Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
67s -
max time network
165s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
-
Size
403KB
-
MD5
f957e397e71010885b67f2afe37d8161
-
SHA1
a8bf84b971b37ac6e7f66c5e5a7e971a7741401e
-
SHA256
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66
-
SHA512
8b5e9cb926fafc295c403c1fce7aa883db3a327e58c3295e9a081a8937bed28e305cca08c2c7d98080818095ea99bb4047e10aa2f61e3e4d6d965aef6d16a4f6
Malware Config
Extracted
socelars
http://www.hhgenice.top/
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Extracted
raccoon
1.8.3-hotfix
19425a9ea527ab0b3a94d8156a7d2f62d79d3b73
-
url4cnc
http://91.219.236.162/bimboDinotrex
http://185.163.47.176/bimboDinotrex
http://193.38.54.238/bimboDinotrex
http://74.119.192.122/bimboDinotrex
http://91.219.236.240/bimboDinotrex
https://t.me/bimboDinotrex
Extracted
redline
45.9.20.149:10844
Extracted
redline
udptest
193.56.146.64:65441
Extracted
vidar
47.9
937
https://mas.to/@kirpich
-
profile_id
937
Extracted
smokeloader
2020
http://misha.at/upload/
http://roohaniinfra.com/upload/
http://0axqpcc.cn/upload/
http://mayak-lombard.ru/upload/
http://mebel-lass.ru/upload/
http://dishakhan.com/upload/
Extracted
vidar
47.9
933
https://mas.to/@kirpich
-
profile_id
933
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral2/memory/2600-213-0x0000000003660000-0x000000000368E000-memory.dmp family_redline behavioral2/memory/592-267-0x0000000002420000-0x000000000244E000-memory.dmp family_redline behavioral2/memory/2600-258-0x0000000003980000-0x0000000003999000-memory.dmp family_redline behavioral2/memory/592-285-0x0000000002450000-0x000000000247C000-memory.dmp family_redline behavioral2/memory/4428-332-0x0000000000418D3A-mapping.dmp family_redline behavioral2/memory/4652-338-0x0000000000418D4A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000400000001abb9-146.dat family_socelars behavioral2/files/0x000400000001abb9-147.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/348-287-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral2/memory/4184-378-0x00000000022C0000-0x0000000002396000-memory.dmp family_vidar behavioral2/memory/4184-383-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
Xloader Payload 2 IoCs
resource yara_rule behavioral2/files/0x000400000001abbe-155.dat xloader behavioral2/files/0x000400000001abbe-154.dat xloader -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
pid Process 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 1796 5l8ybXjb8Hy1OvCnudFUD2l8.exe 1116 bvC0aBrVoiYJT2jZm8LdRil0.exe 1704 wFfzQhAyb9nNxvhU9xe3f5x4.exe 592 PlcErVoRHEB8WDCnEhxZNLfo.exe 1088 _Vm4titsrpvfv_Cfz_F9R_dZ.exe 348 alNDOulU6UA92LJpYj8VwkbB.exe 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe 2584 082l3_AoyLqJozglbfWQ3K9A.exe 3880 gxJ1shjEWNmorQACeSGEJnDg.exe 676 s1Ulg9ILOOmPW7fR22bhRf_C.exe 1460 UW7uXv2QjMlJPvjZEVNXbXzd.exe 2912 BWvifOluhbdVL7uVYPRyFdCe.exe 1848 QOuEBFzOMIfUDYz7ij2u_fba.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral2/files/0x000400000001abbc-157.dat vmprotect behavioral2/files/0x000400000001abbc-156.dat vmprotect behavioral2/memory/2912-254-0x0000000140000000-0x0000000140FFB000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000400000001abaf-143.dat themida behavioral2/files/0x000400000001abe6-183.dat themida behavioral2/files/0x000400000001abeb-184.dat themida behavioral2/memory/1088-227-0x0000000000BA0000-0x0000000000BA1000-memory.dmp themida behavioral2/memory/1944-248-0x0000000000A00000-0x0000000000A01000-memory.dmp themida behavioral2/memory/916-249-0x00000000011F0000-0x00000000011F1000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 170 ipinfo.io 215 ip-api.com 18 ipinfo.io 19 ipinfo.io 169 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
pid pid_target Process procid_target 5048 772 WerFault.exe 104 4700 1352 WerFault.exe 96 5628 4488 WerFault.exe 135 6048 4488 WerFault.exe 135 5768 4488 WerFault.exe 135 5404 4488 WerFault.exe 135 5632 348 WerFault.exe 77 -
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000400000001abea-197.dat nsis_installer_1 behavioral2/files/0x000400000001abea-197.dat nsis_installer_2 behavioral2/files/0x000400000001abea-185.dat nsis_installer_1 behavioral2/files/0x000400000001abea-185.dat nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4464 schtasks.exe 5876 schtasks.exe 5868 schtasks.exe -
Kills process with taskkill 3 IoCs
pid Process 6132 taskkill.exe 4516 taskkill.exe 6112 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe 908 n3Tp8gFuqr5b2BLwWc7xUFAZ.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeAssignPrimaryTokenPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeLockMemoryPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeIncreaseQuotaPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeMachineAccountPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeTcbPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeSecurityPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeTakeOwnershipPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeLoadDriverPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeSystemProfilePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeSystemtimePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeProfSingleProcessPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeIncBasePriorityPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeCreatePagefilePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeCreatePermanentPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeBackupPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeRestorePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeShutdownPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeDebugPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeAuditPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeSystemEnvironmentPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeChangeNotifyPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeRemoteShutdownPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeUndockPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeSyncAgentPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeEnableDelegationPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeManageVolumePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeImpersonatePrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: SeCreateGlobalPrivilege 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: 31 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: 32 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: 33 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: 34 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe Token: 35 708 gLt8wI1OI_X3ODtTGkM_mYnp.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3664 wrote to memory of 908 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 69 PID 3664 wrote to memory of 908 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 69 PID 3664 wrote to memory of 1796 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3664 wrote to memory of 1796 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3664 wrote to memory of 1796 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3664 wrote to memory of 1704 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3664 wrote to memory of 1704 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3664 wrote to memory of 1704 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3664 wrote to memory of 1116 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3664 wrote to memory of 1116 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3664 wrote to memory of 1116 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3664 wrote to memory of 592 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3664 wrote to memory of 592 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3664 wrote to memory of 592 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3664 wrote to memory of 1088 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3664 wrote to memory of 1088 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3664 wrote to memory of 1088 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3664 wrote to memory of 348 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3664 wrote to memory of 348 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3664 wrote to memory of 348 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3664 wrote to memory of 2584 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3664 wrote to memory of 2584 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3664 wrote to memory of 2584 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3664 wrote to memory of 708 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3664 wrote to memory of 708 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3664 wrote to memory of 708 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3664 wrote to memory of 676 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3664 wrote to memory of 676 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3664 wrote to memory of 676 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3664 wrote to memory of 3880 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3664 wrote to memory of 3880 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3664 wrote to memory of 3880 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3664 wrote to memory of 1460 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3664 wrote to memory of 1460 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3664 wrote to memory of 1460 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3664 wrote to memory of 2912 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 3664 wrote to memory of 2912 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 3664 wrote to memory of 1848 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3664 wrote to memory of 1848 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3664 wrote to memory of 1848 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3664 wrote to memory of 1048 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 3664 wrote to memory of 1048 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 3664 wrote to memory of 1048 3664 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\Pictures\Adobe Films\n3Tp8gFuqr5b2BLwWc7xUFAZ.exe"C:\Users\Admin\Pictures\Adobe Films\n3Tp8gFuqr5b2BLwWc7xUFAZ.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:908
-
-
C:\Users\Admin\Pictures\Adobe Films\PlcErVoRHEB8WDCnEhxZNLfo.exe"C:\Users\Admin\Pictures\Adobe Films\PlcErVoRHEB8WDCnEhxZNLfo.exe"2⤵
- Executes dropped EXE
PID:592
-
-
C:\Users\Admin\Pictures\Adobe Films\bvC0aBrVoiYJT2jZm8LdRil0.exe"C:\Users\Admin\Pictures\Adobe Films\bvC0aBrVoiYJT2jZm8LdRil0.exe"2⤵
- Executes dropped EXE
PID:1116
-
-
C:\Users\Admin\Pictures\Adobe Films\wFfzQhAyb9nNxvhU9xe3f5x4.exe"C:\Users\Admin\Pictures\Adobe Films\wFfzQhAyb9nNxvhU9xe3f5x4.exe"2⤵
- Executes dropped EXE
PID:1704
-
-
C:\Users\Admin\Pictures\Adobe Films\5l8ybXjb8Hy1OvCnudFUD2l8.exe"C:\Users\Admin\Pictures\Adobe Films\5l8ybXjb8Hy1OvCnudFUD2l8.exe"2⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5868
-
-
C:\Users\Admin\Documents\HNwrGPZhSvHpbgn0tQWPOxiQ.exe"C:\Users\Admin\Documents\HNwrGPZhSvHpbgn0tQWPOxiQ.exe"3⤵PID:5832
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_Vm4titsrpvfv_Cfz_F9R_dZ.exe"C:\Users\Admin\Pictures\Adobe Films\_Vm4titsrpvfv_Cfz_F9R_dZ.exe"2⤵
- Executes dropped EXE
PID:1088
-
-
C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"2⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"3⤵PID:4428
-
-
-
C:\Users\Admin\Pictures\Adobe Films\gLt8wI1OI_X3ODtTGkM_mYnp.exe"C:\Users\Admin\Pictures\Adobe Films\gLt8wI1OI_X3ODtTGkM_mYnp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:708
-
-
C:\Users\Admin\Pictures\Adobe Films\alNDOulU6UA92LJpYj8VwkbB.exe"C:\Users\Admin\Pictures\Adobe Films\alNDOulU6UA92LJpYj8VwkbB.exe"2⤵
- Executes dropped EXE
PID:348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 15683⤵
- Program crash
PID:5632
-
-
-
C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"2⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"3⤵PID:5992
-
-
-
C:\Users\Admin\Pictures\Adobe Films\BWvifOluhbdVL7uVYPRyFdCe.exe"C:\Users\Admin\Pictures\Adobe Films\BWvifOluhbdVL7uVYPRyFdCe.exe"2⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵PID:5072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵PID:4940
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:2660
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:4304
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵PID:4552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵PID:5168
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:2024
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:5364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵PID:6100
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
PID:4464
-
-
-
C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe"C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe"2⤵
- Executes dropped EXE
PID:1460
-
-
C:\Users\Admin\Pictures\Adobe Films\gxJ1shjEWNmorQACeSGEJnDg.exe"C:\Users\Admin\Pictures\Adobe Films\gxJ1shjEWNmorQACeSGEJnDg.exe"2⤵
- Executes dropped EXE
PID:3880 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:2940
-
-
-
C:\Users\Admin\Pictures\Adobe Films\8n4QpLYx11mbjWKzT1riKHm7.exe"C:\Users\Admin\Pictures\Adobe Films\8n4QpLYx11mbjWKzT1riKHm7.exe"2⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"3⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"3⤵PID:3956
-
C:\Users\Admin\AppData\Local\5919063.exe"C:\Users\Admin\AppData\Local\5919063.exe"4⤵PID:6036
-
-
C:\Users\Admin\AppData\Local\6615391.exe"C:\Users\Admin\AppData\Local\6615391.exe"4⤵PID:3944
-
-
C:\Users\Admin\AppData\Local\3674906.exe"C:\Users\Admin\AppData\Local\3674906.exe"4⤵PID:5620
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\3674906.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\3674906.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))5⤵PID:5636
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\3674906.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\3674906.exe" ) do taskkill -f -Im "%~NXZ"6⤵PID:4160
-
-
-
-
C:\Users\Admin\AppData\Local\4586976.exe"C:\Users\Admin\AppData\Local\4586976.exe"4⤵PID:2192
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"5⤵PID:4648
-
-
-
C:\Users\Admin\AppData\Local\6969289.exe"C:\Users\Admin\AppData\Local\6969289.exe"4⤵PID:5444
-
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"3⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"3⤵PID:4544
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )4⤵PID:3064
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"5⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi6⤵PID:6040
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )7⤵PID:5696
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"8⤵PID:6076
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"6⤵
- Kills process with taskkill
PID:4516
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\is-6918G.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6918G.tmp\setup.tmp" /SL5="$102AA,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT5⤵PID:2304
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"3⤵PID:4976
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"3⤵PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵PID:4488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6564⤵
- Program crash
PID:5628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6684⤵
- Program crash
PID:6048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6724⤵
- Program crash
PID:5768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6844⤵
- Program crash
PID:5404
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"3⤵PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"3⤵PID:5152
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"3⤵PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"3⤵PID:2316
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe"C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe"2⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "QOuEBFzOMIfUDYz7ij2u_fba.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe" & exit3⤵PID:1188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "QOuEBFzOMIfUDYz7ij2u_fba.exe" /f4⤵
- Kills process with taskkill
PID:6112
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9XkBG2Fij6lRQQg2VdDCFVDq.exe"C:\Users\Admin\Pictures\Adobe Films\9XkBG2Fij6lRQQg2VdDCFVDq.exe"2⤵PID:1944
-
-
C:\Users\Admin\Pictures\Adobe Films\RDUUnu6sCbpiWGkN78DH5kei.exe"C:\Users\Admin\Pictures\Adobe Films\RDUUnu6sCbpiWGkN78DH5kei.exe"2⤵PID:3780
-
-
C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"2⤵PID:3496
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe" ) do taskkill -im "%~NxK" -F4⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵PID:5480
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵PID:5712
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵PID:5892
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "68e2VhFSAP0FRPMi5EQ4pv5v.exe" -F5⤵
- Kills process with taskkill
PID:6132
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\s2BraH1hwSN7ptT8LosdeIhg.exe"C:\Users\Admin\Pictures\Adobe Films\s2BraH1hwSN7ptT8LosdeIhg.exe"2⤵PID:2092
-
-
C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe"C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe"2⤵PID:748
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe" & exit3⤵PID:2304
-
-
-
C:\Users\Admin\Pictures\Adobe Films\X18gHmQuxYkxHF4yyIXSTF1v.exe"C:\Users\Admin\Pictures\Adobe Films\X18gHmQuxYkxHF4yyIXSTF1v.exe"2⤵PID:2600
-
-
C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"2⤵PID:2552
-
C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"3⤵PID:4392
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fAxb2uj1hqYE940HxUi2Oq8V.exe"C:\Users\Admin\Pictures\Adobe Films\fAxb2uj1hqYE940HxUi2Oq8V.exe"2⤵PID:1436
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe3⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"4⤵PID:2120
-
-
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe3⤵PID:772
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 5524⤵
- Program crash
PID:5048
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fQ3PKz0AGUetIsFf1bPP0E8B.exe"C:\Users\Admin\Pictures\Adobe Films\fQ3PKz0AGUetIsFf1bPP0E8B.exe"2⤵PID:916
-
-
C:\Users\Admin\Pictures\Adobe Films\Sl1_ExVycKO8zgHCVnimQ8b5.exe"C:\Users\Admin\Pictures\Adobe Films\Sl1_ExVycKO8zgHCVnimQ8b5.exe"2⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 8923⤵
- Program crash
PID:4700
-
-
-
C:\Users\Admin\Pictures\Adobe Films\rbleiDRuuTxWNVSwHhQLgw9o.exe"C:\Users\Admin\Pictures\Adobe Films\rbleiDRuuTxWNVSwHhQLgw9o.exe"2⤵PID:3048
-
-
C:\Users\Admin\Pictures\Adobe Films\i2M5jnBZQI0VGz8B0Jb920CZ.exe"C:\Users\Admin\Pictures\Adobe Films\i2M5jnBZQI0VGz8B0Jb920CZ.exe"2⤵PID:4728
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"1⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe"2⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\is-OV261.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OV261.tmp\setup.tmp" /SL5="$202C0,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT1⤵PID:4920
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart2⤵PID:4304
-
C:\b19e86d2a6a5072ffa94\Setup.exeC:\b19e86d2a6a5072ffa94\\Setup.exe /q /norestart /x86 /x64 /web3⤵PID:5852
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss12⤵PID:3280
-
-
C:\Users\Admin\AppData\Local\Temp\is-C6637.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-C6637.tmp\postback.exe" ss12⤵PID:2996
-