Analysis
-
max time kernel
6s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
26/12/2021, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
ad763d76409ed44f9cfb8b2ed65499e5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ad763d76409ed44f9cfb8b2ed65499e5.exe
Resource
win10-en-20211208
General
-
Target
ad763d76409ed44f9cfb8b2ed65499e5.exe
-
Size
6.3MB
-
MD5
ad763d76409ed44f9cfb8b2ed65499e5
-
SHA1
4c67c4a9b13880d68a324b646d58523b7d7c66b2
-
SHA256
cc2d611eb3f0e462f0c136b1664348fc05669fbac46ebb4b28c900c4dff94318
-
SHA512
5eed101dc0b24c72c957573a675080b8c7cf9c279cfa5b0ed37a12d03cd934400442003abd3d1c0aff042b67fe4be8d12611f88ef56653736f8595258e38bace
Malware Config
Extracted
socelars
http://www.biohazardgraphics.com/
Extracted
vidar
49.2
915
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
-
profile_id
915
Extracted
redline
media24pns
65.108.69.168:13293
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 2952 rundll32.exe 81 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral1/memory/2700-275-0x0000000000419346-mapping.dmp family_redline behavioral1/memory/2700-289-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2700-291-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 3 IoCs
resource yara_rule behavioral1/files/0x0006000000013921-107.dat family_socelars behavioral1/files/0x0006000000013921-166.dat family_socelars behavioral1/files/0x0006000000013921-145.dat family_socelars -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0005000000014070-156.dat WebBrowserPassView behavioral1/memory/2668-242-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
resource yara_rule behavioral1/files/0x0005000000014070-156.dat Nirsoft behavioral1/memory/2464-236-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft behavioral1/memory/1332-237-0x0000000000220000-0x0000000000292000-memory.dmp Nirsoft behavioral1/memory/2668-242-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft -
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/852-260-0x0000000002300000-0x00000000023D5000-memory.dmp family_vidar behavioral1/memory/852-263-0x0000000000400000-0x00000000008B0000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x00060000000133c1-62.dat aspack_v212_v242 behavioral1/files/0x00060000000133c1-63.dat aspack_v212_v242 behavioral1/files/0x00070000000132cc-64.dat aspack_v212_v242 behavioral1/files/0x00070000000132cc-65.dat aspack_v212_v242 behavioral1/files/0x00060000000138c1-69.dat aspack_v212_v242 behavioral1/files/0x00060000000138c1-68.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 320 setup_install.exe 1404 Thu11b21c69a3797.exe 944 Thu11c4d5223f5.exe 1216 Thu11c4a8f1b4.exe 1900 Thu11bb8ff185f.exe 1680 Thu1156c5ba90d95.exe 580 Thu11fc58bc54.exe -
Loads dropped DLL 29 IoCs
pid Process 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 320 setup_install.exe 1112 cmd.exe 1488 cmd.exe 1488 cmd.exe 1096 cmd.exe 1292 cmd.exe 1292 cmd.exe 1652 cmd.exe 1796 cmd.exe 1796 cmd.exe 1828 cmd.exe 1828 cmd.exe 944 Thu11c4d5223f5.exe 944 Thu11c4d5223f5.exe 556 cmd.exe 1780 cmd.exe 556 cmd.exe 1900 Thu11bb8ff185f.exe 1900 Thu11bb8ff185f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ip-api.com 52 ipinfo.io 53 ipinfo.io 58 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1500 1104 WerFault.exe 54 2512 1080 WerFault.exe 57 -
Delays execution with timeout.exe 1 IoCs
pid Process 1848 timeout.exe -
Kills process with taskkill 3 IoCs
pid Process 2768 taskkill.exe 2784 taskkill.exe 3068 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 1592 wrote to memory of 320 1592 ad763d76409ed44f9cfb8b2ed65499e5.exe 27 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 980 320 setup_install.exe 33 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 640 320 setup_install.exe 32 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1096 320 setup_install.exe 31 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1112 320 setup_install.exe 29 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1488 320 setup_install.exe 30 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 320 wrote to memory of 1652 320 setup_install.exe 38 PID 1112 wrote to memory of 1404 1112 cmd.exe 37 PID 1112 wrote to memory of 1404 1112 cmd.exe 37 PID 1112 wrote to memory of 1404 1112 cmd.exe 37 PID 1112 wrote to memory of 1404 1112 cmd.exe 37 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 640 wrote to memory of 1332 640 cmd.exe 34 PID 320 wrote to memory of 1292 320 setup_install.exe 36 PID 320 wrote to memory of 1292 320 setup_install.exe 36 PID 320 wrote to memory of 1292 320 setup_install.exe 36 PID 320 wrote to memory of 1292 320 setup_install.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe"C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS836982C5\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11b21c69a3797.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11b21c69a3797.exeThu11b21c69a3797.exe4⤵
- Executes dropped EXE
PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c4d5223f5.exe3⤵
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4d5223f5.exeThu11c4d5223f5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4d5223f5.exeC:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4d5223f5.exe5⤵PID:2700
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c4a8f1b4.exe3⤵
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4a8f1b4.exeThu11c4a8f1b4.exe4⤵
- Executes dropped EXE
PID:1216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵PID:980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11b566ea7ac6697c5.exe3⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11b566ea7ac6697c5.exeThu11b566ea7ac6697c5.exe4⤵PID:888
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\62XW.NZd5⤵PID:2192
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11bb8ff185f.exe3⤵
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11bb8ff185f.exeThu11bb8ff185f.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11bb8ff185f.exeC:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11bb8ff185f.exe5⤵PID:2284
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1156c5ba90d95.exe3⤵
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu1156c5ba90d95.exeThu1156c5ba90d95.exe4⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:2708
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:2784
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1176d60b7fec40.exe3⤵
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu1176d60b7fec40.exeThu1176d60b7fec40.exe4⤵PID:1080
-
C:\Users\Admin\Pictures\Adobe Films\IItRinnzvHCfxdJMJIyi1fqG.exe"C:\Users\Admin\Pictures\Adobe Films\IItRinnzvHCfxdJMJIyi1fqG.exe"5⤵PID:1384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 14845⤵
- Program crash
PID:2512
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c668614fd663.exe3⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c668614fd663.exeThu11c668614fd663.exe4⤵PID:1104
-
C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe"C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe"5⤵PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 15725⤵
- Program crash
PID:1500
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11a0bd61b27d20c5.exe /mixtwo3⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11857de850e10c9f1.exe3⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11d2de72527d6d7d.exe3⤵PID:848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11db26fe3a1.exe3⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1187a4fcf7bfdc.exe3⤵
- Loads dropped DLL
PID:1828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu112a7360c8b.exe3⤵
- Loads dropped DLL
PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11fc58bc54.exe3⤵
- Loads dropped DLL
PID:1796
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11fc58bc54.exeThu11fc58bc54.exe1⤵
- Executes dropped EXE
PID:580
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11857de850e10c9f1.exeThu11857de850e10c9f1.exe1⤵PID:1676
-
C:\Users\Admin\AppData\Local\8d274652-e0a5-40f9-873b-1cc36b9d898c.exe"C:\Users\Admin\AppData\Local\8d274652-e0a5-40f9-873b-1cc36b9d898c.exe"2⤵PID:1504
-
-
C:\Users\Admin\AppData\Local\4b48f637-5774-4dfc-91ab-a7725afaef4d.exe"C:\Users\Admin\AppData\Local\4b48f637-5774-4dfc-91ab-a7725afaef4d.exe"2⤵PID:2172
-
C:\Users\Admin\AppData\Roaming\13702799\195962023234192.exe"C:\Users\Admin\AppData\Roaming\13702799\195962023234192.exe"3⤵PID:1776
-
-
-
C:\Users\Admin\AppData\Local\8d0dcc60-c69b-4ab7-a337-3f38727fb9e5.exe"C:\Users\Admin\AppData\Local\8d0dcc60-c69b-4ab7-a337-3f38727fb9e5.exe"2⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\1e895cdb-460d-4d1d-a57c-0e42cee3cc55.exe"C:\Users\Admin\AppData\Local\1e895cdb-460d-4d1d-a57c-0e42cee3cc55.exe"2⤵PID:1744
-
C:\Users\Admin\AppData\Roaming\2572059.exe"C:\Users\Admin\AppData\Roaming\2572059.exe"3⤵PID:924
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",4⤵PID:944
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",5⤵PID:996
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11db26fe3a1.exeThu11db26fe3a1.exe1⤵PID:540
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\62XW.NZd2⤵PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11d2de72527d6d7d.exeThu11d2de72527d6d7d.exe1⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11a0bd61b27d20c5.exeThu11a0bd61b27d20c5.exe /mixtwo1⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11a0bd61b27d20c5.exeThu11a0bd61b27d20c5.exe /mixtwo2⤵PID:2156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Thu11a0bd61b27d20c5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11a0bd61b27d20c5.exe" & exit3⤵PID:2560
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Thu11a0bd61b27d20c5.exe" /f4⤵
- Kills process with taskkill
PID:2768
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu1187a4fcf7bfdc.exe"C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu1187a4fcf7bfdc.exe" -u1⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\is-T4TNE.tmp\Thu11c4a8f1b4.tmp"C:\Users\Admin\AppData\Local\Temp\is-T4TNE.tmp\Thu11c4a8f1b4.tmp" /SL5="$10182,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4a8f1b4.exe"1⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4a8f1b4.exe"C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4a8f1b4.exe" /SILENT2⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\is-B7H0F.tmp\Thu11c4a8f1b4.tmp"C:\Users\Admin\AppData\Local\Temp\is-B7H0F.tmp\Thu11c4a8f1b4.tmp" /SL5="$20182,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu11c4a8f1b4.exe" /SILENT3⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\is-5PKS2.tmp\windllhost.exe"C:\Users\Admin\AppData\Local\Temp\is-5PKS2.tmp\windllhost.exe" 774⤵PID:2816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu112a7360c8b.exeThu112a7360c8b.exe1⤵PID:852
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu112a7360c8b.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu112a7360c8b.exe" & del C:\ProgramData\*.dll & exit2⤵PID:2792
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu112a7360c8b.exe /f3⤵
- Kills process with taskkill
PID:3068
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:1848
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS836982C5\Thu1187a4fcf7bfdc.exeThu1187a4fcf7bfdc.exe1⤵PID:752
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2432
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2668