Analysis
-
max time kernel
21s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26/12/2021, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
ad763d76409ed44f9cfb8b2ed65499e5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ad763d76409ed44f9cfb8b2ed65499e5.exe
Resource
win10-en-20211208
General
-
Target
ad763d76409ed44f9cfb8b2ed65499e5.exe
-
Size
6.3MB
-
MD5
ad763d76409ed44f9cfb8b2ed65499e5
-
SHA1
4c67c4a9b13880d68a324b646d58523b7d7c66b2
-
SHA256
cc2d611eb3f0e462f0c136b1664348fc05669fbac46ebb4b28c900c4dff94318
-
SHA512
5eed101dc0b24c72c957573a675080b8c7cf9c279cfa5b0ed37a12d03cd934400442003abd3d1c0aff042b67fe4be8d12611f88ef56653736f8595258e38bace
Malware Config
Extracted
socelars
http://www.biohazardgraphics.com/
Extracted
vidar
49.2
915
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
-
profile_id
915
Extracted
redline
media24pns
65.108.69.168:13293
Extracted
redline
userv1
159.69.246.184:13127
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 5048 rundll32.exe 127 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 10 IoCs
resource yara_rule behavioral2/memory/1012-281-0x000000000041932A-mapping.dmp family_redline behavioral2/memory/704-290-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/1012-292-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/704-284-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/1012-289-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/704-279-0x0000000000419346-mapping.dmp family_redline behavioral2/memory/1012-278-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/704-274-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4196-333-0x0000000000F20000-0x00000000010ED000-memory.dmp family_redline behavioral2/memory/4196-335-0x0000000000F20000-0x00000000010ED000-memory.dmp family_redline -
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000001ab39-151.dat family_socelars behavioral2/files/0x000500000001ab39-176.dat family_socelars -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/files/0x000500000001ab46-179.dat WebBrowserPassView behavioral2/files/0x000500000001ab46-204.dat WebBrowserPassView -
Nirsoft 5 IoCs
resource yara_rule behavioral2/files/0x000500000001ab46-179.dat Nirsoft behavioral2/files/0x000500000001ab46-204.dat Nirsoft behavioral2/files/0x000700000001ab5f-273.dat Nirsoft behavioral2/memory/2316-276-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft behavioral2/files/0x000700000001ab5f-275.dat Nirsoft -
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/1536-255-0x0000000000DC0000-0x0000000000E95000-memory.dmp family_vidar behavioral2/memory/1536-258-0x0000000000400000-0x00000000008B0000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x000700000001ab32-120.dat aspack_v212_v242 behavioral2/files/0x000700000001ab32-122.dat aspack_v212_v242 behavioral2/files/0x000500000001ab31-121.dat aspack_v212_v242 behavioral2/files/0x000500000001ab31-126.dat aspack_v212_v242 behavioral2/files/0x000500000001ab31-125.dat aspack_v212_v242 behavioral2/files/0x000600000001ab34-124.dat aspack_v212_v242 behavioral2/files/0x000600000001ab34-129.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 28 IoCs
pid Process 3508 setup_install.exe 1380 Thu11b21c69a3797.exe 716 Thu1156c5ba90d95.exe 1008 Thu11c4d5223f5.exe 1104 Thu11c4a8f1b4.exe 1868 Thu11b566ea7ac6697c5.exe 1936 Thu1176d60b7fec40.exe 1396 Thu11c668614fd663.exe 4076 Thu11bb8ff185f.exe 1536 Thu112a7360c8b.exe 1660 Thu11857de850e10c9f1.exe 2436 Thu11d2de72527d6d7d.exe 1128 Thu1187a4fcf7bfdc.exe 1360 Thu11fc58bc54.exe 1716 Thu11a0bd61b27d20c5.exe 2992 Thu11db26fe3a1.exe 948 Thu11a0bd61b27d20c5.exe 1228 Thu11c4a8f1b4.tmp 2824 Thu1187a4fcf7bfdc.exe 2720 Thu11c4a8f1b4.exe 2316 11111.exe 704 Thu11c4d5223f5.exe 1468 Thu11c4a8f1b4.tmp 1012 Thu11bb8ff185f.exe 1932 011a2f3d-3bf0-4bcf-8901-7fc2f21ea7ca.exe 3932 3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe 4196 e34b04a4-fd86-45e2-baac-2546895d4016.exe 4232 4175b3cc-687e-4e7d-a606-59906f95ead2.exe -
Loads dropped DLL 13 IoCs
pid Process 3508 setup_install.exe 3508 setup_install.exe 3508 setup_install.exe 3508 setup_install.exe 3508 setup_install.exe 3508 setup_install.exe 3508 setup_install.exe 1228 Thu11c4a8f1b4.tmp 2936 msiexec.exe 2936 msiexec.exe 1468 Thu11c4a8f1b4.tmp 1204 msiexec.exe 1204 msiexec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\218457123 = "C:\\Users\\Admin\\AppData\\Roaming\\33691759\\3369109633691096.exe" 3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 200 ipinfo.io 16 ip-api.com 84 ipinfo.io 85 ipinfo.io 199 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4196 e34b04a4-fd86-45e2-baac-2546895d4016.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1716 set thread context of 948 1716 Thu11a0bd61b27d20c5.exe 96 PID 1008 set thread context of 704 1008 Thu11c4d5223f5.exe 108 PID 4076 set thread context of 1012 4076 Thu11bb8ff185f.exe 107 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 4836 1380 WerFault.exe 81 4940 4132 WerFault.exe 143 4808 4132 WerFault.exe 143 4960 4132 WerFault.exe 143 764 4132 WerFault.exe 143 1920 4132 WerFault.exe 143 3064 4680 WerFault.exe 171 1824 4132 WerFault.exe 143 700 4132 WerFault.exe 143 1384 4132 WerFault.exe 143 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Process not Found -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3976 schtasks.exe 2184 schtasks.exe 4664 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4488 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 4932 taskkill.exe 5092 taskkill.exe 1264 taskkill.exe 3980 taskkill.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1360 Process not Found 1360 Process not Found 1060 powershell.exe 2052 powershell.exe 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2052 powershell.exe 2052 powershell.exe 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 4196 e34b04a4-fd86-45e2-baac-2546895d4016.exe 4196 e34b04a4-fd86-45e2-baac-2546895d4016.exe 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 1060 powershell.exe 1060 powershell.exe 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found 2364 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1360 Process not Found -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 1380 Thu11b21c69a3797.exe Token: SeCreateTokenPrivilege 716 Thu1156c5ba90d95.exe Token: SeAssignPrimaryTokenPrivilege 716 Thu1156c5ba90d95.exe Token: SeLockMemoryPrivilege 716 Thu1156c5ba90d95.exe Token: SeIncreaseQuotaPrivilege 716 Thu1156c5ba90d95.exe Token: SeMachineAccountPrivilege 716 Thu1156c5ba90d95.exe Token: SeTcbPrivilege 716 Thu1156c5ba90d95.exe Token: SeSecurityPrivilege 716 Thu1156c5ba90d95.exe Token: SeTakeOwnershipPrivilege 716 Thu1156c5ba90d95.exe Token: SeLoadDriverPrivilege 716 Thu1156c5ba90d95.exe Token: SeSystemProfilePrivilege 716 Thu1156c5ba90d95.exe Token: SeSystemtimePrivilege 716 Thu1156c5ba90d95.exe Token: SeProfSingleProcessPrivilege 716 Thu1156c5ba90d95.exe Token: SeIncBasePriorityPrivilege 716 Thu1156c5ba90d95.exe Token: SeCreatePagefilePrivilege 716 Thu1156c5ba90d95.exe Token: SeCreatePermanentPrivilege 716 Thu1156c5ba90d95.exe Token: SeBackupPrivilege 716 Thu1156c5ba90d95.exe Token: SeRestorePrivilege 716 Thu1156c5ba90d95.exe Token: SeShutdownPrivilege 716 Thu1156c5ba90d95.exe Token: SeDebugPrivilege 716 Thu1156c5ba90d95.exe Token: SeAuditPrivilege 716 Thu1156c5ba90d95.exe Token: SeSystemEnvironmentPrivilege 716 Thu1156c5ba90d95.exe Token: SeChangeNotifyPrivilege 716 Thu1156c5ba90d95.exe Token: SeRemoteShutdownPrivilege 716 Thu1156c5ba90d95.exe Token: SeUndockPrivilege 716 Thu1156c5ba90d95.exe Token: SeSyncAgentPrivilege 716 Thu1156c5ba90d95.exe Token: SeEnableDelegationPrivilege 716 Thu1156c5ba90d95.exe Token: SeManageVolumePrivilege 716 Thu1156c5ba90d95.exe Token: SeImpersonatePrivilege 716 Thu1156c5ba90d95.exe Token: SeCreateGlobalPrivilege 716 Thu1156c5ba90d95.exe Token: 31 716 Thu1156c5ba90d95.exe Token: 32 716 Thu1156c5ba90d95.exe Token: 33 716 Thu1156c5ba90d95.exe Token: 34 716 Thu1156c5ba90d95.exe Token: 35 716 Thu1156c5ba90d95.exe Token: SeDebugPrivilege 1660 Thu11857de850e10c9f1.exe Token: SeDebugPrivilege 4076 Thu11bb8ff185f.exe Token: SeDebugPrivilege 1008 Thu11c4d5223f5.exe Token: SeDebugPrivilege 2052 powershell.exe Token: SeDebugPrivilege 1060 powershell.exe Token: SeShutdownPrivilege 2364 Process not Found Token: SeCreatePagefilePrivilege 2364 Process not Found Token: SeShutdownPrivilege 2364 Process not Found Token: SeCreatePagefilePrivilege 2364 Process not Found Token: SeShutdownPrivilege 2364 Process not Found Token: SeCreatePagefilePrivilege 2364 Process not Found Token: SeShutdownPrivilege 2364 Process not Found Token: SeCreatePagefilePrivilege 2364 Process not Found Token: SeDebugPrivilege 4232 4175b3cc-687e-4e7d-a606-59906f95ead2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 3508 2580 ad763d76409ed44f9cfb8b2ed65499e5.exe 68 PID 2580 wrote to memory of 3508 2580 ad763d76409ed44f9cfb8b2ed65499e5.exe 68 PID 2580 wrote to memory of 3508 2580 ad763d76409ed44f9cfb8b2ed65499e5.exe 68 PID 3508 wrote to memory of 2452 3508 setup_install.exe 71 PID 3508 wrote to memory of 2452 3508 setup_install.exe 71 PID 3508 wrote to memory of 2452 3508 setup_install.exe 71 PID 3508 wrote to memory of 2792 3508 setup_install.exe 72 PID 3508 wrote to memory of 2792 3508 setup_install.exe 72 PID 3508 wrote to memory of 2792 3508 setup_install.exe 72 PID 3508 wrote to memory of 3532 3508 setup_install.exe 73 PID 3508 wrote to memory of 3532 3508 setup_install.exe 73 PID 3508 wrote to memory of 3532 3508 setup_install.exe 73 PID 3508 wrote to memory of 3956 3508 setup_install.exe 106 PID 3508 wrote to memory of 3956 3508 setup_install.exe 106 PID 3508 wrote to memory of 3956 3508 setup_install.exe 106 PID 3508 wrote to memory of 3472 3508 setup_install.exe 79 PID 3508 wrote to memory of 3472 3508 setup_install.exe 79 PID 3508 wrote to memory of 3472 3508 setup_install.exe 79 PID 3508 wrote to memory of 1480 3508 setup_install.exe 74 PID 3508 wrote to memory of 1480 3508 setup_install.exe 74 PID 3508 wrote to memory of 1480 3508 setup_install.exe 74 PID 3508 wrote to memory of 4088 3508 setup_install.exe 75 PID 3508 wrote to memory of 4088 3508 setup_install.exe 75 PID 3508 wrote to memory of 4088 3508 setup_install.exe 75 PID 3508 wrote to memory of 3104 3508 setup_install.exe 76 PID 3508 wrote to memory of 3104 3508 setup_install.exe 76 PID 3508 wrote to memory of 3104 3508 setup_install.exe 76 PID 3508 wrote to memory of 3916 3508 setup_install.exe 77 PID 3508 wrote to memory of 3916 3508 setup_install.exe 77 PID 3508 wrote to memory of 3916 3508 setup_install.exe 77 PID 3508 wrote to memory of 68 3508 setup_install.exe 78 PID 3508 wrote to memory of 68 3508 setup_install.exe 78 PID 3508 wrote to memory of 68 3508 setup_install.exe 78 PID 3508 wrote to memory of 2704 3508 setup_install.exe 80 PID 3508 wrote to memory of 2704 3508 setup_install.exe 80 PID 3508 wrote to memory of 2704 3508 setup_install.exe 80 PID 3508 wrote to memory of 2524 3508 setup_install.exe 105 PID 3508 wrote to memory of 2524 3508 setup_install.exe 105 PID 3508 wrote to memory of 2524 3508 setup_install.exe 105 PID 3508 wrote to memory of 1376 3508 setup_install.exe 104 PID 3508 wrote to memory of 1376 3508 setup_install.exe 104 PID 3508 wrote to memory of 1376 3508 setup_install.exe 104 PID 2452 wrote to memory of 1060 2452 cmd.exe 82 PID 2452 wrote to memory of 1060 2452 cmd.exe 82 PID 2452 wrote to memory of 1060 2452 cmd.exe 82 PID 3956 wrote to memory of 1380 3956 cmd.exe 81 PID 3956 wrote to memory of 1380 3956 cmd.exe 81 PID 2792 wrote to memory of 2052 2792 cmd.exe 103 PID 2792 wrote to memory of 2052 2792 cmd.exe 103 PID 2792 wrote to memory of 2052 2792 cmd.exe 103 PID 3508 wrote to memory of 3640 3508 setup_install.exe 102 PID 3508 wrote to memory of 3640 3508 setup_install.exe 102 PID 3508 wrote to memory of 3640 3508 setup_install.exe 102 PID 3532 wrote to memory of 1104 3532 cmd.exe 101 PID 3532 wrote to memory of 1104 3532 cmd.exe 101 PID 3532 wrote to memory of 1104 3532 cmd.exe 101 PID 1480 wrote to memory of 716 1480 cmd.exe 94 PID 1480 wrote to memory of 716 1480 cmd.exe 94 PID 1480 wrote to memory of 716 1480 cmd.exe 94 PID 3472 wrote to memory of 1008 3472 cmd.exe 91 PID 3472 wrote to memory of 1008 3472 cmd.exe 91 PID 3472 wrote to memory of 1008 3472 cmd.exe 91 PID 3508 wrote to memory of 316 3508 setup_install.exe 90 PID 3508 wrote to memory of 316 3508 setup_install.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe"C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c4a8f1b4.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exeThu11c4a8f1b4.exe4⤵
- Executes dropped EXE
PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1156c5ba90d95.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1156c5ba90d95.exeThu1156c5ba90d95.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:716 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:4888
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:5092
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11bb8ff185f.exe3⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exeThu11bb8ff185f.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exeC:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exe5⤵
- Executes dropped EXE
PID:1012
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11b566ea7ac6697c5.exe3⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11b566ea7ac6697c5.exeThu11b566ea7ac6697c5.exe4⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\62XW.NZd5⤵
- Loads dropped DLL
PID:2936
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1176d60b7fec40.exe3⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1176d60b7fec40.exeThu1176d60b7fec40.exe4⤵
- Executes dropped EXE
PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11fc58bc54.exe3⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11fc58bc54.exeThu11fc58bc54.exe4⤵
- Executes dropped EXE
PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c4d5223f5.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exeThu11c4d5223f5.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exeC:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exe5⤵
- Executes dropped EXE
PID:704
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu112a7360c8b.exe3⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu112a7360c8b.exeThu112a7360c8b.exe4⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu112a7360c8b.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu112a7360c8b.exe" & del C:\ProgramData\*.dll & exit5⤵PID:2600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu112a7360c8b.exe /f6⤵
- Kills process with taskkill
PID:1264
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 66⤵
- Delays execution with timeout.exe
PID:4488
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11857de850e10c9f1.exe3⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11857de850e10c9f1.exeThu11857de850e10c9f1.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Users\Admin\AppData\Local\e34b04a4-fd86-45e2-baac-2546895d4016.exe"C:\Users\Admin\AppData\Local\e34b04a4-fd86-45e2-baac-2546895d4016.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Users\Admin\AppData\Local\4175b3cc-687e-4e7d-a606-59906f95ead2.exe"C:\Users\Admin\AppData\Local\4175b3cc-687e-4e7d-a606-59906f95ead2.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Users\Admin\AppData\Roaming\8265817.exe"C:\Users\Admin\AppData\Roaming\8265817.exe"6⤵PID:4920
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",7⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",8⤵PID:4176
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",9⤵PID:2792
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",10⤵PID:4212
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe"C:\Users\Admin\AppData\Local\3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3932 -
C:\Users\Admin\AppData\Roaming\33691759\3369109633691096.exe"C:\Users\Admin\AppData\Roaming\33691759\3369109633691096.exe"6⤵PID:4636
-
-
-
C:\Users\Admin\AppData\Local\011a2f3d-3bf0-4bcf-8901-7fc2f21ea7ca.exe"C:\Users\Admin\AppData\Local\011a2f3d-3bf0-4bcf-8901-7fc2f21ea7ca.exe"5⤵
- Executes dropped EXE
PID:1932
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11a0bd61b27d20c5.exe /mixtwo3⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exeThu11a0bd61b27d20c5.exe /mixtwo4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11d2de72527d6d7d.exe3⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11d2de72527d6d7d.exeThu11d2de72527d6d7d.exe4⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
PID:2316
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11c668614fd663.exe3⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11db26fe3a1.exe3⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1187a4fcf7bfdc.exe3⤵PID:2524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu11b21c69a3797.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3956
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11b21c69a3797.exeThu11b21c69a3797.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1380 -s 20162⤵
- Program crash
PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exeThu1187a4fcf7bfdc.exe1⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exe"C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exe" -u2⤵
- Executes dropped EXE
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c668614fd663.exeThu11c668614fd663.exe1⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe"C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe"2⤵PID:3808
-
-
C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe"C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe"2⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im V2gM9BSf23MRqQXJdebiDxEp.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe" & del C:\ProgramData\*.dll & exit3⤵PID:2884
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im V2gM9BSf23MRqQXJdebiDxEp.exe /f4⤵
- Kills process with taskkill
PID:3980
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cxc_WLLx3Y0pNNbstOrOAcaL.exe"C:\Users\Admin\Pictures\Adobe Films\cxc_WLLx3Y0pNNbstOrOAcaL.exe"2⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 6643⤵
- Program crash
PID:4940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 6803⤵
- Program crash
PID:4808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 6403⤵
- Program crash
PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 6723⤵
- Program crash
PID:764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 8963⤵
- Program crash
PID:1920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 11603⤵
- Program crash
PID:1824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 11243⤵
- Program crash
PID:700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 12723⤵
- Program crash
PID:1384
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zAGXS0GZxHCLigIrOP9OyPBT.exe"C:\Users\Admin\Pictures\Adobe Films\zAGXS0GZxHCLigIrOP9OyPBT.exe"2⤵PID:1220
-
-
C:\Users\Admin\Pictures\Adobe Films\6gJZOXHkXB88iYMvazLx9MGY.exe"C:\Users\Admin\Pictures\Adobe Films\6gJZOXHkXB88iYMvazLx9MGY.exe"2⤵PID:2116
-
-
C:\Users\Admin\Pictures\Adobe Films\0MOEaydNL1UVIRRmPbrBOBmU.exe"C:\Users\Admin\Pictures\Adobe Films\0MOEaydNL1UVIRRmPbrBOBmU.exe"2⤵PID:4508
-
-
C:\Users\Admin\Pictures\Adobe Films\_8ai3yQW6FPO01hOzEIncRVr.exe"C:\Users\Admin\Pictures\Adobe Films\_8ai3yQW6FPO01hOzEIncRVr.exe"2⤵PID:4936
-
C:\Users\Admin\AppData\Local\330a2e88-7cbd-4836-8a7f-07367570c0d4.exe"C:\Users\Admin\AppData\Local\330a2e88-7cbd-4836-8a7f-07367570c0d4.exe"3⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\99680099-a670-4a95-9e99-82bbd31051e7.exe"C:\Users\Admin\AppData\Local\99680099-a670-4a95-9e99-82bbd31051e7.exe"3⤵PID:836
-
-
C:\Users\Admin\AppData\Local\d380bb0b-1963-4481-a09e-38a49cfb97d1.exe"C:\Users\Admin\AppData\Local\d380bb0b-1963-4481-a09e-38a49cfb97d1.exe"3⤵PID:4868
-
-
C:\Users\Admin\AppData\Local\19b7f440-da07-4d03-a4be-425061ac7dcc.exe"C:\Users\Admin\AppData\Local\19b7f440-da07-4d03-a4be-425061ac7dcc.exe"3⤵PID:4912
-
-
-
C:\Users\Admin\Pictures\Adobe Films\oZw99uWuckiiTMPo4jXmO8we.exe"C:\Users\Admin\Pictures\Adobe Films\oZw99uWuckiiTMPo4jXmO8we.exe"2⤵PID:4432
-
-
C:\Users\Admin\Pictures\Adobe Films\hnDZHPCjimYyhkuQNEN2UzYY.exe"C:\Users\Admin\Pictures\Adobe Films\hnDZHPCjimYyhkuQNEN2UzYY.exe"2⤵PID:372
-
C:\Users\Admin\Documents\yEf2igUUw8rudmU2nVprf9hp.exe"C:\Users\Admin\Documents\yEf2igUUw8rudmU2nVprf9hp.exe"3⤵PID:1396
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3976
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2184
-
-
-
C:\Users\Admin\Pictures\Adobe Films\SXk4YsAHlGIXtTwxOODY2ilu.exe"C:\Users\Admin\Pictures\Adobe Films\SXk4YsAHlGIXtTwxOODY2ilu.exe"2⤵PID:5020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd3⤵PID:4500
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ltaV8XFB8ZSC1JSdTlaAHyKe.exe"C:\Users\Admin\Pictures\Adobe Films\ltaV8XFB8ZSC1JSdTlaAHyKe.exe"2⤵PID:3056
-
-
C:\Users\Admin\Pictures\Adobe Films\1ZIOvo98BnWNoJ3ryGTmkxYP.exe"C:\Users\Admin\Pictures\Adobe Films\1ZIOvo98BnWNoJ3ryGTmkxYP.exe"2⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7zSEA2D.tmp\Install.exe.\Install.exe3⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\7zSF5A7.tmp\Install.exe.\Install.exe /S /site_id "525403"4⤵PID:4476
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &5⤵PID:4488
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"6⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True7⤵PID:1076
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True8⤵PID:4528
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"5⤵PID:4880
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&6⤵PID:3768
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:327⤵PID:4612
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:647⤵PID:4468
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"5⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&6⤵PID:4804
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:327⤵PID:5012
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:647⤵PID:4592
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "glDhdqFsc" /SC once /ST 12:59:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="5⤵
- Creates scheduled task(s)
PID:4664
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vc0v70ph0c7ww8dYdh6dMVtd.exe"C:\Users\Admin\Pictures\Adobe Films\vc0v70ph0c7ww8dYdh6dMVtd.exe"2⤵PID:4168
-
-
C:\Users\Admin\Pictures\Adobe Films\EGrN5MJ0qGUv33AjUGGoLYBB.exe"C:\Users\Admin\Pictures\Adobe Films\EGrN5MJ0qGUv33AjUGGoLYBB.exe"2⤵PID:2708
-
-
C:\Users\Admin\Pictures\Adobe Films\nk1DRguj1eHV3aQLO6BwM23Z.exe"C:\Users\Admin\Pictures\Adobe Films\nk1DRguj1eHV3aQLO6BwM23Z.exe"2⤵PID:1252
-
C:\Users\Public\Videos\hgfdfds.exe"C:\Users\Public\Videos\hgfdfds.exe"3⤵PID:2904
-
-
-
C:\Users\Admin\Pictures\Adobe Films\xT0wSrD98kxNd9PO32Eo5Z5o.exe"C:\Users\Admin\Pictures\Adobe Films\xT0wSrD98kxNd9PO32Eo5Z5o.exe"2⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\wfvStpOzRepe5\EasyCalc License Agreement.exe"C:\Users\Admin\AppData\Local\Temp\wfvStpOzRepe5\EasyCalc License Agreement.exe"3⤵PID:5324
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RD46IbVk80V5IgkDihYqK4Yv.exe"C:\Users\Admin\Pictures\Adobe Films\RD46IbVk80V5IgkDihYqK4Yv.exe"2⤵PID:2524
-
-
C:\Users\Admin\Pictures\Adobe Films\LQVkjXmg8goR37YpwaLB5Fnc.exe"C:\Users\Admin\Pictures\Adobe Films\LQVkjXmg8goR37YpwaLB5Fnc.exe"2⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:716
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9eBrpMc7IVoQr8Xf9DN0Itg7.exe"C:\Users\Admin\Pictures\Adobe Films\9eBrpMc7IVoQr8Xf9DN0Itg7.exe"2⤵PID:1120
-
-
C:\Users\Admin\Pictures\Adobe Films\OYkwmzTrguYodZTCoC3sw6JL.exe"C:\Users\Admin\Pictures\Adobe Films\OYkwmzTrguYodZTCoC3sw6JL.exe"2⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 4003⤵
- Program crash
PID:3064
-
-
-
C:\Users\Admin\Pictures\Adobe Films\02XIqzfbSdWUTpVjedofSyGx.exe"C:\Users\Admin\Pictures\Adobe Films\02XIqzfbSdWUTpVjedofSyGx.exe"2⤵PID:4688
-
-
C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe"C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe"2⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\is-ACF3F.tmp\df5aBk1XAe0fUHE_LHn5yxgq.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACF3F.tmp\df5aBk1XAe0fUHE_LHn5yxgq.tmp" /SL5="$302CC,140559,56832,C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe"3⤵PID:3984
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe"C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe"2⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\is-TQ5OM.tmp\lsxTFGEgtCGMsiX5kZQ8pjNV.tmp"C:\Users\Admin\AppData\Local\Temp\is-TQ5OM.tmp\lsxTFGEgtCGMsiX5kZQ8pjNV.tmp" /SL5="$302CA,140559,56832,C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe"3⤵PID:4980
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ZxJCH40kVq7FNcViM_6V5AfJ.exe"C:\Users\Admin\Pictures\Adobe Films\ZxJCH40kVq7FNcViM_6V5AfJ.exe"2⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exeThu11a0bd61b27d20c5.exe /mixtwo1⤵
- Executes dropped EXE
PID:948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Thu11a0bd61b27d20c5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exe" & exit2⤵PID:4648
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Thu11a0bd61b27d20c5.exe" /f3⤵
- Kills process with taskkill
PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-TTEST.tmp\Thu11c4a8f1b4.tmp"C:\Users\Admin\AppData\Local\Temp\is-TTEST.tmp\Thu11c4a8f1b4.tmp" /SL5="$201AA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe"C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe" /SILENT2⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\is-4O2RB.tmp\Thu11c4a8f1b4.tmp"C:\Users\Admin\AppData\Local\Temp\is-4O2RB.tmp\Thu11c4a8f1b4.tmp" /SL5="$20202,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\is-69VFF.tmp\windllhost.exe"C:\Users\Admin\AppData\Local\Temp\is-69VFF.tmp\windllhost.exe" 774⤵PID:5100
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11db26fe3a1.exeThu11db26fe3a1.exe1⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\62XW.NZd2⤵
- Loads dropped DLL
PID:1204
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1948
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2740