Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
8ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
9ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
8ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
8win102
windows10_x64
8win102
windows10_x64
8win102
windows10_x64
8win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
8win105
windows10_x64
10win105
windows10_x64
8win105
windows10_x64
8win105
windows10_x64
8Resubmissions
12-11-2024 01:29
241112-bwgrxs1gnf 1008-07-2021 12:18
210708-8z6d5h8z2n 1006-07-2021 17:53
210706-g6we6sa7sa 1019-06-2021 18:17
210619-vr8bj2dzfn 1017-06-2021 21:39
210617-a9cvlnmrbx 1011-06-2021 17:26
210611-wvab1yw2tj 1008-06-2021 06:47
210608-qrbpch3y46 1008-06-2021 06:47
210608-64tndgm1ln 1005-06-2021 18:40
210605-cd6qpr55sx 1004-06-2021 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
13s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-05-2021 18:11
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Install.exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
keygen-step-4d.exe
Resource
win10v20210408
General
-
Target
Install2.exe
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 8 IoCs
pid Process 368 Install2.tmp 2496 Ultra.exe 1272 ultramediaburner.exe 3996 ultramediaburner.tmp 2088 ZHomafebyha.exe 4028 UltraMediaBurner.exe 2160 ZHukaezhuxaeva.exe 4636 001.exe -
resource yara_rule behavioral14/files/0x000100000001abc8-170.dat upx behavioral14/files/0x000100000001abc8-171.dat upx behavioral14/files/0x000100000001ac3a-219.dat upx behavioral14/files/0x000100000001ac3a-220.dat upx -
resource yara_rule behavioral14/memory/6036-317-0x0000000000400000-0x000000000065D000-memory.dmp vmprotect behavioral14/memory/5756-320-0x00000000013B0000-0x0000000001A0F000-memory.dmp vmprotect behavioral14/files/0x000300000001ac3d-277.dat vmprotect behavioral14/files/0x000300000001ac3d-276.dat vmprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation 702564a0.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation ZHomafebyha.exe -
Loads dropped DLL 1 IoCs
pid Process 368 Install2.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\UltraMediaBurner\\Lushagaejaeky.exe\"" Ultra.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 239 ipinfo.io 433 ip-api.com 44 ip-api.com 61 ipinfo.io 64 ipinfo.io 145 ip-api.com 234 ipinfo.io 237 ipinfo.io -
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\Lushagaejaeky.exe Ultra.exe File created C:\Program Files\Mozilla Firefox\AOWAAACWVZ\ultramediaburner.exe.config Ultra.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-DN7PB.tmp ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-61G9D.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\Lushagaejaeky.exe.config Ultra.exe File created C:\Program Files\Mozilla Firefox\AOWAAACWVZ\ultramediaburner.exe Ultra.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 6548 5804 WerFault.exe 131 2156 2660 WerFault.exe 231 4876 7612 WerFault.exe 280 -
Kills process with taskkill 2 IoCs
pid Process 5884 taskkill.exe 6588 taskkill.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{C6C9274B-FB42-4DE0-867C-A479BD8D191C} = "0" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 0100000030cd398432f789353245cbea45f7a10df00cbec2e647395a0f2349009dedc4d5f979bf96d910368620988ffc557f549d491d724a4cc33b5df38f3eb332d9 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows 702564a0.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000054a06b9b514cc5e9f305e57ce68ed905d1c9f97b9eddbd19ab5dfbef6a99550ece85fcdfed7acccd706730b37866b80aee3cf9af437827f30f84f169b815f94a18012e046b0a6ccf99dd0f1eb2cbb17111cb99e274c5d0cd82f 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge 702564a0.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5" 702564a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{29921A04-045C-4577-9F4F-0E8E13D1256F}" 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser 702564a0.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory 702564a0.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a 702564a0.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a 702564a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" 702564a0.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 ZHomafebyha.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ZHomafebyha.exe -
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 343 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 349 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 62 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 67 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 236 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 238 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 243 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 244 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3996 ultramediaburner.tmp 3996 ultramediaburner.tmp 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe 2160 ZHukaezhuxaeva.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2496 Ultra.exe Token: SeDebugPrivilege 2088 ZHomafebyha.exe Token: SeDebugPrivilege 2160 ZHukaezhuxaeva.exe Token: SeDebugPrivilege 4128 702564a0.exe Token: SeDebugPrivilege 4128 702564a0.exe Token: SeDebugPrivilege 4128 702564a0.exe Token: SeDebugPrivilege 4128 702564a0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3996 ultramediaburner.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4128 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3368 wrote to memory of 368 3368 Install2.exe 73 PID 3368 wrote to memory of 368 3368 Install2.exe 73 PID 3368 wrote to memory of 368 3368 Install2.exe 73 PID 368 wrote to memory of 2496 368 Install2.tmp 77 PID 368 wrote to memory of 2496 368 Install2.tmp 77 PID 2496 wrote to memory of 1272 2496 Ultra.exe 80 PID 2496 wrote to memory of 1272 2496 Ultra.exe 80 PID 2496 wrote to memory of 1272 2496 Ultra.exe 80 PID 1272 wrote to memory of 3996 1272 ultramediaburner.exe 81 PID 1272 wrote to memory of 3996 1272 ultramediaburner.exe 81 PID 1272 wrote to memory of 3996 1272 ultramediaburner.exe 81 PID 2496 wrote to memory of 2088 2496 Ultra.exe 82 PID 2496 wrote to memory of 2088 2496 Ultra.exe 82 PID 3996 wrote to memory of 4028 3996 ultramediaburner.tmp 83 PID 3996 wrote to memory of 4028 3996 ultramediaburner.tmp 83 PID 2496 wrote to memory of 2160 2496 Ultra.exe 84 PID 2496 wrote to memory of 2160 2496 Ultra.exe 84 PID 2160 wrote to memory of 4428 2160 ZHukaezhuxaeva.exe 90 PID 2160 wrote to memory of 4428 2160 ZHukaezhuxaeva.exe 90 PID 4428 wrote to memory of 4636 4428 cmd.exe 92 PID 4428 wrote to memory of 4636 4428 cmd.exe 92 PID 4428 wrote to memory of 4636 4428 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install2.exe"C:\Users\Admin\AppData\Local\Temp\Install2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\is-DEHCB.tmp\Install2.tmp"C:\Users\Admin\AppData\Local\Temp\is-DEHCB.tmp\Install2.tmp" /SL5="$801DA,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\is-BOAC2.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-BOAC2.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files\Mozilla Firefox\AOWAAACWVZ\ultramediaburner.exe"C:\Program Files\Mozilla Firefox\AOWAAACWVZ\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\is-4EO36.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-4EO36.tmp\ultramediaburner.tmp" /SL5="$B006C,281924,62464,C:\Program Files\Mozilla Firefox\AOWAAACWVZ\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:4028
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5c-0aa8a-184-5e4b9-7274ff1d06595\ZHomafebyha.exe"C:\Users\Admin\AppData\Local\Temp\5c-0aa8a-184-5e4b9-7274ff1d06595\ZHomafebyha.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\d7-982ca-2a8-b7aa4-5e1e8b18cddc4\ZHukaezhuxaeva.exe"C:\Users\Admin\AppData\Local\Temp\d7-982ca-2a8-b7aa4-5e1e8b18cddc4\ZHukaezhuxaeva.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ucpkauy3.oyi\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\ucpkauy3.oyi\001.exeC:\Users\Admin\AppData\Local\Temp\ucpkauy3.oyi\001.exe6⤵
- Executes dropped EXE
PID:4636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fbpyayxe.jjo\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\fbpyayxe.jjo\installer.exeC:\Users\Admin\AppData\Local\Temp\fbpyayxe.jjo\installer.exe /qn CAMPAIGN="654"6⤵PID:4876
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fbpyayxe.jjo\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\fbpyayxe.jjo\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1621188481 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:5216
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pefansw4.a3y\hbggg.exe & exit5⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\pefansw4.a3y\hbggg.exeC:\Users\Admin\AppData\Local\Temp\pefansw4.a3y\hbggg.exe6⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:4324
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:2264
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dropzu1z.a1y\Setup3310.exe /Verysilent /subid=623 & exit5⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\dropzu1z.a1y\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\dropzu1z.a1y\Setup3310.exe /Verysilent /subid=6236⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\is-VN2S8.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-VN2S8.tmp\Setup3310.tmp" /SL5="$20354,138429,56832,C:\Users\Admin\AppData\Local\Temp\dropzu1z.a1y\Setup3310.exe" /Verysilent /subid=6237⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\is-KTNPK.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KTNPK.tmp\Setup.exe" /Verysilent8⤵PID:5408
-
C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"9⤵PID:5736
-
C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"10⤵PID:6808
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:6016
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:5164
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"9⤵PID:5852
-
C:\Users\Admin\AppData\Roaming\8299882.exe"C:\Users\Admin\AppData\Roaming\8299882.exe"10⤵PID:5684
-
-
C:\Users\Admin\AppData\Roaming\8553024.exe"C:\Users\Admin\AppData\Roaming\8553024.exe"10⤵PID:5352
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"11⤵PID:6148
-
-
-
C:\Users\Admin\AppData\Roaming\1225502.exe"C:\Users\Admin\AppData\Roaming\1225502.exe"10⤵PID:5704
-
-
C:\Users\Admin\AppData\Roaming\2202701.exe"C:\Users\Admin\AppData\Roaming\2202701.exe"10⤵PID:6252
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"9⤵PID:5888
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"9⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\is-216UD.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-216UD.tmp\lylal220.tmp" /SL5="$3043A,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"10⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\is-PJMSL.tmp\4_177039.exe"C:\Users\Admin\AppData\Local\Temp\is-PJMSL.tmp\4_177039.exe" /S /UID=lylal22011⤵PID:6032
-
C:\Program Files\VideoLAN\GJWNYCMTBO\irecord.exe"C:\Program Files\VideoLAN\GJWNYCMTBO\irecord.exe" /VERYSILENT12⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\is-3QGPO.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-3QGPO.tmp\irecord.tmp" /SL5="$2052A,6139911,56832,C:\Program Files\VideoLAN\GJWNYCMTBO\irecord.exe" /VERYSILENT13⤵PID:7136
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu14⤵PID:5924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e1-d22c0-6f4-a0faa-bd7f35d34addf\Lodelyfiry.exe"C:\Users\Admin\AppData\Local\Temp\e1-d22c0-6f4-a0faa-bd7f35d34addf\Lodelyfiry.exe"12⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\d4-92ce1-560-f2085-55b74d2bc415b\Juhysyfoco.exe"C:\Users\Admin\AppData\Local\Temp\d4-92ce1-560-f2085-55b74d2bc415b\Juhysyfoco.exe"12⤵PID:5896
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nlfagkxf.ejg\001.exe & exit13⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\nlfagkxf.ejg\001.exeC:\Users\Admin\AppData\Local\Temp\nlfagkxf.ejg\001.exe14⤵PID:6900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\szh4vro0.o4k\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\szh4vro0.o4k\installer.exeC:\Users\Admin\AppData\Local\Temp\szh4vro0.o4k\installer.exe /qn CAMPAIGN="654"14⤵PID:2156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qj35dwju.1pz\hbggg.exe & exit13⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\qj35dwju.1pz\hbggg.exeC:\Users\Admin\AppData\Local\Temp\qj35dwju.1pz\hbggg.exe14⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:3756
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:1000
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cyawnufg.2ah\Setup3310.exe /Verysilent /subid=623 & exit13⤵PID:8116
-
C:\Users\Admin\AppData\Local\Temp\cyawnufg.2ah\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\cyawnufg.2ah\Setup3310.exe /Verysilent /subid=62314⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\is-5PSM6.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-5PSM6.tmp\Setup3310.tmp" /SL5="$402F0,138429,56832,C:\Users\Admin\AppData\Local\Temp\cyawnufg.2ah\Setup3310.exe" /Verysilent /subid=62315⤵PID:6940
-
C:\Users\Admin\AppData\Local\Temp\is-CQDO0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-CQDO0.tmp\Setup.exe" /Verysilent16⤵PID:7192
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wb0ymx01.xz4\google-game.exe & exit13⤵PID:7704
-
C:\Users\Admin\AppData\Local\Temp\wb0ymx01.xz4\google-game.exeC:\Users\Admin\AppData\Local\Temp\wb0ymx01.xz4\google-game.exe14⤵PID:4620
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser15⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 61616⤵
- Program crash
PID:2156
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0nsnp45q.0wc\flashplayer.exe & exit13⤵PID:7252
-
C:\Users\Admin\AppData\Local\Temp\0nsnp45q.0wc\flashplayer.exeC:\Users\Admin\AppData\Local\Temp\0nsnp45q.0wc\flashplayer.exe14⤵PID:4548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qnvvlf4u.1fm\setup.exe & exit13⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\qnvvlf4u.1fm\setup.exeC:\Users\Admin\AppData\Local\Temp\qnvvlf4u.1fm\setup.exe14⤵PID:7128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4rbpi3gz.4fu\customer1.exe & exit13⤵PID:7512
-
C:\Users\Admin\AppData\Local\Temp\4rbpi3gz.4fu\customer1.exeC:\Users\Admin\AppData\Local\Temp\4rbpi3gz.4fu\customer1.exe14⤵PID:7268
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:7560
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:7320
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vqwiaeeb.mhk\GcleanerWW.exe /mixone & exit13⤵PID:4828
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f1yoqgxf.i1r\005.exe & exit13⤵PID:7748
-
C:\Users\Admin\AppData\Local\Temp\f1yoqgxf.i1r\005.exeC:\Users\Admin\AppData\Local\Temp\f1yoqgxf.i1r\005.exe14⤵PID:4940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pdg23xeo.1ui\toolspab1.exe & exit13⤵PID:7412
-
C:\Users\Admin\AppData\Local\Temp\pdg23xeo.1ui\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\pdg23xeo.1ui\toolspab1.exe14⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\pdg23xeo.1ui\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\pdg23xeo.1ui\toolspab1.exe15⤵PID:4512
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hhotokvj.d5g\702564a0.exe & exit13⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\hhotokvj.d5g\702564a0.exeC:\Users\Admin\AppData\Local\Temp\hhotokvj.d5g\702564a0.exe14⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iedto0ar.cd1\app.exe /8-2222 & exit13⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\iedto0ar.cd1\app.exeC:\Users\Admin\AppData\Local\Temp\iedto0ar.cd1\app.exe /8-222214⤵PID:4596
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"9⤵PID:6088
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵PID:5612
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
PID:6588
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"9⤵PID:6036
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"9⤵PID:5932
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵PID:5804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 76410⤵
- Program crash
PID:6548
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\urpdyugd.d4g\google-game.exe & exit5⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\urpdyugd.d4g\google-game.exeC:\Users\Admin\AppData\Local\Temp\urpdyugd.d4g\google-game.exe6⤵PID:4444
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser7⤵PID:5140
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bm32vthg.3dt\flashplayer.exe & exit5⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\bm32vthg.3dt\flashplayer.exeC:\Users\Admin\AppData\Local\Temp\bm32vthg.3dt\flashplayer.exe6⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\irecCH4.exe"C:\Users\Admin\AppData\Local\Temp\irecCH4.exe"7⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\is-HTESS.tmp\irecCH4.tmp"C:\Users\Admin\AppData\Local\Temp\is-HTESS.tmp\irecCH4.tmp" /SL5="$40532,140559,56832,C:\Users\Admin\AppData\Local\Temp\irecCH4.exe"8⤵PID:8144
-
C:\Users\Admin\AppData\Local\Temp\is-7KO2H.tmp\sa__N___FOU____R__45__.exe"C:\Users\Admin\AppData\Local\Temp\is-7KO2H.tmp\sa__N___FOU____R__45__.exe" /S /UID=irecordch49⤵PID:3944
-
C:\Program Files\Windows Multimedia Platform\NRGYALRAMV\irecord.exe"C:\Program Files\Windows Multimedia Platform\NRGYALRAMV\irecord.exe" /VERYSILENT10⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\is-V2937.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-V2937.tmp\irecord.tmp" /SL5="$F007C,6139911,56832,C:\Program Files\Windows Multimedia Platform\NRGYALRAMV\irecord.exe" /VERYSILENT11⤵PID:5708
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu12⤵PID:7844
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8e-43ff7-cc4-b9ca4-2da28653f4da5\Huzhoqygili.exe"C:\Users\Admin\AppData\Local\Temp\8e-43ff7-cc4-b9ca4-2da28653f4da5\Huzhoqygili.exe"10⤵PID:7988
-
-
C:\Users\Admin\AppData\Local\Temp\f9-63d42-03b-c4695-27c7558f9e80b\Lypamaetika.exe"C:\Users\Admin\AppData\Local\Temp\f9-63d42-03b-c4695-27c7558f9e80b\Lypamaetika.exe"10⤵PID:4984
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jg8_mysu.exe"C:\Users\Admin\AppData\Local\Temp\jg8_mysu.exe"7⤵PID:4608
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵PID:5448
-
-
C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"7⤵PID:5016
-
C:\Users\Admin\AppData\Roaming\5947769.exe"C:\Users\Admin\AppData\Roaming\5947769.exe"8⤵PID:4528
-
-
C:\Users\Admin\AppData\Roaming\1184088.exe"C:\Users\Admin\AppData\Roaming\1184088.exe"8⤵PID:5076
-
-
C:\Users\Admin\AppData\Roaming\2667571.exe"C:\Users\Admin\AppData\Roaming\2667571.exe"8⤵PID:6572
-
-
-
C:\Users\Admin\AppData\Local\Temp\liwei.exe"C:\Users\Admin\AppData\Local\Temp\liwei.exe"7⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\y1.exe"C:\Users\Admin\AppData\Local\Temp\y1.exe"7⤵PID:7468
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nzgsabhb.ti1\setup.exe & exit5⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\nzgsabhb.ti1\setup.exeC:\Users\Admin\AppData\Local\Temp\nzgsabhb.ti1\setup.exe6⤵PID:6396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0pmb5hw.ib1\customer1.exe & exit5⤵PID:6176
-
C:\Users\Admin\AppData\Local\Temp\w0pmb5hw.ib1\customer1.exeC:\Users\Admin\AppData\Local\Temp\w0pmb5hw.ib1\customer1.exe6⤵PID:6740
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7124
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6260
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jxlhvfvi.tjq\GcleanerWW.exe /mixone & exit5⤵PID:6416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qntjbxoy.ugf\005.exe & exit5⤵PID:6544
-
C:\Users\Admin\AppData\Local\Temp\qntjbxoy.ugf\005.exeC:\Users\Admin\AppData\Local\Temp\qntjbxoy.ugf\005.exe6⤵PID:6848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v2mu2qac.zof\toolspab1.exe & exit5⤵PID:7244
-
C:\Users\Admin\AppData\Local\Temp\v2mu2qac.zof\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\v2mu2qac.zof\toolspab1.exe6⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\v2mu2qac.zof\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\v2mu2qac.zof\toolspab1.exe7⤵PID:4688
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k4gn0kiw.ozt\702564a0.exe & exit5⤵PID:6396
-
C:\Users\Admin\AppData\Local\Temp\k4gn0kiw.ozt\702564a0.exeC:\Users\Admin\AppData\Local\Temp\k4gn0kiw.ozt\702564a0.exe6⤵PID:5228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\21dotoss.d0s\app.exe /8-2222 & exit5⤵PID:7524
-
C:\Users\Admin\AppData\Local\Temp\21dotoss.d0s\app.exeC:\Users\Admin\AppData\Local\Temp\21dotoss.d0s\app.exe /8-22226⤵PID:2648
-
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4128
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4180
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4480
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4532
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:3704
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 346F56FCDCB6B4C3777A3D8DCEA65DD7 C2⤵PID:3852
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 29BF6FA44F69805059D4C088994F32AD2⤵PID:5324
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:5884
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DDEB0CB116D7579F1B810163EA20F597 E Global\MSI00002⤵PID:7404
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\is-R4U4J.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-R4U4J.tmp\LabPicV3.tmp" /SL5="$1044C,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"1⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\is-9HIOL.tmp\3316505.exe"C:\Users\Admin\AppData\Local\Temp\is-9HIOL.tmp\3316505.exe" /S /UID=lab2142⤵PID:6096
-
C:\Program Files\VideoLAN\HORNDPDIZR\prolab.exe"C:\Program Files\VideoLAN\HORNDPDIZR\prolab.exe" /VERYSILENT3⤵PID:6920
-
C:\Users\Admin\AppData\Local\Temp\is-6NEQA.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-6NEQA.tmp\prolab.tmp" /SL5="$303F6,575243,216576,C:\Program Files\VideoLAN\HORNDPDIZR\prolab.exe" /VERYSILENT4⤵PID:6988
-
-
-
C:\Users\Admin\AppData\Local\Temp\57-e31ed-277-b37b8-06f59a2fba353\Gesadugusu.exe"C:\Users\Admin\AppData\Local\Temp\57-e31ed-277-b37b8-06f59a2fba353\Gesadugusu.exe"3⤵PID:7072
-
-
C:\Users\Admin\AppData\Local\Temp\db-2f97e-3d3-b1b80-0612d6f5af095\Komobybeni.exe"C:\Users\Admin\AppData\Local\Temp\db-2f97e-3d3-b1b80-0612d6f5af095\Komobybeni.exe"3⤵PID:1952
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rivl42ri.nwi\001.exe & exit4⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\rivl42ri.nwi\001.exeC:\Users\Admin\AppData\Local\Temp\rivl42ri.nwi\001.exe5⤵PID:6260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\loqxxpi0.3mr\installer.exe /qn CAMPAIGN="654" & exit4⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\loqxxpi0.3mr\installer.exeC:\Users\Admin\AppData\Local\Temp\loqxxpi0.3mr\installer.exe /qn CAMPAIGN="654"5⤵PID:4836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bqagvthc.pso\hbggg.exe & exit4⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\bqagvthc.pso\hbggg.exeC:\Users\Admin\AppData\Local\Temp\bqagvthc.pso\hbggg.exe5⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:7300
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\frnohoev.ff2\Setup3310.exe /Verysilent /subid=623 & exit4⤵PID:8024
-
C:\Users\Admin\AppData\Local\Temp\frnohoev.ff2\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\frnohoev.ff2\Setup3310.exe /Verysilent /subid=6235⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\is-LHV9V.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-LHV9V.tmp\Setup3310.tmp" /SL5="$2036E,138429,56832,C:\Users\Admin\AppData\Local\Temp\frnohoev.ff2\Setup3310.exe" /Verysilent /subid=6236⤵PID:6596
-
C:\Users\Admin\AppData\Local\Temp\is-D7VVV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-D7VVV.tmp\Setup.exe" /Verysilent7⤵PID:7852
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rzkhfz5z.tif\google-game.exe & exit4⤵PID:7428
-
C:\Users\Admin\AppData\Local\Temp\rzkhfz5z.tif\google-game.exeC:\Users\Admin\AppData\Local\Temp\rzkhfz5z.tif\google-game.exe5⤵PID:4444
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser6⤵PID:5964
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2hmliynf.0m2\flashplayer.exe & exit4⤵PID:7636
-
C:\Users\Admin\AppData\Local\Temp\2hmliynf.0m2\flashplayer.exeC:\Users\Admin\AppData\Local\Temp\2hmliynf.0m2\flashplayer.exe5⤵PID:7984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubbrr2yq.0ar\setup.exe & exit4⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\ubbrr2yq.0ar\setup.exeC:\Users\Admin\AppData\Local\Temp\ubbrr2yq.0ar\setup.exe5⤵PID:6880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\inwtws2t.4fm\customer1.exe & exit4⤵PID:7900
-
C:\Users\Admin\AppData\Local\Temp\inwtws2t.4fm\customer1.exeC:\Users\Admin\AppData\Local\Temp\inwtws2t.4fm\customer1.exe5⤵PID:6604
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5832
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5696
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wqod14di.p5e\GcleanerWW.exe /mixone & exit4⤵PID:7364
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1tdnvvzu.cqs\005.exe & exit4⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\1tdnvvzu.cqs\005.exeC:\Users\Admin\AppData\Local\Temp\1tdnvvzu.cqs\005.exe5⤵PID:4760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mmu5ywqw.ive\toolspab1.exe & exit4⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\mmu5ywqw.ive\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mmu5ywqw.ive\toolspab1.exe5⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\mmu5ywqw.ive\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mmu5ywqw.ive\toolspab1.exe6⤵PID:4932
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0etjlmme.4us\702564a0.exe & exit4⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\0etjlmme.4us\702564a0.exeC:\Users\Admin\AppData\Local\Temp\0etjlmme.4us\702564a0.exe5⤵PID:7612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 4806⤵
- Program crash
PID:4876
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vapr5hzw.zpo\app.exe /8-2222 & exit4⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\vapr5hzw.zpo\app.exeC:\Users\Admin\AppData\Local\Temp\vapr5hzw.zpo\app.exe /8-22225⤵PID:7500
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4116
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:7276
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7784
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6360
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af7855 /state1:0x41c64e6d1⤵PID:5408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:6192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:7888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:6612