documents\JFhmuPRk4KTBFCyPfF_7rVMH.exe"1⤵PID:1600