Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
10Resubmissions
12-11-2024 01:29
241112-bwgrxs1gnf 1008-07-2021 12:18
210708-8z6d5h8z2n 1006-07-2021 17:53
210706-g6we6sa7sa 1019-06-2021 18:17
210619-vr8bj2dzfn 1017-06-2021 21:39
210617-a9cvlnmrbx 1011-06-2021 17:26
210611-wvab1yw2tj 1008-06-2021 06:47
210608-qrbpch3y46 1008-06-2021 06:47
210608-64tndgm1ln 1005-06-2021 18:40
210605-cd6qpr55sx 1004-06-2021 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
135s -
max time network
1802s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 12:40
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win7v20210408
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210410
General
-
Target
Install2.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Malware Config
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 1 IoCs
resource yara_rule behavioral18/memory/7552-294-0x0000000000200000-0x00000000002F1000-memory.dmp xmrig -
Blocklisted process makes network request 64 IoCs
flow pid Process 74 2416 msiexec.exe 151 2684 MsiExec.exe 153 2684 MsiExec.exe 154 2684 MsiExec.exe 156 2684 MsiExec.exe 158 2684 MsiExec.exe 160 2684 MsiExec.exe 162 2684 MsiExec.exe 169 2684 MsiExec.exe 170 2684 MsiExec.exe 172 2684 MsiExec.exe 173 2684 MsiExec.exe 174 2684 MsiExec.exe 175 2684 MsiExec.exe 176 2684 MsiExec.exe 185 2684 MsiExec.exe 189 2684 MsiExec.exe 192 2684 MsiExec.exe 193 2684 MsiExec.exe 194 2684 MsiExec.exe 195 2684 MsiExec.exe 196 2684 MsiExec.exe 199 2684 MsiExec.exe 201 2684 MsiExec.exe 202 2684 MsiExec.exe 203 2684 MsiExec.exe 204 2684 MsiExec.exe 205 2684 MsiExec.exe 206 2684 MsiExec.exe 207 2684 MsiExec.exe 208 2684 MsiExec.exe 209 2684 MsiExec.exe 210 2684 MsiExec.exe 211 2684 MsiExec.exe 212 2684 MsiExec.exe 213 2684 MsiExec.exe 214 2684 MsiExec.exe 215 2684 MsiExec.exe 216 2684 MsiExec.exe 218 2684 MsiExec.exe 219 2684 MsiExec.exe 220 2684 MsiExec.exe 221 2684 MsiExec.exe 222 2684 MsiExec.exe 223 2684 MsiExec.exe 224 2684 MsiExec.exe 225 2684 MsiExec.exe 226 2684 MsiExec.exe 227 2684 MsiExec.exe 228 2684 MsiExec.exe 229 2684 MsiExec.exe 230 2684 MsiExec.exe 231 2684 MsiExec.exe 237 2684 MsiExec.exe 238 2684 MsiExec.exe 239 2684 MsiExec.exe 240 2684 MsiExec.exe 241 2684 MsiExec.exe 242 2684 MsiExec.exe 243 2684 MsiExec.exe 244 2684 MsiExec.exe 245 2684 MsiExec.exe 246 2684 MsiExec.exe 247 2684 MsiExec.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 22 IoCs
pid Process 1980 Install2.tmp 1140 Ultra.exe 436 ultramediaburner.exe 432 ultramediaburner.tmp 1696 Paejiwekeki.exe 1584 UltraMediaBurner.exe 300 Qikaekyvari.exe 2384 001.exe 2364 installer.exe 2920 hbggg.exe 412 jfiag3g_gg.exe 3048 jfiag3g_gg.exe 2068 huesaa.exe 2284 jfiag3g_gg.exe 2112 setup.exe 2744 askinstall39.exe 2916 jfiag3g_gg.exe 2800 customer1.exe 2184 jfiag3g_gg.exe 2756 toolspab1.exe 2672 toolspab1.exe 1088 jfiag3g_gg.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral18/files/0x000300000001319d-165.dat upx behavioral18/files/0x000300000001319d-166.dat upx behavioral18/files/0x000300000001319d-168.dat upx -
Loads dropped DLL 51 IoCs
pid Process 1756 Install2.exe 1980 Install2.tmp 1980 Install2.tmp 1980 Install2.tmp 1980 Install2.tmp 436 ultramediaburner.exe 432 ultramediaburner.tmp 432 ultramediaburner.tmp 432 ultramediaburner.tmp 432 ultramediaburner.tmp 432 ultramediaburner.tmp 432 ultramediaburner.tmp 2364 installer.exe 2364 installer.exe 2364 installer.exe 2648 MsiExec.exe 2648 MsiExec.exe 2684 MsiExec.exe 2920 hbggg.exe 2920 hbggg.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2684 MsiExec.exe 2364 installer.exe 2684 MsiExec.exe 2684 MsiExec.exe 2920 hbggg.exe 2920 hbggg.exe 2144 MsiExec.exe 2144 MsiExec.exe 2144 MsiExec.exe 2144 MsiExec.exe 2144 MsiExec.exe 2144 MsiExec.exe 2144 MsiExec.exe 2684 MsiExec.exe 2068 huesaa.exe 2068 huesaa.exe 2068 huesaa.exe 2068 huesaa.exe 2800 customer1.exe 2800 customer1.exe 2756 toolspab1.exe 2672 toolspab1.exe 2800 customer1.exe 2800 customer1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Sidebar\\Waxylajilo.exe\"" Ultra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hbggg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\A: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 75 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2756 set thread context of 2672 2756 toolspab1.exe 88 -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\BWCGCIQJQA\ultramediaburner.exe Ultra.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-QMHQ2.tmp ultramediaburner.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-90DO4.tmp ultramediaburner.tmp File created C:\Program Files (x86)\Windows Sidebar\Waxylajilo.exe.config Ultra.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File created C:\Program Files\Common Files\BWCGCIQJQA\ultramediaburner.exe.config Ultra.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Windows Sidebar\Waxylajilo.exe Ultra.exe -
Drops file in Windows directory 30 IoCs
description ioc Process File created C:\Windows\Installer\f74f602.msi msiexec.exe File created C:\Windows\Installer\f74f604.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1F38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI24B7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI45.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF9A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI20FE.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\f74f604.ipi msiexec.exe File opened for modification C:\Windows\Installer\f74f602.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFEBD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1620.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI431.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C69.tmp msiexec.exe File created C:\Windows\Installer\f74f606.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI326.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD46.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1DD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBEF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI19E8.tmp msiexec.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe -
Kills process with taskkill 2 IoCs
pid Process 2080 taskkill.exe 2080 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "17" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "390" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "390" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "391" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "80" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "342" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "391" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "38" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "248" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "248" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "372" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "372" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "292" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "354" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000c62fc393ca0ca048ae8ac38464592904118b6e94d1e13b1a388c342304855599000000000e800000000200002000000085b0da2745972b1fef466b21080a0326a37592445b53623f88dc58e82810198290000000845b0d66086c71dbb043b3147e5e90724781b7ce7db6da0e12e9b5610f73f097977da10be8c47afb5a5eb4db5ea801d50e8d35897120c21ebbee4d757b8a0948feee7316484d94bcac84c2730a67e58d82b6c4380d0a63e1bf94cff90cef0916dfe7ec679e1590e5e98effa58e2894b0468988e72c950c6da47f1400e3f19b6d4925fc11432fce2fb7c380a57d53161040000000ad9ba8a675acb1aa030164ac6656fcf8354aabbf37bf98a1ebfa070a10c68ce69068004a0293b3e73ec91c6ea1a1de49560f81f36e27d964e312cb3644e3ea5f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "17" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "38" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "327" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "372" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327501642" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADF85BF1-B255-11EB-849A-C2EBB310CB62} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "327" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "342" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "38" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "80" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "354" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03e95936246d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "292" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "292" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "354" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\ = "391" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz\Total = "80" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\girls.xyz IEXPLORE.EXE -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "6BBF4B2F4524B25478C17BFBEE2559F7" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductIcon = "C:\\Windows\\Installer\\{C845414C-903C-4218-9DE7-132AB97FDF62}\\logo.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Y.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde askinstall39.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f000000190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 askinstall39.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 askinstall39.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C askinstall39.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2056 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 8 IoCs
pid Process 2384 001.exe 2364 installer.exe 2920 hbggg.exe 2068 huesaa.exe 2112 setup.exe 2744 askinstall39.exe 2800 customer1.exe 2756 toolspab1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 432 ultramediaburner.tmp 432 ultramediaburner.tmp 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe 300 Qikaekyvari.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2672 toolspab1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 300 Qikaekyvari.exe Token: SeRestorePrivilege 2416 msiexec.exe Token: SeTakeOwnershipPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 2416 msiexec.exe Token: SeCreateTokenPrivilege 2364 installer.exe Token: SeAssignPrimaryTokenPrivilege 2364 installer.exe Token: SeLockMemoryPrivilege 2364 installer.exe Token: SeIncreaseQuotaPrivilege 2364 installer.exe Token: SeMachineAccountPrivilege 2364 installer.exe Token: SeTcbPrivilege 2364 installer.exe Token: SeSecurityPrivilege 2364 installer.exe Token: SeTakeOwnershipPrivilege 2364 installer.exe Token: SeLoadDriverPrivilege 2364 installer.exe Token: SeSystemProfilePrivilege 2364 installer.exe Token: SeSystemtimePrivilege 2364 installer.exe Token: SeProfSingleProcessPrivilege 2364 installer.exe Token: SeIncBasePriorityPrivilege 2364 installer.exe Token: SeCreatePagefilePrivilege 2364 installer.exe Token: SeCreatePermanentPrivilege 2364 installer.exe Token: SeBackupPrivilege 2364 installer.exe Token: SeRestorePrivilege 2364 installer.exe Token: SeShutdownPrivilege 2364 installer.exe Token: SeDebugPrivilege 2364 installer.exe Token: SeAuditPrivilege 2364 installer.exe Token: SeSystemEnvironmentPrivilege 2364 installer.exe Token: SeChangeNotifyPrivilege 2364 installer.exe Token: SeRemoteShutdownPrivilege 2364 installer.exe Token: SeUndockPrivilege 2364 installer.exe Token: SeSyncAgentPrivilege 2364 installer.exe Token: SeEnableDelegationPrivilege 2364 installer.exe Token: SeManageVolumePrivilege 2364 installer.exe Token: SeImpersonatePrivilege 2364 installer.exe Token: SeCreateGlobalPrivilege 2364 installer.exe Token: SeCreateTokenPrivilege 2364 installer.exe Token: SeAssignPrimaryTokenPrivilege 2364 installer.exe Token: SeLockMemoryPrivilege 2364 installer.exe Token: SeIncreaseQuotaPrivilege 2364 installer.exe Token: SeMachineAccountPrivilege 2364 installer.exe Token: SeTcbPrivilege 2364 installer.exe Token: SeSecurityPrivilege 2364 installer.exe Token: SeTakeOwnershipPrivilege 2364 installer.exe Token: SeLoadDriverPrivilege 2364 installer.exe Token: SeSystemProfilePrivilege 2364 installer.exe Token: SeSystemtimePrivilege 2364 installer.exe Token: SeProfSingleProcessPrivilege 2364 installer.exe Token: SeIncBasePriorityPrivilege 2364 installer.exe Token: SeCreatePagefilePrivilege 2364 installer.exe Token: SeCreatePermanentPrivilege 2364 installer.exe Token: SeBackupPrivilege 2364 installer.exe Token: SeRestorePrivilege 2364 installer.exe Token: SeShutdownPrivilege 2364 installer.exe Token: SeDebugPrivilege 2364 installer.exe Token: SeAuditPrivilege 2364 installer.exe Token: SeSystemEnvironmentPrivilege 2364 installer.exe Token: SeChangeNotifyPrivilege 2364 installer.exe Token: SeRemoteShutdownPrivilege 2364 installer.exe Token: SeUndockPrivilege 2364 installer.exe Token: SeSyncAgentPrivilege 2364 installer.exe Token: SeEnableDelegationPrivilege 2364 installer.exe Token: SeManageVolumePrivilege 2364 installer.exe Token: SeImpersonatePrivilege 2364 installer.exe Token: SeCreateGlobalPrivilege 2364 installer.exe Token: SeCreateTokenPrivilege 2364 installer.exe Token: SeAssignPrimaryTokenPrivilege 2364 installer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 432 ultramediaburner.tmp 608 iexplore.exe 2364 installer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 608 iexplore.exe 608 iexplore.exe 308 IEXPLORE.EXE 308 IEXPLORE.EXE 956 IEXPLORE.EXE 956 IEXPLORE.EXE 956 IEXPLORE.EXE 956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1756 wrote to memory of 1980 1756 Install2.exe 26 PID 1980 wrote to memory of 1140 1980 Install2.tmp 32 PID 1980 wrote to memory of 1140 1980 Install2.tmp 32 PID 1980 wrote to memory of 1140 1980 Install2.tmp 32 PID 1980 wrote to memory of 1140 1980 Install2.tmp 32 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 1140 wrote to memory of 436 1140 Ultra.exe 33 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 436 wrote to memory of 432 436 ultramediaburner.exe 34 PID 1140 wrote to memory of 1696 1140 Ultra.exe 35 PID 1140 wrote to memory of 1696 1140 Ultra.exe 35 PID 1140 wrote to memory of 1696 1140 Ultra.exe 35 PID 432 wrote to memory of 1584 432 ultramediaburner.tmp 36 PID 432 wrote to memory of 1584 432 ultramediaburner.tmp 36 PID 432 wrote to memory of 1584 432 ultramediaburner.tmp 36 PID 432 wrote to memory of 1584 432 ultramediaburner.tmp 36 PID 1140 wrote to memory of 300 1140 Ultra.exe 37 PID 1140 wrote to memory of 300 1140 Ultra.exe 37 PID 1140 wrote to memory of 300 1140 Ultra.exe 37 PID 1696 wrote to memory of 608 1696 Paejiwekeki.exe 39 PID 1696 wrote to memory of 608 1696 Paejiwekeki.exe 39 PID 1696 wrote to memory of 608 1696 Paejiwekeki.exe 39 PID 608 wrote to memory of 308 608 iexplore.exe 40 PID 608 wrote to memory of 308 608 iexplore.exe 40 PID 608 wrote to memory of 308 608 iexplore.exe 40 PID 608 wrote to memory of 308 608 iexplore.exe 40 PID 300 wrote to memory of 2268 300 Qikaekyvari.exe 43 PID 300 wrote to memory of 2268 300 Qikaekyvari.exe 43 PID 300 wrote to memory of 2268 300 Qikaekyvari.exe 43 PID 2268 wrote to memory of 2384 2268 cmd.exe 45 PID 2268 wrote to memory of 2384 2268 cmd.exe 45 PID 2268 wrote to memory of 2384 2268 cmd.exe 45 PID 2268 wrote to memory of 2384 2268 cmd.exe 45 PID 300 wrote to memory of 2740 300 Qikaekyvari.exe 46 PID 300 wrote to memory of 2740 300 Qikaekyvari.exe 46 PID 300 wrote to memory of 2740 300 Qikaekyvari.exe 46 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2740 wrote to memory of 2364 2740 cmd.exe 48 PID 2416 wrote to memory of 2648 2416 msiexec.exe 50 PID 2416 wrote to memory of 2648 2416 msiexec.exe 50 PID 2416 wrote to memory of 2648 2416 msiexec.exe 50 PID 2416 wrote to memory of 2648 2416 msiexec.exe 50 PID 2416 wrote to memory of 2648 2416 msiexec.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install2.exe"C:\Users\Admin\AppData\Local\Temp\Install2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\is-LII8A.tmp\Install2.tmp"C:\Users\Admin\AppData\Local\Temp\is-LII8A.tmp\Install2.tmp" /SL5="$40158,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\is-G0F6V.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-G0F6V.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Common Files\BWCGCIQJQA\ultramediaburner.exe"C:\Program Files\Common Files\BWCGCIQJQA\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\is-VEL4C.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-VEL4C.tmp\ultramediaburner.tmp" /SL5="$80128,281924,62464,C:\Program Files\Common Files\BWCGCIQJQA\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:1584
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6d-dbf1c-235-c4a9b-450d0e5922713\Paejiwekeki.exe"C:\Users\Admin\AppData\Local\Temp\6d-dbf1c-235-c4a9b-450d0e5922713\Paejiwekeki.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e65⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:340994 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:1586390 /prefetch:26⤵PID:7656
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad5⤵PID:1376
-
-
-
C:\Users\Admin\AppData\Local\Temp\78-e7e85-8f9-b4c82-dc5ce5751aa8e\Qikaekyvari.exe"C:\Users\Admin\AppData\Local\Temp\78-e7e85-8f9-b4c82-dc5ce5751aa8e\Qikaekyvari.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j5cc1ehh.nik\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\j5cc1ehh.nik\001.exeC:\Users\Admin\AppData\Local\Temp\j5cc1ehh.nik\001.exe6⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\en0chf55.1fm\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\en0chf55.1fm\installer.exeC:\Users\Admin\AppData\Local\Temp\en0chf55.1fm\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2364 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\en0chf55.1fm\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\en0chf55.1fm\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1620477382 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:2232
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lnwxtb3s.c4v\hbggg.exe & exit5⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\lnwxtb3s.c4v\hbggg.exeC:\Users\Admin\AppData\Local\Temp\lnwxtb3s.c4v\hbggg.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:412
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7608
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7560
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jvwpjbd2.jlh\huesaa.exe & exit5⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\jvwpjbd2.jlh\huesaa.exeC:\Users\Admin\AppData\Local\Temp\jvwpjbd2.jlh\huesaa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7604
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sqsnl0l3.mmv\setup.exe & exit5⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\sqsnl0l3.mmv\setup.exeC:\Users\Admin\AppData\Local\Temp\sqsnl0l3.mmv\setup.exe6⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\sqsnl0l3.mmv\setup.exe"7⤵PID:2928
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30008⤵
- Runs ping.exe
PID:2056
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pi3l4ctq.hyc\askinstall39.exe & exit5⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\pi3l4ctq.hyc\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\pi3l4ctq.hyc\askinstall39.exe6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2744 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:2220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:2080
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cuov1kby.4vl\customer1.exe & exit5⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\cuov1kby.4vl\customer1.exeC:\Users\Admin\AppData\Local\Temp\cuov1kby.4vl\customer1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7748
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7364
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0dtqvmex.wf0\toolspab1.exe & exit5⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\0dtqvmex.wf0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\0dtqvmex.wf0\toolspab1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\0dtqvmex.wf0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\0dtqvmex.wf0\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2672
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y0eujh1m.se0\GcleanerWW.exe /mixone & exit5⤵PID:3052
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99008C91DEDF426381FC1C2CC6A054C1 C2⤵
- Loads dropped DLL
PID:2648
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5C814365F38E70EBB6ADD403A08512FC2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:2080
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DDB62217A5A718243D7DDB17DBE3CA27 M Global\MSI00002⤵
- Loads dropped DLL
PID:2144
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B3E4D072-6DEB-4D30-8892-221830087A74} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1780
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80802⤵PID:1092
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 80802⤵PID:2628
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 80802⤵PID:1604
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 80802⤵PID:2228
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80802⤵PID:4840
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 80802⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\9933.exeC:\Users\Admin\AppData\Local\Temp\9933.exe1⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\A258.exeC:\Users\Admin\AppData\Local\Temp\A258.exe1⤵PID:7796
-
C:\Users\Admin\AppData\Local\Temp\EB89.exeC:\Users\Admin\AppData\Local\Temp\EB89.exe1⤵PID:7856
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rqfxpqso\2⤵PID:7876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\namjcpue.exe" C:\Windows\SysWOW64\rqfxpqso\2⤵PID:1684
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create rqfxpqso binPath= "C:\Windows\SysWOW64\rqfxpqso\namjcpue.exe /d\"C:\Users\Admin\AppData\Local\Temp\EB89.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:2452
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description rqfxpqso "wifi internet conection"2⤵PID:7964
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start rqfxpqso2⤵PID:7988
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:7984
-
-
C:\Users\Admin\AppData\Local\Temp\F875.exeC:\Users\Admin\AppData\Local\Temp\F875.exe1⤵PID:7940
-
C:\Windows\SysWOW64\rqfxpqso\namjcpue.exeC:\Windows\SysWOW64\rqfxpqso\namjcpue.exe /d"C:\Users\Admin\AppData\Local\Temp\EB89.exe"1⤵PID:8008
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:8120
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o masari.miner.rocks:30162 -u 9rqX2BQ6Z4teAkaSqGBWvPZEM7bAtidewXXjYz86pVgKUQqDHeUqjy55fXt2fJAaJkPBteXWhptFqJVSr132QxsSSGfMCgw.50000 -p w=a -k -a cn/half3⤵PID:7552
-
-
-
C:\Users\Admin\AppData\Local\Temp\40A.exeC:\Users\Admin\AppData\Local\Temp\40A.exe1⤵PID:8088
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8140
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7376
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:8076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7424
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7468
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7512
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:820
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7600
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7624
-
C:\Windows\system32\taskeng.exetaskeng.exe {79B43300-23C2-449E-9B3B-BEE2AAF8FC10} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:7676
-
C:\Users\Admin\AppData\Roaming\jugthftC:\Users\Admin\AppData\Roaming\jugthft2⤵PID:7724
-
C:\Users\Admin\AppData\Roaming\jugthftC:\Users\Admin\AppData\Roaming\jugthft3⤵PID:1168
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {72764381-43DC-4419-B6AC-DA509F0B5C2B} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:7452
-
C:\Users\Admin\AppData\Roaming\jugthftC:\Users\Admin\AppData\Roaming\jugthft2⤵PID:7836
-
C:\Users\Admin\AppData\Roaming\jugthftC:\Users\Admin\AppData\Roaming\jugthft3⤵PID:3024
-
-