54c3df482d19d43646ce5a992a24233ec10a33f0733e93aa78eb468952670248

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 4 IoCs

Processes:

MsiExec.exeinstaller.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsAccessBridge-64.dll	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\WindowsAccessBridge-64.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	installer.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-64.dll	installer.exe

Drops file in Program Files directory 64 IoCs

Processes:

MsiExec.exeinstaller.exe

description	ioc	process
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\lib\deploy\messages_fr.properties	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\jaas_nt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\jabswitch.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\.lastModified	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\jjs.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.2.174165.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.2.174165.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\config\Modules\org-openide-text.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\JavaAccessBridge-32.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\lib\ext\access-bridge-32.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\bin\ucrtbase.dll	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\bin\tnameserv.exe	installer.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\lib\ext\meta-index	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\api-ms-win-core-timezone-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\lib\management\jmxremote.password.template	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\html\dcommon\gifs\doclib.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\api-ms-win-crt-math-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\THIRDPARTYLICENSEREADME.txt	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-crt-locale-l1-1-0.dll	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\bin\jps.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\core\core.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\bin\java.exe	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.2.174165.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\html\dcommon\gifs\mix.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-core-timezone-l1-1-0.dll	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\rmid.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\lib\cmm\CIEXYZ.pf	installer.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_191\lib\content-types.properties	installer.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\msvcr100.dll	MsiExec.exe

Drops file in Windows directory 52 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e5b35ed.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F32180191F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA36F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA95.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b35e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6DE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7991.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7990.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79E5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b35e1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI513D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5200.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6700.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b35e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b35e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF045.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA602.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI50AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI514E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51AE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b35e3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7970.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFA8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA857.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{32A3A4F4-B792-11D6-A78A-00B0D0180191}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI467B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI510D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI518D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBBF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA670.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b35e1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA555.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b35ed.msi	msiexec.exe
File created	C:\Windows\Installer\e5b35f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exemsiexec.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEinstaller.exejre.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4156272709"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31020286"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31020286"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b355f9fe54d901	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	jre.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{22CCB9CE-C0F2-11ED-9EF6-DA4DA442263B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\GPU	jre.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4156272709"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppName = "jp2launcher.exe"	installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe300000000020000000000106600000001000020000000104f80b5f43e785fbf827cbb5d4d41dfd9228ea7a3771d62675107f10bcc98e7000000000e8000000002000020000000be4e8dec749d5d71dd173185fb327e2a0c5f134dc22f6c4a7842aa6b52348daa20000000eede38ed0443675ad196554e79f6111afdfece9e171de609c7d543a9d066add3400000003ec4db93e90216aeeea5b312f1c6b4cd689a4ebf463dfd5f8cce79a268535d4e31ce49c71266b675a92cf2db3c672f154bf7cd3b6e657f0a0ee025819674d020	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\Policy = "3"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31020286"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a042f9fe54d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe300000000020000000000106600000001000020000000f6cea9e67589c23837453b96fae688faefe5f06d797d86e3127dccbb685de0cb000000000e8000000002000020000000bcbdd330e33b853445899f4a361d39c41edc93fd8e9dae700903752a1f91e1532000000063ec9330cf8e5d74c234655e167c702dd3a4c5495a7f48647e2ca3f6683fe2f8400000009719ba7443e85c9098023e33b568fb1a0f2f1dfa2a57bd6ded88fad09fc46a336f194402f1bad3b705b5f0c9435c9236df6058401778f8f0b36a8a446bdc2c30	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4166744041"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	installer.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

installer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_78"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0102-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0078-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_78"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0119-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0097-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0110-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0085-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_85"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0139-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0083-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0183-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_183"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0086-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0086-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_86"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0109-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_109"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0098-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0132-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0100-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0089-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0036-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0134-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_196"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0067-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0093-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_93"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0071-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0040-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0108-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0113-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_75"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0150-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0209-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0093-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_93"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0112-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0162-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0178-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_27"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0175-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0076-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0124-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0134-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_134"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0130-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0154-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0058-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0031-ABCDEFFEDCBA}	installer.exe

Modifies registry class 64 IoCs

Processes:

installer.exessvagent.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0132-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0045-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0050-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0115-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0069-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_69"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0190-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_190"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0122-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0102-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0180-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_180"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}\Shell\Open\Command	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0096-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0080-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0097-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_97"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0040-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0111-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBA}	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0030-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_30"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_13"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0106-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0034-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0072-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0124-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0057-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_57"	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0201-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.0_02"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0057-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0099-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0208-ABCDEFFEDCBB}	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBC}	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0122-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_122"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0057-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0190-ABCDEFFEDCBB}	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0179-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0144-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0005-ABCDEFFEDCBA}	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0056-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0094-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0177-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0078-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_05"	ssvagent.exe

NTFS ADS 2 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\thkkkhk422.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\jdk-8u191-windows-i586.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msiexec.exejavaws.exejp2launcher.exejavaws.exejp2launcher.exe

pid	process
2632	msiexec.exe
2632	msiexec.exe
8768	javaws.exe
8768	javaws.exe
8788	jp2launcher.exe
8788	jp2launcher.exe
3948	javaws.exe
3948	javaws.exe
1080	jp2launcher.exe
1080	jp2launcher.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

jre.exe

pid process

6900 jre.exe

pid	process
6900	jre.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeShutdownPrivilege	2668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2668	msiexec.exe
Token: SeSecurityPrivilege	2632	msiexec.exe
Token: SeCreateTokenPrivilege	2668	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2668	msiexec.exe
Token: SeLockMemoryPrivilege	2668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2668	msiexec.exe
Token: SeMachineAccountPrivilege	2668	msiexec.exe
Token: SeTcbPrivilege	2668	msiexec.exe
Token: SeSecurityPrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeLoadDriverPrivilege	2668	msiexec.exe
Token: SeSystemProfilePrivilege	2668	msiexec.exe
Token: SeSystemtimePrivilege	2668	msiexec.exe
Token: SeProfSingleProcessPrivilege	2668	msiexec.exe
Token: SeIncBasePriorityPrivilege	2668	msiexec.exe
Token: SeCreatePagefilePrivilege	2668	msiexec.exe
Token: SeCreatePermanentPrivilege	2668	msiexec.exe
Token: SeBackupPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeShutdownPrivilege	2668	msiexec.exe
Token: SeDebugPrivilege	2668	msiexec.exe
Token: SeAuditPrivilege	2668	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2668	msiexec.exe
Token: SeChangeNotifyPrivilege	2668	msiexec.exe
Token: SeRemoteShutdownPrivilege	2668	msiexec.exe
Token: SeUndockPrivilege	2668	msiexec.exe
Token: SeSyncAgentPrivilege	2668	msiexec.exe
Token: SeEnableDelegationPrivilege	2668	msiexec.exe
Token: SeManageVolumePrivilege	2668	msiexec.exe
Token: SeImpersonatePrivilege	2668	msiexec.exe
Token: SeCreateGlobalPrivilege	2668	msiexec.exe
Token: SeCreateTokenPrivilege	2668	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2668	msiexec.exe
Token: SeLockMemoryPrivilege	2668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2668	msiexec.exe
Token: SeMachineAccountPrivilege	2668	msiexec.exe
Token: SeTcbPrivilege	2668	msiexec.exe
Token: SeSecurityPrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeLoadDriverPrivilege	2668	msiexec.exe
Token: SeSystemProfilePrivilege	2668	msiexec.exe
Token: SeSystemtimePrivilege	2668	msiexec.exe
Token: SeProfSingleProcessPrivilege	2668	msiexec.exe
Token: SeIncBasePriorityPrivilege	2668	msiexec.exe
Token: SeCreatePagefilePrivilege	2668	msiexec.exe
Token: SeCreatePermanentPrivilege	2668	msiexec.exe
Token: SeBackupPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeShutdownPrivilege	2668	msiexec.exe
Token: SeDebugPrivilege	2668	msiexec.exe
Token: SeAuditPrivilege	2668	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2668	msiexec.exe
Token: SeChangeNotifyPrivilege	2668	msiexec.exe
Token: SeRemoteShutdownPrivilege	2668	msiexec.exe
Token: SeUndockPrivilege	2668	msiexec.exe
Token: SeSyncAgentPrivilege	2668	msiexec.exe
Token: SeEnableDelegationPrivilege	2668	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exefirefox.exemsiexec.exe

pid process

2192 iexplore.exe
3944 firefox.exe
3944 firefox.exe
3944 firefox.exe
3944 firefox.exe
2668 msiexec.exe
2668 msiexec.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3944 firefox.exe
3944 firefox.exe
3944 firefox.exe

pid	process
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exejdk-8u191-windows-i586.exejre.exejp2launcher.exejp2launcher.exeerror422(1).exe

pid	process
2192	iexplore.exe
2192	iexplore.exe
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
2672	jdk-8u191-windows-i586.exe
6900	jre.exe
6900	jre.exe
6900	jre.exe
6900	jre.exe
6900	jre.exe
6900	jre.exe
8788	jp2launcher.exe
1080	jp2launcher.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
7272	error422(1).exe
7272	error422(1).exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2192 wrote to memory of 1120	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 1120	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 1120	2192	iexplore.exe	IEXPLORE.EXE
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3500 wrote to memory of 3944	3500	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2848	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2848	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe
PID 3944 wrote to memory of 2032	3944	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\525660.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.0.878277012\1069588754" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9a85595-94f9-49d7-9de5-c7018134a407} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 1940 1e993b18658 gpu
3⤵
PID:2848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.1.1072884568\883970263" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b24dddb5-c9d5-4254-8438-324417014d5c} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 2332 1e985b72558 socket
3⤵
PID:2032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.2.1465782110\33343382" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3156 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a1bf931-0b02-46a5-bbc1-e76385fcf9a2} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 3288 1e996930858 tab
3⤵
PID:3332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.3.730606508\1996385469" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97574ed1-515f-48d2-a55d-cc9341177ed3} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 3624 1e996a6b258 tab
3⤵
PID:3656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.4.1353962553\641516064" -childID 3 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b970200b-ac9e-42f1-9c70-b5dccf7c874b} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 4048 1e985b62b58 tab
3⤵
PID:4464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.5.1267490025\972124259" -childID 4 -isForBrowser -prefsHandle 4776 -prefMapHandle 4772 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d27312-0ff0-4d88-a0d9-3b44be35383d} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 4788 1e998b97258 tab
3⤵
PID:1880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.7.1721351466\437288834" -childID 6 -isForBrowser -prefsHandle 5108 -prefMapHandle 5112 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38106f05-0288-45fa-938e-82a04b76d99c} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 5016 1e999238558 tab
3⤵
PID:4304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.6.729400919\536461907" -childID 5 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d72a2f-551c-4957-9bdb-66f3afd58591} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 5016 1e998bf5658 tab
3⤵
PID:2884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.8.450073321\2078964118" -childID 7 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66f0b647-a18c-4e73-9e54-eb8b9d78de63} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 5152 1e99b3a8f58 tab
3⤵
PID:5788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.9.1353921750\489784403" -parentBuildID 20221007134813 -prefsHandle 3720 -prefMapHandle 3736 -prefsLen 26930 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8373a584-aaab-4927-a4bb-2885f6fb541e} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 3684 1e99a461458 rdd
3⤵
PID:5228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.10.1723178855\1409551081" -childID 8 -isForBrowser -prefsHandle 3720 -prefMapHandle 6132 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0acc2d9-8616-44de-ba6b-aacfb2035105} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6152 1e998bf4458 tab
3⤵
PID:5732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.11.407792766\1744406778" -childID 9 -isForBrowser -prefsHandle 6364 -prefMapHandle 6276 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f62c50a6-8b7f-4d74-b68c-a74f1d35ddd8} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6084 1e99918c858 tab
3⤵
PID:4872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.13.489695485\795565808" -childID 11 -isForBrowser -prefsHandle 10256 -prefMapHandle 10260 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79bda858-1244-45ff-956f-4bc68c7d4f4f} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 10248 1e99c3dea58 tab
3⤵
PID:1320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.12.1241356440\1956651392" -childID 10 -isForBrowser -prefsHandle 10200 -prefMapHandle 3216 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10217c4f-6a9e-486f-8edf-9bb0bf8f58e4} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 2780 1e99c458e58 tab
3⤵
PID:1856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.14.1708062568\1232348226" -childID 12 -isForBrowser -prefsHandle 10808 -prefMapHandle 10812 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee6c7a95-803b-4544-b2c5-8e3ba8fa6d06} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 10844 1e9991be758 tab
3⤵
PID:5940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.15.643805844\615409186" -childID 13 -isForBrowser -prefsHandle 10984 -prefMapHandle 10980 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b3e604c-0f80-432d-8378-00bb24025cf3} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11112 1e99c765f58 tab
3⤵
PID:6080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.16.922947855\214403991" -childID 14 -isForBrowser -prefsHandle 10808 -prefMapHandle 10812 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28812446-510f-4db9-aeb0-e77466ac3709} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 10748 1e99c766e58 tab
3⤵
PID:6088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.17.323678213\1325404147" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 10700 -prefMapHandle 10036 -prefsLen 26930 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ccd2d95-23e1-43e3-a73e-c9f332503879} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11036 1e985b67258 utility
3⤵
PID:1368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.18.639935146\194942069" -childID 15 -isForBrowser -prefsHandle 9844 -prefMapHandle 9832 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cbd5c2b-a2f4-499d-b833-5e06591e2f00} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9804 1e99c45be58 tab
3⤵
PID:6072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.19.1618621744\1501396304" -childID 16 -isForBrowser -prefsHandle 9688 -prefMapHandle 9684 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc9ef1a4-fa7d-41c0-a5eb-166ba3d5f0fa} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9588 1e99c9a6458 tab
3⤵
PID:1704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.21.1440542115\1038170325" -childID 18 -isForBrowser -prefsHandle 9288 -prefMapHandle 9608 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf11271-370f-4fc1-867b-aeb2af64bc3f} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9256 1e99ddc8758 tab
3⤵
PID:5324

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.20.567462779\1709634513" -childID 17 -isForBrowser -prefsHandle 9496 -prefMapHandle 9492 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2117b9bb-2199-40e9-81a4-dff6957c9440} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9444 1e99ddc7558 tab
3⤵
PID:5604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.24.941556653\1907452189" -childID 21 -isForBrowser -prefsHandle 8608 -prefMapHandle 8692 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4400505d-54ca-48d8-a116-425e670a403d} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 8596 1e99e1b9258 tab
3⤵
PID:2624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.23.1640247825\206104002" -childID 20 -isForBrowser -prefsHandle 8804 -prefMapHandle 8808 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69b75385-48d9-4f0d-8e12-48c6c3ba9a0c} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9192 1e99ec9e458 tab
3⤵
PID:5960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.22.1986464698\1124374206" -childID 19 -isForBrowser -prefsHandle 9024 -prefMapHandle 9020 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd059582-32f8-4e1c-bf3f-d57bbb77fa72} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9032 1e99eca0258 tab
3⤵
PID:5968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.26.1877194321\722214866" -childID 23 -isForBrowser -prefsHandle 8160 -prefMapHandle 8164 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {582f59d0-fdd4-4a36-b229-fd4b0b263720} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 8248 1e985b6b258 tab
3⤵
PID:544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.25.1240757376\1300988211" -childID 22 -isForBrowser -prefsHandle 8484 -prefMapHandle 8480 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b50b96d6-0b08-4ae9-b923-4466657f12df} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 8376 1e985b67858 tab
3⤵
PID:2716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.29.1495003476\526706706" -childID 26 -isForBrowser -prefsHandle 7664 -prefMapHandle 7668 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73f76d0d-e85b-47ea-969b-331173d714e2} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 7748 1e99c8dfd58 tab
3⤵
PID:6744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.28.1945578168\1831827292" -childID 25 -isForBrowser -prefsHandle 8500 -prefMapHandle 7944 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a418606-7386-46ed-b959-9ae3777a6148} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 9020 1e99c846a58 tab
3⤵
PID:6736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.27.1530024984\1025286283" -childID 24 -isForBrowser -prefsHandle 8196 -prefMapHandle 8200 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec1f396f-5f66-4878-8558-6d3e525ced53} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 8612 1e99c794e58 tab
3⤵
PID:6728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.30.289212515\546926252" -childID 27 -isForBrowser -prefsHandle 7332 -prefMapHandle 7340 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0af4a02f-4e59-47fe-b3c0-3a9a963bb2ec} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 7320 1e992dab158 tab
3⤵
PID:6924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.31.1644389344\1915561421" -childID 28 -isForBrowser -prefsHandle 3552 -prefMapHandle 3548 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63b97416-3ee7-4adf-aecf-27ee3c328635} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 3564 1e998ddaa58 tab
3⤵
PID:6304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.32.63663309\1457129906" -childID 29 -isForBrowser -prefsHandle 7080 -prefMapHandle 7076 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da8ca5fc-35d3-4a30-b129-2e5bc57c84d6} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 7088 1e99b40a158 tab
3⤵
PID:6708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.33.1571197145\340169339" -childID 30 -isForBrowser -prefsHandle 7412 -prefMapHandle 6824 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf0ccf3-2fb3-463d-9866-f8ee192aa39a} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6848 1e99cb0ca58 tab
3⤵
PID:7496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.35.1989748158\423538616" -childID 32 -isForBrowser -prefsHandle 6864 -prefMapHandle 6860 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eff7d865-8def-44a8-9837-43071e2662c6} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6884 1e99cde8558 tab
3⤵
PID:7512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.34.643733536\1311875433" -childID 31 -isForBrowser -prefsHandle 6840 -prefMapHandle 6832 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d250ecb3-53bb-43bc-a59c-267700889b21} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6984 1e99cc9ce58 tab
3⤵
PID:7504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.36.81775249\320563367" -childID 33 -isForBrowser -prefsHandle 6548 -prefMapHandle 6544 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0263df24-5916-486d-bd83-c375ce487ad3} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6556 1e99dca5b58 tab
3⤵
PID:7800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.37.639743585\1197747211" -childID 34 -isForBrowser -prefsHandle 7004 -prefMapHandle 9916 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9784aad9-536a-4bae-a4e2-e6e9b12d752d} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 7016 1e998bf3e58 tab
3⤵
PID:8112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.38.672742325\1450274995" -childID 35 -isForBrowser -prefsHandle 6708 -prefMapHandle 6284 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8305c115-e640-4f9b-a6d2-2e7c2f926e46} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11092 1e99617cd58 tab
3⤵
PID:6712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.39.267594877\1140707342" -childID 36 -isForBrowser -prefsHandle 7412 -prefMapHandle 8760 -prefsLen 30379 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1da57727-4a9a-460f-a49d-0ddf7ba39ad7} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6020 1e9a0818a58 tab
3⤵
PID:7252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.40.792161584\1836417345" -childID 37 -isForBrowser -prefsHandle 11372 -prefMapHandle 8800 -prefsLen 30379 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6abe9139-f4c1-4600-84b8-4d3979d4d6f3} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 10220 1e99ba0d358 tab
3⤵
PID:8156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.41.1310736179\1223303045" -childID 38 -isForBrowser -prefsHandle 4940 -prefMapHandle 11288 -prefsLen 30419 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa8573d1-3f75-4987-a4a3-814732d80e2b} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6780 1e99d0d8f58 tab
3⤵
PID:7572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.42.1886512035\1039580851" -childID 39 -isForBrowser -prefsHandle 11336 -prefMapHandle 6384 -prefsLen 30419 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1b936bd-f70b-4b26-b18f-2154adb25ea9} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 8424 1e996a68858 tab
3⤵
PID:7240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.43.1189577541\1324342580" -childID 40 -isForBrowser -prefsHandle 11356 -prefMapHandle 7368 -prefsLen 30419 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {652754ec-b9f4-40df-a54f-a51fcda03e20} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11084 1e9991f8858 tab
3⤵
PID:428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.44.225520206\761140271" -childID 41 -isForBrowser -prefsHandle 1656 -prefMapHandle 8224 -prefsLen 30428 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c0f763e-9659-4040-a5ee-9117363a64de} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 6628 1e99d81eb58 tab
3⤵
PID:3564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.45.1863854220\344688916" -childID 42 -isForBrowser -prefsHandle 11972 -prefMapHandle 11964 -prefsLen 30428 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {902cad49-e7e2-42d5-bc6e-bc655b949a89} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11984 1e99fac3858 tab
3⤵
PID:1560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.47.544826732\1779430249" -childID 44 -isForBrowser -prefsHandle 12360 -prefMapHandle 12364 -prefsLen 30428 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9128efb1-d3e3-4ee7-85ba-e25cc9056652} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12348 1e99faad358 tab
3⤵
PID:7764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.46.17570990\2096183286" -childID 43 -isForBrowser -prefsHandle 12136 -prefMapHandle 12244 -prefsLen 30428 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {632b1483-7e8d-4af4-af8c-cc63a82c9b94} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12216 1e99faae258 tab
3⤵
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.48.519193480\313831133" -childID 45 -isForBrowser -prefsHandle 9608 -prefMapHandle 12660 -prefsLen 30437 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf58cd4-d93c-4a08-bbeb-444ec2247d2f} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 11336 1e9a01a9658 tab
3⤵
PID:2332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.49.602341537\1113556821" -childID 46 -isForBrowser -prefsHandle 12264 -prefMapHandle 12252 -prefsLen 30437 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6cacc5e-a140-49ad-b701-8675bc32d285} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12332 1e9991c0558 tab
3⤵
PID:4888

C:\Users\Admin\Downloads\jdk-8u191-windows-i586.exe
"C:\Users\Admin\Downloads\jdk-8u191-windows-i586.exe"
3⤵
- Executes dropped EXE
PID:6964

C:\Users\Admin\AppData\Local\Temp\jds240800265.tmp\jdk-8u191-windows-i586.exe
"C:\Users\Admin\AppData\Local\Temp\jds240800265.tmp\jdk-8u191-windows-i586.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi" WRAPPER=1
5⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2668

C:\Program Files (x86)\Java\jdk1.8.0_191\jre.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\\jre.exe" LAUNCHEDFROMJDK=1 NOSTARTMENU=0
6⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.50.356795576\1426342721" -childID 47 -isForBrowser -prefsHandle 12232 -prefMapHandle 13080 -prefsLen 30446 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {423c5350-b19a-4ff5-8ff1-940661f0c1df} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 3348 1e996147658 tab
3⤵
PID:1424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.51.720716195\2087108200" -childID 48 -isForBrowser -prefsHandle 8728 -prefMapHandle 5312 -prefsLen 30455 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa21a0e8-972d-432b-b810-fdf40915b761} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 4716 1e998ed8758 tab
3⤵
PID:8308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.52.2124855327\1504788461" -childID 49 -isForBrowser -prefsHandle 9848 -prefMapHandle 12692 -prefsLen 30455 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dd2ec62-dede-4475-8ca5-bddae4d77a86} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12104 1e99e07c258 tab
3⤵
PID:8212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.53.432944399\1288811318" -childID 50 -isForBrowser -prefsHandle 12280 -prefMapHandle 12384 -prefsLen 30520 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4a406a6-ed59-4121-b101-9e3e0c0dc307} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 5940 1e995837258 tab
3⤵
PID:5032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.54.66087075\1212886875" -childID 51 -isForBrowser -prefsHandle 12420 -prefMapHandle 11960 -prefsLen 30529 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8acac4c-9dd2-4244-9d41-0bbaa26a19cf} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 10616 1e99c7be458 tab
3⤵
PID:7052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.55.1878570764\1291848560" -childID 52 -isForBrowser -prefsHandle 8668 -prefMapHandle 12488 -prefsLen 30538 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {722d8a5c-7bed-4086-ae22-f5a3b1aa6ab2} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12492 1e9a5ca2d58 tab
3⤵
PID:1244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.56.750719620\140917386" -childID 53 -isForBrowser -prefsHandle 12508 -prefMapHandle 12776 -prefsLen 30842 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8fb1fbc-5a8f-4ea3-8e86-e27de794ed86} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 12112 1e9a7b56e58 tab
3⤵
PID:1884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3944.57.1741061072\1694726270" -childID 54 -isForBrowser -prefsHandle 11320 -prefMapHandle 13196 -prefsLen 30842 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d65c001-0896-4dd7-bea9-79476f2d9357} 3944 "\\.\pipe\gecko-crash-server-pipe.3944" 13136 1e9958f8458 tab
3⤵
PID:4540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 918F4DF132109FF5552DF7AA0C22D12B C
2⤵
- Loads dropped DLL
PID:6296

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:8016

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ECB39FB481E9BD0A914268AF3215D111
2⤵
- Loads dropped DLL
PID:6332

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 70E4B328CFA0D0D2829AF99ADF55784F E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
PID:7320

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4460

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6916

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.jar"
3⤵
PID:448

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6344

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.jar"
3⤵
PID:4220

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712

C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6452

C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\javaw.exe
"C:\Program Files (x86)\Java\jdk1.8.0_191\\jre\bin\javaw.exe" -Xshare:dump
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4908

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AC9C75B68ADBB3D98B46EC81E4052DA1
2⤵
- Loads dropped DLL
PID:2836

C:\Program Files (x86)\Java\jre1.8.0_191\installer.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_191\\" NOSTARTMENU=0 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F32180191F0}
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:448

C:\ProgramData\Oracle\Java\installcache\240909609.tmp\bspatch.exe
"bspatch.exe" baseimagefam8 newimage diff
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4220

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/plugin.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/plugin.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/javaws.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/javaws.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7052

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/deploy.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/deploy.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7148

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/rt.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/rt.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7312

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/jsse.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/jsse.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7964

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/charsets.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/charsets.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4184

C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/ext/localedata.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4916

C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4832

C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssvagent.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssvagent.exe" -doHKCUSSVSetup
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:8604

C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe" -wait -fix -permissions -silent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:8768

C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_191" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8xOTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8788

C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe" -wait -fix -shortcut -silent
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3948

C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe
"C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_191" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8xOTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FDDC143278A7C891E3E6F7B739AE32E6 E Global\MSI0000
2⤵
PID:6556

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2C546DDD34413552F5DD7C20C6BB5B62
2⤵
PID:3180

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D311755D6FAB78AB21CADD0171D12468 E Global\MSI0000
2⤵
PID:8048

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 929995996703306EC66BBB6824B17E77
2⤵
PID:8500

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8226A164CEB83950AEAC92AA76878C81 E Global\MSI0000
2⤵
PID:9052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4484

C:\Users\Admin\Downloads\thkkkhk422\error422(1).exe
"C:\Users\Admin\Downloads\thkkkhk422\error422(1).exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:7272

\??\c:\PROGRA~2\java\JRE18~1.0_1\bin\java.exe
c:\PROGRA~2\java\JRE18~1.0_1\bin\java.exe -version
2⤵
- Executes dropped EXE
PID:7308

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:7660

C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j4305695492064900594.tmp
2⤵
- Executes dropped EXE
PID:4908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery