Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
102s -
max time network
182s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
10/11/2021, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211014
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211014
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
-
Size
403KB
-
MD5
f957e397e71010885b67f2afe37d8161
-
SHA1
a8bf84b971b37ac6e7f66c5e5a7e971a7741401e
-
SHA256
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66
-
SHA512
8b5e9cb926fafc295c403c1fce7aa883db3a327e58c3295e9a081a8937bed28e305cca08c2c7d98080818095ea99bb4047e10aa2f61e3e4d6d965aef6d16a4f6
Malware Config
Extracted
socelars
http://www.hhgenice.top/
Extracted
redline
tatreriash.xyz:80
Extracted
redline
udptest
193.56.146.64:65441
Extracted
redline
1011h
charirelay.xyz:80
Extracted
smokeloader
2020
http://misha.at/upload/
http://roohaniinfra.com/upload/
http://0axqpcc.cn/upload/
http://mayak-lombard.ru/upload/
http://mebel-lass.ru/upload/
http://dishakhan.com/upload/
Extracted
metasploit
windows/single_exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral3/memory/3560-255-0x0000000000190000-0x00000000001B0000-memory.dmp family_redline behavioral3/memory/2608-256-0x0000000002360000-0x000000000238C000-memory.dmp family_redline behavioral3/memory/2608-244-0x00000000020E0000-0x000000000210E000-memory.dmp family_redline behavioral3/memory/4248-303-0x0000000000418EE6-mapping.dmp family_redline behavioral3/memory/3560-277-0x00000000001AA17E-mapping.dmp family_redline behavioral3/memory/4248-276-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral3/files/0x000400000001abc3-155.dat family_socelars behavioral3/files/0x000400000001abc3-154.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
pid Process 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 1508 usQX7TOKBjRSa9cPQlo2Gsbn.exe 604 1IYNv_7IKQZkDypclWavITb3.exe 1136 7GGNLEN_klAFHlC1YgYvMkAy.exe 2608 QR7rjEU1N7ogY8KXNZSJXxCu.exe 1664 SywOKNV_EKcaSnmbfQQRyeL3.exe 2528 1fS3yF8eipW5ZHgPiYtVTe2e.exe 768 DxbrZzAnEDYtRbhdu7tqNojO.exe 504 PrpbbJZWt4YJXKrT4be1uk8_.exe 840 pjsWEdUnjZWZ3keggXND2i_w.exe 1232 dDZjDIBa69w5wGYvo_O5DnKH.exe 2328 IQa2rCkswbdsU1dXjD7Iquks.exe 2388 S9cWd4LzCnY5K2DkiBQo7Y8R.exe 2032 FemAQyKCc8h6JXF9XwZzfmYc.exe 1796 v5rKqMcqx40a2ydINrpnbOIX.exe 3884 IyybWC2LtI0SYw92kxtUq2cj.exe 2260 7te1E2BlkrIyAs_3ZbNr0_dd.exe 2212 _90Ji_B6CHsmvIxMbim0aBKa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/files/0x000400000001abb5-145.dat themida behavioral3/files/0x000200000001abd5-167.dat themida behavioral3/files/0x000400000001abc7-162.dat themida behavioral3/files/0x000400000001abe3-183.dat themida behavioral3/memory/3884-219-0x0000000000850000-0x0000000000851000-memory.dmp themida behavioral3/memory/504-237-0x0000000001390000-0x0000000001391000-memory.dmp themida behavioral3/memory/1728-234-0x0000000000BB0000-0x0000000000BB1000-memory.dmp themida behavioral3/memory/1796-252-0x0000000000010000-0x0000000000011000-memory.dmp themida behavioral3/files/0x000600000001ac25-458.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 165 ip-api.com 195 ipinfo.io 196 ipinfo.io 18 ipinfo.io 19 ipinfo.io 124 ipinfo.io 125 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 4276 768 WerFault.exe 75 4584 3032 WerFault.exe 91 4364 2528 WerFault.exe 76 4908 768 WerFault.exe 75 1968 768 WerFault.exe 75 4284 768 WerFault.exe 75 2388 768 WerFault.exe 75 4372 768 WerFault.exe 75 428 604 WerFault.exe 71 1552 768 WerFault.exe 75 -
NSIS installer 4 IoCs
resource yara_rule behavioral3/files/0x000400000001abf7-193.dat nsis_installer_1 behavioral3/files/0x000400000001abf7-193.dat nsis_installer_2 behavioral3/files/0x000400000001abf7-188.dat nsis_installer_1 behavioral3/files/0x000400000001abf7-188.dat nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4688 schtasks.exe 4732 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4384 timeout.exe -
Kills process with taskkill 3 IoCs
pid Process 3676 taskkill.exe 2968 taskkill.exe 5616 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe 816 Zzxc65t45YSBF9nqKHPuiSeU.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeCreateTokenPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeAssignPrimaryTokenPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeLockMemoryPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeIncreaseQuotaPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeMachineAccountPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeTcbPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeSecurityPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeTakeOwnershipPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeLoadDriverPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeSystemProfilePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeSystemtimePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeProfSingleProcessPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeIncBasePriorityPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeCreatePagefilePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeCreatePermanentPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeBackupPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeRestorePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeShutdownPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeDebugPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeAuditPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeSystemEnvironmentPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeChangeNotifyPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeRemoteShutdownPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeUndockPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeSyncAgentPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeEnableDelegationPrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeManageVolumePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe Token: SeImpersonatePrivilege 2328 IQa2rCkswbdsU1dXjD7Iquks.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 3660 wrote to memory of 816 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 69 PID 3660 wrote to memory of 816 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 69 PID 3660 wrote to memory of 1508 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3660 wrote to memory of 1508 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3660 wrote to memory of 1508 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 70 PID 3660 wrote to memory of 1136 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3660 wrote to memory of 1136 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3660 wrote to memory of 1136 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 72 PID 3660 wrote to memory of 604 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3660 wrote to memory of 604 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3660 wrote to memory of 604 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 71 PID 3660 wrote to memory of 2608 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3660 wrote to memory of 2608 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3660 wrote to memory of 2608 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 74 PID 3660 wrote to memory of 1664 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3660 wrote to memory of 1664 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3660 wrote to memory of 1664 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 73 PID 3660 wrote to memory of 2528 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3660 wrote to memory of 2528 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3660 wrote to memory of 2528 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 76 PID 3660 wrote to memory of 768 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3660 wrote to memory of 768 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3660 wrote to memory of 768 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 75 PID 3660 wrote to memory of 504 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3660 wrote to memory of 504 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3660 wrote to memory of 504 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 78 PID 3660 wrote to memory of 840 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3660 wrote to memory of 840 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3660 wrote to memory of 840 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 77 PID 3660 wrote to memory of 1232 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3660 wrote to memory of 1232 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3660 wrote to memory of 1232 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 80 PID 3660 wrote to memory of 2328 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 3660 wrote to memory of 2328 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 3660 wrote to memory of 2328 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 79 PID 3660 wrote to memory of 2388 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3660 wrote to memory of 2388 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3660 wrote to memory of 2388 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 3660 wrote to memory of 1796 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 3660 wrote to memory of 1796 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 3660 wrote to memory of 1796 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 82 PID 3660 wrote to memory of 2032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3660 wrote to memory of 2032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3660 wrote to memory of 2032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 81 PID 3660 wrote to memory of 3884 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 3660 wrote to memory of 3884 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 3660 wrote to memory of 3884 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 3660 wrote to memory of 2260 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 3660 wrote to memory of 2260 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 3660 wrote to memory of 2260 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 3660 wrote to memory of 2212 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 3660 wrote to memory of 2212 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 3660 wrote to memory of 2212 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 3660 wrote to memory of 3032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 3660 wrote to memory of 3032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 3660 wrote to memory of 3032 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 91 PID 3660 wrote to memory of 1728 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 3660 wrote to memory of 1728 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 3660 wrote to memory of 1728 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 3660 wrote to memory of 876 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 3660 wrote to memory of 876 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 3660 wrote to memory of 876 3660 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\Pictures\Adobe Films\Zzxc65t45YSBF9nqKHPuiSeU.exe"C:\Users\Admin\Pictures\Adobe Films\Zzxc65t45YSBF9nqKHPuiSeU.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:816
-
-
C:\Users\Admin\Pictures\Adobe Films\usQX7TOKBjRSa9cPQlo2Gsbn.exe"C:\Users\Admin\Pictures\Adobe Films\usQX7TOKBjRSa9cPQlo2Gsbn.exe"2⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4688
-
-
C:\Users\Admin\Documents\_Kd5CPUs6K3DzCthdD6AU3i6.exe"C:\Users\Admin\Documents\_Kd5CPUs6K3DzCthdD6AU3i6.exe"3⤵PID:4628
-
C:\Users\Admin\Pictures\Adobe Films\KrzMylGKMxrMR4vdwlYcwxIE.exe"C:\Users\Admin\Pictures\Adobe Films\KrzMylGKMxrMR4vdwlYcwxIE.exe"4⤵PID:5316
-
-
C:\Users\Admin\Pictures\Adobe Films\L2OrsqhZxGmE1E2fWDTYrrYk.exe"C:\Users\Admin\Pictures\Adobe Films\L2OrsqhZxGmE1E2fWDTYrrYk.exe"4⤵PID:5980
-
-
C:\Users\Admin\Pictures\Adobe Films\fSmnWOxFIn10IKyrPhMw2elg.exe"C:\Users\Admin\Pictures\Adobe Films\fSmnWOxFIn10IKyrPhMw2elg.exe"4⤵PID:6024
-
-
C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe"C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe"4⤵PID:6044
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵PID:968
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\7ubD9jljRcPdjXqFcy0MdDNT.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵PID:1184
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:6012
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\hPbvPn5DvDnforiYyb7WTZLv.exe"C:\Users\Admin\Pictures\Adobe Films\hPbvPn5DvDnforiYyb7WTZLv.exe"4⤵PID:6036
-
-
C:\Users\Admin\Pictures\Adobe Films\LH2PDLjkI6hoCDnXz9pMSlRL.exe"C:\Users\Admin\Pictures\Adobe Films\LH2PDLjkI6hoCDnXz9pMSlRL.exe"4⤵PID:2140
-
-
C:\Users\Admin\Pictures\Adobe Films\ws58LMYLWOiPEEwvBd6GcVQ2.exe"C:\Users\Admin\Pictures\Adobe Films\ws58LMYLWOiPEEwvBd6GcVQ2.exe"4⤵PID:4864
-
C:\Users\Admin\Pictures\Adobe Films\ws58LMYLWOiPEEwvBd6GcVQ2.exe"C:\Users\Admin\Pictures\Adobe Films\ws58LMYLWOiPEEwvBd6GcVQ2.exe" -u5⤵PID:4168
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lXsZ7GVJnW8z1lZ0f0L3cfRY.exe"C:\Users\Admin\Pictures\Adobe Films\lXsZ7GVJnW8z1lZ0f0L3cfRY.exe"4⤵PID:5712
-
-
C:\Users\Admin\Pictures\Adobe Films\PrCbFC7HE12IFcCz8ryS06am.exe"C:\Users\Admin\Pictures\Adobe Films\PrCbFC7HE12IFcCz8ryS06am.exe"4⤵PID:5652
-
-
C:\Users\Admin\Pictures\Adobe Films\0NWx0kNOKQ1nRUVQkmBY5lrF.exe"C:\Users\Admin\Pictures\Adobe Films\0NWx0kNOKQ1nRUVQkmBY5lrF.exe"4⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\is-LTPGU.tmp\0NWx0kNOKQ1nRUVQkmBY5lrF.tmp"C:\Users\Admin\AppData\Local\Temp\is-LTPGU.tmp\0NWx0kNOKQ1nRUVQkmBY5lrF.tmp" /SL5="$30294,506127,422400,C:\Users\Admin\Pictures\Adobe Films\0NWx0kNOKQ1nRUVQkmBY5lrF.exe"5⤵PID:5256
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1IYNv_7IKQZkDypclWavITb3.exe"C:\Users\Admin\Pictures\Adobe Films\1IYNv_7IKQZkDypclWavITb3.exe"2⤵
- Executes dropped EXE
PID:604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 8963⤵
- Program crash
PID:428
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7GGNLEN_klAFHlC1YgYvMkAy.exe"C:\Users\Admin\Pictures\Adobe Films\7GGNLEN_klAFHlC1YgYvMkAy.exe"2⤵
- Executes dropped EXE
PID:1136
-
-
C:\Users\Admin\Pictures\Adobe Films\SywOKNV_EKcaSnmbfQQRyeL3.exe"C:\Users\Admin\Pictures\Adobe Films\SywOKNV_EKcaSnmbfQQRyeL3.exe"2⤵
- Executes dropped EXE
PID:1664 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:3128
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QR7rjEU1N7ogY8KXNZSJXxCu.exe"C:\Users\Admin\Pictures\Adobe Films\QR7rjEU1N7ogY8KXNZSJXxCu.exe"2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Users\Admin\Pictures\Adobe Films\DxbrZzAnEDYtRbhdu7tqNojO.exe"C:\Users\Admin\Pictures\Adobe Films\DxbrZzAnEDYtRbhdu7tqNojO.exe"2⤵
- Executes dropped EXE
PID:768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 6643⤵
- Program crash
PID:4276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 6803⤵
- Program crash
PID:4908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 6883⤵
- Program crash
PID:1968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 6443⤵
- Program crash
PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 11283⤵
- Program crash
PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 11843⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 11203⤵
- Program crash
PID:1552
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1fS3yF8eipW5ZHgPiYtVTe2e.exe"C:\Users\Admin\Pictures\Adobe Films\1fS3yF8eipW5ZHgPiYtVTe2e.exe"2⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 5523⤵
- Program crash
PID:4364
-
-
-
C:\Users\Admin\Pictures\Adobe Films\pjsWEdUnjZWZ3keggXND2i_w.exe"C:\Users\Admin\Pictures\Adobe Films\pjsWEdUnjZWZ3keggXND2i_w.exe"2⤵
- Executes dropped EXE
PID:840
-
-
C:\Users\Admin\Pictures\Adobe Films\PrpbbJZWt4YJXKrT4be1uk8_.exe"C:\Users\Admin\Pictures\Adobe Films\PrpbbJZWt4YJXKrT4be1uk8_.exe"2⤵
- Executes dropped EXE
PID:504
-
-
C:\Users\Admin\Pictures\Adobe Films\IQa2rCkswbdsU1dXjD7Iquks.exe"C:\Users\Admin\Pictures\Adobe Films\IQa2rCkswbdsU1dXjD7Iquks.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:6092
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:5616
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\dDZjDIBa69w5wGYvo_O5DnKH.exe"C:\Users\Admin\Pictures\Adobe Films\dDZjDIBa69w5wGYvo_O5DnKH.exe"2⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\Pictures\Adobe Films\dDZjDIBa69w5wGYvo_O5DnKH.exe"C:\Users\Admin\Pictures\Adobe Films\dDZjDIBa69w5wGYvo_O5DnKH.exe"3⤵PID:1884
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FemAQyKCc8h6JXF9XwZzfmYc.exe"C:\Users\Admin\Pictures\Adobe Films\FemAQyKCc8h6JXF9XwZzfmYc.exe"2⤵
- Executes dropped EXE
PID:2032
-
-
C:\Users\Admin\Pictures\Adobe Films\v5rKqMcqx40a2ydINrpnbOIX.exe"C:\Users\Admin\Pictures\Adobe Films\v5rKqMcqx40a2ydINrpnbOIX.exe"2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Users\Admin\Pictures\Adobe Films\S9cWd4LzCnY5K2DkiBQo7Y8R.exe"C:\Users\Admin\Pictures\Adobe Films\S9cWd4LzCnY5K2DkiBQo7Y8R.exe"2⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\Pictures\Adobe Films\S9cWd4LzCnY5K2DkiBQo7Y8R.exe"C:\Users\Admin\Pictures\Adobe Films\S9cWd4LzCnY5K2DkiBQo7Y8R.exe"3⤵PID:4224
-
-
-
C:\Users\Admin\Pictures\Adobe Films\7te1E2BlkrIyAs_3ZbNr0_dd.exe"C:\Users\Admin\Pictures\Adobe Films\7te1E2BlkrIyAs_3ZbNr0_dd.exe"2⤵
- Executes dropped EXE
PID:2260
-
-
C:\Users\Admin\Pictures\Adobe Films\_90Ji_B6CHsmvIxMbim0aBKa.exe"C:\Users\Admin\Pictures\Adobe Films\_90Ji_B6CHsmvIxMbim0aBKa.exe"2⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\_90Ji_B6CHsmvIxMbim0aBKa.exe" & exit3⤵PID:524
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:4384
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\IyybWC2LtI0SYw92kxtUq2cj.exe"C:\Users\Admin\Pictures\Adobe Films\IyybWC2LtI0SYw92kxtUq2cj.exe"2⤵
- Executes dropped EXE
PID:3884
-
-
C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe"C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe"2⤵PID:968
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵PID:1880
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\C0A9XfJ_5wd1nSZRqwKSm1mC.exe" ) do taskkill -im "%~NxK" -F4⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵PID:4188
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵PID:2908
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵PID:4456
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )6⤵PID:3004
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵PID:1432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵PID:5380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵PID:5432
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵PID:1240
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "C0A9XfJ_5wd1nSZRqwKSm1mC.exe" -F5⤵
- Kills process with taskkill
PID:3676
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\yFF_KELjDNHU_4pFVjdedvzq.exe"C:\Users\Admin\Pictures\Adobe Films\yFF_KELjDNHU_4pFVjdedvzq.exe"2⤵PID:876
-
C:\Users\Admin\AppData\Roaming\2378053.exe"C:\Users\Admin\AppData\Roaming\2378053.exe"3⤵PID:4532
-
-
C:\Users\Admin\AppData\Roaming\4417232.exe"C:\Users\Admin\AppData\Roaming\4417232.exe"3⤵PID:1340
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:1968
-
-
-
C:\Users\Admin\AppData\Roaming\7741300.exe"C:\Users\Admin\AppData\Roaming\7741300.exe"3⤵PID:5040
-
-
C:\Users\Admin\AppData\Roaming\1418081.exe"C:\Users\Admin\AppData\Roaming\1418081.exe"3⤵PID:3788
-
-
C:\Users\Admin\AppData\Roaming\4055177.exe"C:\Users\Admin\AppData\Roaming\4055177.exe"3⤵PID:3136
-
-
C:\Users\Admin\AppData\Roaming\7408226.exe"C:\Users\Admin\AppData\Roaming\7408226.exe"3⤵PID:3724
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\7408226.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\7408226.exe"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )4⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\7408226.exe"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\7408226.exe" ) do taskkill /F /Im "%~Nxk"5⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXEkStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ6⤵PID:1232
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If ""/P6l3hjJm2mK1sJpxUmLJ""== """" for %k In ( ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )7⤵PID:5240
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If "/P6l3hjJm2mK1sJpxUmLJ"== "" for %k In ( "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE" ) do taskkill /F /Im "%~Nxk"8⤵PID:5356
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscrIPT: cLOSE( cREATEobjeCt ( "WSCRIPt.SheLL" ). ruN ( "C:\Windows\system32\cmd.exe /q /C echo %DatE%cl1V> 8KyK.ZNp & Echo | sET /P = ""MZ"" > hXUPL.XH& CoPY /b /Y HXUPL.XH + QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM & StArT control .\GKq1GTV.ZnM " , 0 , TrUe ) )7⤵PID:5520
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C echo ÚtE%cl1V>8KyK.ZNp & Echo | sET /P = "MZ" >hXUPL.XH& CoPY /b /Y HXUPL.XH +QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM& StArT control .\GKq1GTV.ZnM8⤵PID:5656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "9⤵PID:5768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>hXUPL.XH"9⤵PID:5784
-
-
C:\Windows\SysWOW64\control.execontrol .\GKq1GTV.ZnM9⤵PID:5472
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\GKq1GTV.ZnM10⤵PID:5668
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /Im "7408226.exe"6⤵
- Kills process with taskkill
PID:2968
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\6594567.exe"C:\Users\Admin\AppData\Roaming\6594567.exe"3⤵PID:4820
-
-
-
C:\Users\Admin\Pictures\Adobe Films\78vdA1CLVfKSJhEqstwFgyTv.exe"C:\Users\Admin\Pictures\Adobe Films\78vdA1CLVfKSJhEqstwFgyTv.exe"2⤵PID:1728
-
-
C:\Users\Admin\Pictures\Adobe Films\jPvfkjsR22lyWfa078kkjVwH.exe"C:\Users\Admin\Pictures\Adobe Films\jPvfkjsR22lyWfa078kkjVwH.exe"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:4248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 5523⤵
- Program crash
PID:4584
-
-
-
C:\Users\Admin\Pictures\Adobe Films\8QTmsdvRB71JJCYalLSCsLVF.exe"C:\Users\Admin\Pictures\Adobe Films\8QTmsdvRB71JJCYalLSCsLVF.exe"2⤵PID:3024
-