Resubmissions
09/05/2024, 18:25
240509-w2nsmsbc561009/05/2024, 08:53
240509-ks9szahf2w1009/05/2024, 08:52
240509-ks3pnace25108/05/2024, 09:27
240508-le3m6sdf7t1007/05/2024, 10:53
240507-my8tzach4v505/05/2024, 15:20
240505-sqqlbadg5s504/05/2024, 12:20
240504-phv92sgf241004/05/2024, 12:17
240504-pf52gage491003/05/2024, 11:11
240503-naq5pafb291030/04/2024, 17:26
240430-v1anysbf4y7Analysis
- max time kernel
1235s - max time network
1238s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/05/2024, 18:25
General
- Target https://github.com
- Sample240509-w2nsmsbc56
Score
10/10
Malware Config
Extracted
Family
-
vidar
Version
-
9.2
Botnet
-
90055089a554b801602b3ac265dc570c
C2
-
https://steamcommunity.com/profiles/76561199677575543
-
https://t.me/snsb82
Attributes
-
profile_id_v2
90055089a554b801602b3ac265dc570c
-
user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Signatures
- DcRat 64 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Vidar Stealer 3 IoCs
- Detect ZGRat V1 1 IoCs
- Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- ZGRat
ZGRat is remote access trojan written in C#.
- DCRat payload 3 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Nirsoft 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 62 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 46 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 16 IoCs
- Drops file in Windows directory 32 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Control Panel 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 61 IoCs
- NTFS ADS 2 IoCs
- Runs regedit.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 9 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com1⤵
- DcRat
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5e046f8,0x7ff9e5e04708,0x7ff9e5e047182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5784 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5592 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6696 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8776 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7748655058580427175,17252954933554345630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap12429:72:7zEvent183551⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap2366:68:7zEvent82171⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\setup.exe"C:\Users\Admin\Desktop\setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\katB08E.tmpC:\Users\Admin\AppData\Local\Temp\katB08E.tmp2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 16803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3996 -ip 39961⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\DCRAT-Crack-main\" -an -ai#7zMap22980:102:7zEvent17681⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.exe"C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIIIllIllIlIIIlIIIIIIlIIIIIIIlllIlllIIIIllIIlIIIllIIlIllllIllIIlllllIlIIllIIIIIIIIIllIlIIIIIllIllIllIIlllIlIIlIllllIIII.jar;lib\IIlIIIlIlIIIIIllllIlIllIlIIIllIlllIllIIIIlllIllIlIllllIIlIlIIIllIIlIlIIllllIlIlIlIIlIlllIlIlIIIlIIIIIIllllllllIlIllIIIIl.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DCRAT-Crack-main\Bypass_license.bat" "1⤵
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\dcrat_updservice.exedcrat_updservice.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\QICY7Iox.vbe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\webintoruntimesvc\RfOoYslo.bat" "4⤵
-
C:\webintoruntimesvc\Serverfontsaves.exe"C:\webintoruntimesvc\Serverfontsaves.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\Serverfontsaves.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\sppsvc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\taskhostw.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wscript.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\OfficeClickToRun.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\dllhost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\wscript.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dllhost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\dllhost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\DCRat.sfx.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winlogon.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2WOvmLpKwy.bat"6⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Users\Public\AccountPictures\dllhost.exe"C:\Users\Public\AccountPictures\dllhost.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\file.vbs"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DCRAT-Crack-main\updatelauncher.bat" "1⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 3 /NOBREAK2⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\dcrat_updservice.exe"C:\Users\Admin\Desktop\DCRAT-Crack-main\/dcrat_updservice.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\QICY7Iox.vbe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\webintoruntimesvc\RfOoYslo.bat" "4⤵
-
C:\webintoruntimesvc\Serverfontsaves.exe"C:\webintoruntimesvc\Serverfontsaves.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\Serverfontsaves.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\SppExtComObj.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\winlogon.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\en-US\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\LocalService\winlogon.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\sihost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\SppExtComObj.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cydCZMhLGR.bat"6⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Program Files\Windows Multimedia Platform\msedge.exe"C:\Program Files\Windows Multimedia Platform\msedge.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\file.vbs"3⤵
-
-
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.sfx.exe"C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.sfx.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.sfx.exe"C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.sfx.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\webintoruntimesvc\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\webintoruntimesvc\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\webintoruntimesvc\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\wscript.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Users\Default User\wscript.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\wscript.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\webintoruntimesvc\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\webintoruntimesvc\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\wscript.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\webintoruntimesvc\wscript.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\webintoruntimesvc\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\webintoruntimesvc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\webintoruntimesvc\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\msedge.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Package Cache\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DCRat.sfxD" /sc MINUTE /mo 11 /tr "'C:\webintoruntimesvc\DCRat.sfx.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DCRat.sfx" /sc ONLOGON /tr "'C:\webintoruntimesvc\DCRat.sfx.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DCRat.sfxD" /sc MINUTE /mo 11 /tr "'C:\webintoruntimesvc\DCRat.sfx.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\95f6663c671e4de7bc806152251dd931 /t 1812 /p 49521⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\SppExtComObj.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Cookies\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\webintoruntimesvc\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\webintoruntimesvc\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\webintoruntimesvc\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\msedge.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\DESIGNER\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\DESIGNER\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\LocalService\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\LocalService\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\uk-UA\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\webintoruntimesvc\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\webintoruntimesvc\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\webintoruntimesvc\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe'" /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\DCRAT-Crack-main\" -an -ai#7zMap27349:102:7zEvent34671⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.exe"C:\Users\Admin\Desktop\DCRAT-Crack-main\DCRat.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIIIllIllIlIIIlIIIIIIlIIIIIIIlllIlllIIIIllIIlIIIllIIlIllllIllIIlllllIlIIllIIIIIIIIIllIlIIIIIllIllIllIIlllIlIIlIllllIIII.jar;lib\IIlIIIlIlIIIIIllllIlIllIlIIIllIlllIllIIIIlllIllIlIllllIIlIlIIIllIIlIlIIllllIlIlIlIIlIlllIlIlIIIlIIIIIIllllllllIlIllIIIIl.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\004e1b5c7c5c43ea874cc06db31926c0 /t 2024 /p 48441⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap11819:68:7zEvent1501⤵
-
C:\Users\Admin\Desktop\dcrat_updservice.exe"C:\Users\Admin\Desktop\dcrat_updservice.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\QICY7Iox.vbe"2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\webintoruntimesvc\RfOoYslo.bat" "3⤵
-
C:\webintoruntimesvc\Serverfontsaves.exe"C:\webintoruntimesvc\Serverfontsaves.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\Serverfontsaves.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\webintoruntimesvc\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\Sorting\Serverfontsaves.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\757197a3-0a25-4982-bd24-4a26bb7bdd71.vbs"6⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fcf8f80-bf11-4669-86aa-43d58040c522.vbs"8⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8eb4d788-0236-49c5-8c8e-f5dc7aadf7a0.vbs"10⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\960569fb-4169-4086-9e70-715ecf617cf8.vbs"12⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\901b7450-25fe-4b93-8a49-cbe38a434bf5.vbs"14⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a341123-fbac-4f03-8c83-a64fb939bf8a.vbs"16⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47768a9a-14ce-4659-8ea0-fe6fa5755922.vbs"18⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fbce369-269c-4a9d-a49e-806730b705b7.vbs"20⤵
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"21⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1cc575a-43a6-47aa-9dc6-d083091e03af.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\503c8640-738f-4815-969d-17554abceb87.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1650be2-c88c-4dcc-b786-a33a36d6ebaf.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b001bdec-7b0e-4759-bf81-93001285d110.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3dc5b423-1547-45ad-9ff1-b5d66cbf9bbe.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a1abd79-4f5a-4101-b6a6-8d8c5c3a448b.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4d1fc08-dbae-400c-bf68-71cd15276edf.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efa53c6d-a528-4aca-9952-dc81b1d16e1e.vbs"6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\webintoruntimesvc\file.vbs"2⤵
-
-
C:\Users\Admin\Desktop\DCRat.exe"C:\Users\Admin\Desktop\DCRat.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIIIllIllIlIIIlIIIIIIlIIIIIIIlllIlllIIIIllIIlIIIllIIlIllllIllIIlllllIlIIllIIIIIIIIIllIlIIIIIllIllIllIIlllIlIIlIllllIIII.jar;lib\IIlIIIlIlIIIIIllllIlIllIlIIIllIlllIllIIIIlllIllIlIllllIIlIlIIIllIIlIlIIllllIlIlIlIIlIlllIlIlIIIlIIIIIIllllllllIlIllIIIIl.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
-
-
C:\Users\Admin\Desktop\DCRat.exe"C:\Users\Admin\Desktop\DCRat.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIIIllIllIlIIIlIIIIIIlIIIIIIIlllIlllIIIIllIIlIIIllIIlIllllIllIIlllllIlIIllIIIIIIIIIllIlIIIIIllIllIllIIlllIlIIlIllllIIII.jar;lib\IIlIIIlIlIIIIIllllIlIllIlIIIllIlllIllIIIIlllIllIlIllllIIlIlIIIllIIlIlIIllllIlIlIlIIlIlllIlIlIIIlIIIIIIllllllllIlIllIIIIl.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\webintoruntimesvc\Idle.exe'" /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\webintoruntimesvc\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\webintoruntimesvc\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ServerfontsavesS" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\Sorting\Serverfontsaves.exe'" /f1⤵
- DcRat
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Serverfontsaves" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\Serverfontsaves.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ServerfontsavesS" /sc MINUTE /mo 12 /tr "'C:\Windows\Globalization\Sorting\Serverfontsaves.exe'" /rl HIGHEST /f1⤵
- DcRat
- Creates scheduled task(s)
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\sppsvc.exeC:\webintoruntimesvc\sppsvc.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\taskhostw.exeC:\webintoruntimesvc\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\OfficeClickToRun.exeC:\webintoruntimesvc\OfficeClickToRun.exe1⤵
- Executes dropped EXE
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d0d25aa-9dc8-4d67-b78c-360965ddbb04.vbs"2⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44a174e5-dbc5-4caf-97a7-ccee38b462bd.vbs"4⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0952c0c9-fc9e-4a1a-8e52-bec86f6f9f50.vbs"6⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cde391ee-7150-4f3e-a6e9-7ae3a83f202a.vbs"8⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcd64038-f0b8-4c01-86a3-61a5ed08cde5.vbs"10⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e3a0055-a7c3-457b-bf75-a9d0331415d6.vbs"12⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94bb254b-d834-49f8-ac6b-88af5b3957bc.vbs"14⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7532cc4-a59e-4adf-a51d-a845f2520617.vbs"16⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\411a4ac2-e21c-4bb9-897e-38896dd294c8.vbs"18⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb810c19-0dc3-4ea1-8f40-6980697451cc.vbs"20⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e4394e8-a391-4be0-b209-e8f55cca56b7.vbs"22⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f703802f-01b5-437d-a8b1-d7bb7e0e9a33.vbs"24⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c424fc54-9abe-4e05-81cf-d0cf4f1cc0d2.vbs"26⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5aa4f30d-c8ac-4a65-bddf-ddc94859e9b8.vbs"28⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dab304e8-29e4-4578-86b5-11354ef98c18.vbs"30⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c68a420-e154-4c2b-8bb9-db3d17f8c534.vbs"32⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f33dfa68-0bd0-4fa4-ad55-362971a51e07.vbs"34⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d836392-3c0a-45d0-b104-b423a8660d56.vbs"36⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94516e43-eff0-4e10-8e06-e114c16988aa.vbs"38⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9526f69-9217-41dd-a6d0-a0fe08ceaa41.vbs"40⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79643c5e-e4e5-4f7c-ac02-5127e08e6394.vbs"42⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1665fde8-31e1-4c06-8509-97097671295e.vbs"44⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e76683b5-5cde-4f45-a1df-a9e619911db1.vbs"46⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1369c1dd-98c2-42c8-99c4-85fd3dbff844.vbs"48⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe49⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13e505c3-48d1-4c6d-8051-d67b0436c6bc.vbs"48⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8c3eb01-f836-4742-8f56-22b21f15f384.vbs"46⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8839e269-8444-4bd2-9582-0e37da87ab90.vbs"44⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d506285b-6277-4a0d-8362-ed80913e13ce.vbs"42⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb7b2741-0d08-4f6f-a983-348b49c7eefe.vbs"40⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95913ad9-f3b0-43d7-a422-5539fb789a14.vbs"38⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8bc5173-fd0a-47d5-8981-ef2c43f58b09.vbs"36⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f54ec7e-351c-40e6-a155-e8567732294c.vbs"34⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e4ce053-3901-4723-b12b-428af6c425c2.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e735bfc-cccf-44c9-b1cd-58cc286eade4.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71877e3d-01b6-4994-916a-e99fa635c56e.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80e6c085-5aa7-4518-865c-240bf4998fbe.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47efabba-62dc-45e8-8df4-67c14affd3c0.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42aa34e0-f1ea-4c60-9854-88bf2047720a.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c85c122-0634-4b38-ad42-310a4950a6e7.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e436cca5-8228-404f-a724-ff27d79ea72d.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9b42eeb-21e9-4d40-9910-2cbba90d6135.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9197ff0e-f1f7-4b6f-bc22-9b1ad5bf4276.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d3c0f9c-440f-4bcf-8624-4e8c3b0b618f.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bbe7cfe-f64d-4a93-9995-4b49b14880ee.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04ca5416-b942-482b-8dbd-a4c224c9c8c0.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee77c6b0-1a3e-4aa2-b2c6-8fc9e66040c6.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ace84537-8408-4d3e-9c9f-4962d404cf09.vbs"4⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a70c6fd8-1b8d-464e-b72b-d700a68db63e.vbs"2⤵
-
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9e5a7ab58,0x7ff9e5a7ab68,0x7ff9e5a7ab782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1396 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3988 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4324 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4776 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3376 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3404 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5240 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5436 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5596 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5748 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5824 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5252 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5268 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5016 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5416 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6020 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5624 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3044 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\SC INSTALLER.exe"C:\Users\Admin\Downloads\SC INSTALLER.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies Control Panel
-
C:\Users\Admin\Downloads\SC INSTALLER.exe"C:\Users\Admin\Downloads\SC INSTALLER.exe" /i "C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\install\51B5780\SandeLLoCHECKER_Installer.msi" AI_EUIMSI=1 APPDIR="C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER" SHORTCUTDIR="C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER" SECONDSEQUENCE="1" CLIENTPROCESSID="1684" CHAINERUIPROCESSID="1684Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_DETECTED_DOTNET_VERSION="4.8" AI_DETECTED_PHYSICAL_MEMORY="8192" AI_SETUPEXEPATH="C:\Users\Admin\Downloads\SC INSTALLER.exe" SETUPEXEDIR="C:\Users\Admin\Downloads\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1715038523 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\Downloads\SC INSTALLER.exe" TARGETDIR="F:\" AI_INSTALL="1"3⤵
- Executes dropped EXE
- Enumerates connected drives
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4936 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1876,i,16531257054205429128,15879423768598939195,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x4981⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\sppsvc.exeC:\webintoruntimesvc\sppsvc.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\taskhostw.exeC:\webintoruntimesvc\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\webintoruntimesvc\OfficeClickToRun.exeC:\webintoruntimesvc\OfficeClickToRun.exe1⤵
- Executes dropped EXE
-
C:\Windows\uk-UA\sihost.exeC:\Windows\uk-UA\sihost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0406E92DB4242FBA4BFE984567527C08 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D99A6F106FE0254C3F5B281B8888EA0C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c7aa960-d47e-4b63-b01b-b01bec4030ba.vbs"2⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf33258d-ff9c-4d9b-84ab-9db9641cb8cf.vbs"2⤵
-
-
C:\webintoruntimesvc\DCRat.sfx.exeC:\webintoruntimesvc\DCRat.sfx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"1⤵
- Loads dropped DLL
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SelfUpdate\AppUpdater.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SelfUpdate\AppUpdater.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SelfUpdate\AppUpdater.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SelfUpdate\AppUpdater.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\SandeLLo CHECKER.exe"1⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Extras\reg2.bat" "1⤵
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Extras\regjump.exeregjump HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView2⤵
-
C:\Windows\Regedit.exeC:\Windows\Regedit.exe3⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe1⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\735b7d05-1a6b-45e0-90b3-4035e8ff66ee.vbs"2⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe3⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dcb83b8-1ba4-4b38-b4a7-a0a942d02f39.vbs"4⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe5⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e051a56a-b198-4828-be51-92989f27de13.vbs"6⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe7⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ed25d5e-d892-43f8-b831-8d83eb38b645.vbs"8⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe9⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb97fb61-11e7-49c1-a02a-60a192a6d638.vbs"10⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe11⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bb837b6-b402-4b9d-98b7-9407e19be2cf.vbs"12⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe13⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5349368-d6e6-4a29-bc86-ac6c047e6884.vbs"14⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe15⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80a59cbf-0f46-43b2-9c58-145cef474a1a.vbs"16⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe17⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ea5fc3c-9815-43bc-b86e-c2e6df773aad.vbs"18⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe19⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f325c84a-abbc-4ac9-8796-9e4cd99f8c8b.vbs"20⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe21⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b72c49d4-4e94-4a63-8f2c-7182a242a06a.vbs"22⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe23⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\183676cc-f22b-43a4-98c6-e38dae5da48c.vbs"24⤵
-
C:\Recovery\WindowsRE\TextInputHost.exeC:\Recovery\WindowsRE\TextInputHost.exe25⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db7acba9-75dc-485f-a3db-374d1d9470ac.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\043a1a7a-e6f0-430d-8415-e3f7ef13fd30.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a701609-b507-45a0-a67c-099fc660df81.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b110f998-eee4-44e9-97d5-99141f974b0f.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a15a0510-2811-4bb5-bced-03880175f06e.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24af5bd3-79fb-4354-86a7-99636c189a2c.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abb5be50-7bab-4d1c-be5d-accca381fddc.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7657456f-45af-4503-814c-e277d25de3fa.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1725f00d-068f-4fbc-b9d8-752b8b0e0043.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e2db9f8-3a18-43af-a0de-b1494363c35c.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ca27bdb-83eb-4940-9a7d-dacc2d05af44.vbs"4⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd4ff4d8-30e3-483f-9649-cfcd1f013752.vbs"2⤵
-
-
C:\webintoruntimesvc\Idle.exeC:\webintoruntimesvc\Idle.exe1⤵
-
C:\Windows\ServiceProfiles\LocalService\winlogon.exeC:\Windows\ServiceProfiles\LocalService\winlogon.exe1⤵
-
C:\webintoruntimesvc\dllhost.exeC:\webintoruntimesvc\dllhost.exe1⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe"C:\Program Files (x86)\Mozilla Maintenance Service\msedge.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\BrowserDownloadsView.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\BrowserDownloadsView.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\shellbag.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\shellbag.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\BrowserDownloadsView.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\BrowserDownloadsView.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\DevManView.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\DevManView.exe"1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\ExecutedProgramsList.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\ExecutedProgramsList.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\MUICacheView.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\MUICacheView.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\JumpListsView.exe"C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\Apps\JumpListsView.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe1⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42dd8d69-720e-4c44-868f-2112c101a287.vbs"2⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe3⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02ae6937-68c8-4541-9617-bc63eb52cf9f.vbs"4⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe5⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05071726-0b5c-4b83-92cb-bde9c22de939.vbs"6⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe7⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9febf5ad-83e2-455c-a753-c0cc83669dcd.vbs"8⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe9⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5438a647-ff8c-49e7-8f38-b09c670f3bf0.vbs"10⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe11⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44f8ff61-a0cc-41cc-976e-478c598f2e0c.vbs"12⤵
-
C:\webintoruntimesvc\wscript.exeC:\webintoruntimesvc\wscript.exe13⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1c15061-9b11-4867-a786-afc158c8781b.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5a36238-437d-43cc-9fc0-889e83ec0a2a.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f006aed-0e44-4b7d-8556-b9abe43aae72.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17569032-5a70-4aec-b021-e3bdfa739aed.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2f6dafa-5984-4634-b4eb-1a4a3be1f1ad.vbs"4⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5169cb10-1e8b-4f58-82f1-97ad8b7040fa.vbs"2⤵
-
-
C:\webintoruntimesvc\sppsvc.exeC:\webintoruntimesvc\sppsvc.exe1⤵
-
C:\webintoruntimesvc\taskhostw.exeC:\webintoruntimesvc\taskhostw.exe1⤵
-
C:\webintoruntimesvc\OfficeClickToRun.exeC:\webintoruntimesvc\OfficeClickToRun.exe1⤵
-
C:\Windows\Globalization\Sorting\Serverfontsaves.exeC:\Windows\Globalization\Sorting\Serverfontsaves.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0x11c,0x128,0x7ff9e5e046f8,0x7ff9e5e04708,0x7ff9e5e047182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5872 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13083777063469456932,12642585048910207518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 /prefetch:22⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe1⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a359495d-a8cd-4202-8b26-9dc43afcbc6d.vbs"2⤵
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe3⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\295b35d5-4cb1-494f-9bfe-53b87d6429f4.vbs"2⤵
-
-
C:\Users\Default User\SppExtComObj.exe"C:\Users\Default User\SppExtComObj.exe"1⤵
-
C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"C:\Users\Admin\Downloads\GPU-Z.2.59.0.exe"1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-L12O9.tmp\gpuz_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-L12O9.tmp\gpuz_installer.tmp" /SL5="$110562,832512,832512,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GPU-Z\GPU-Z.exe"C:\Program Files (x86)\GPU-Z\GPU-Z.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
e638a55.rbs
3903daac9bc4a3b7.timestamp
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
f_000006
f_00000a
f_00000b
f_00000d
f_00000e
f_000018
f_00001a
the-real-index
the-real-index
the-real-index
MANIFEST-000001
MANIFEST-000001
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe632706.TMP
the-real-index
the-real-index
the-real-index~RFe62a591.TMP
index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe625231.TMP
the-real-index
the-real-index
the-real-index~RFe62a0fd.TMP
512.png
512.png
16.png
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache~RFe636a97.TMP
data_1
powershell.exe.log
taskhostw.exe.log
settings.dat
settings.dat
settings.dat
settings.dat
4559f770-f1dc-481e-b89e-2c66dcef545c.tmp
f_000003
f_000004
f_000005
f_000006
f_000007
f_00000a
f_00000b
f_00000f
f_000010
f_00003c
f_000040
f_000042
f_000048
f_000049
f_00004c
0a76502c15b2cf7d_0
111af0fced70a6fa_0
14822a70f5acfd01_0
168396ca4d2cb76b_0
1e1331237e75dbdd_0
2249e8f6abb97632_0
22d5e812a7f1054a_0
252fc33d5c34f8fa_0
286a1787eb6b73cf_0
28ccdce40c1c0a9a_0
29ee49a9e002c15f_0
2d25ed7742ac7c93_0
34fe86bcf42f4dd8_0
398dc4c46c55b261_0
40767c6ffa0c49cf_0
49b9379fac5112c5_0
5684b7c93d81468d_0
59fe92d1a831a761_0
5b7b840cbf940c6f_0
605c86883fe214f1_0
65c587b533bfba81_0
6cc2f548fe222056_0
6ea01d9ed7e88907_0
70f32ab89c3a4ab5_0
751174a858a247d3_0
78f2114b40a9af81_0
7ac4df3442f556d8_0
7ccae3f573b0063a_0
84ef792e97c5476a_0
88adf831e25e51cd_0
8b09cd648ed7a0a9_0
8e17a5992f93488f_0
8fecedb75e84be59_0
9441bb93ec653ba3_0
9a3f70e6d9d70dfa_0
9e96d197dd7526c4_0
a6a0cf33e9d1018c_0
ab379c46566bf95c_0
adf69b8fd35e8021_0
b8f8519938cd280a_0
ba4f0a370739432c_0
bb9d3617b204eedb_0
bd8f6d4dc79c48fd_0
bdab77cef9a22778_0
c287b5daf63a00b8_0
c70c9d08cbd88953_0
c9822c34ba20db86_0
cc48d455a0beb0bb_0
d00659af99907d53_0
d27b19b7853adc8e_0
d6f96a3c94a636bc_0
d7321bd58ec6538a_0
dac519eebb4a7a0f_0
dc1e60b23dabc270_0
df7ed9f9dfe0bbe9_0
e11b2a4b6e19a0af_0
e210e36f2206f9cf_0
eb90d765ca9a8ba9_0
f535f9453fd2381a_0
f5ccb442c8b8f9e9_0
f61188ee2a0a7e42_0
f66233e72c393c10_0
f87781a453f03c47_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe57aa1b.TMP
CURRENT
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
2WOvmLpKwy.bat
8ca27bdb-83eb-4940-9a7d-dacc2d05af44.vbs
aboutbtn.xaml
buttonimgs.xaml
GPU-Z-v2.sys
MSI4A61.tmp
__PSScriptPolicyTest_0qdwiqj2.fsx.ps1
ace84537-8408-4d3e-9c9f-4962d404cf09.vbs
b2f6dafa-5984-4634-b4eb-1a4a3be1f1ad.vbs
b4d1fc08-dbae-400c-bf68-71cd15276edf.vbs
katB08E.tmp
shi570F.tmp
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
BrowserDownloadsView.cfg
BrowserDownloadsView.cfg
DevManView.cfg
DevManView.cfg
ExecutedProgramsList.cfg
SandeLLoCHECKER_Installer.msi
Bypass_license.bat
DCRat.exe
dcrat_updservice.exe
IIIIIllIllIlIIIlIIIIIIlIIIIIIIlllIlllIIIIllIIlIIIllIIlIllllIllIIlllllIlIIllIIIIIIIIIllIlIIIIIllIllIllIIlllIlIIlIllllIIII.jar
IIlIIIlIlIIIIIllllIlIllIlIIIllIlllIllIIIIlllIllIlIllllIIlIlIIIllIIlIlIIllllIlIlIlIIlIlllIlIlIIIlIIIIIIllllllllIlIllIIIIl.jar
fav.png
fav.png
updatelauncher.bat
Notify.wav
back.o
7zxa.dll
NCC2.dll
NCC3.dll
NCCheck.dll
Rar.exe
RarExt.dll
RarExt64.dll
WinCon.SFX
Zip.SFX
dnlib.dll
dotNET_Reactor.Console.exe
dotNET_Reactor.exe
enc.vbe
upx.exe
wRar.exe
DeleteAll_legacy.json
PluginsLoader_legacy.json
eula
f00263888b3a2bbd9e5834bb59d27e24c093692316706b91d827fcd4ab93ce39
Audio_native.plg
Audio_native.dclib
configuration.json
BrowsersStealer_native.plg
BrowsersStealer_native.dclib
configuration.json
ClientsStealer_native.plg
ClientsStealer_native.dclib
configuration.json
Fun_native.plg
Fun_native.dclib
configuration.json
HiddenRemoteDesktop_native.plg
HiddenRemoteDesktop_native.dclib
configuration.json
Keylogger_native.plg
ConfigKeylogger_native.json
Keylogger_native.dclib
configuration.json
RemoteCMD_native.plg
RemoteCMD_native.dclib
configuration.json
SystemInformation_native.plg
SystemInformation_native.dclib
configuration.json
TestDCLIB.plg
configuration.json
file.dclib
TestDefault.plg
configuration.json
WebcamViewer_native.plg
WebcamViewer_native.dclib
configuration.json
chat_native.plg
chat_native.dclib
configuration.json
setup.exe
setup.rar
Release.zip
SC INSTALLER.exe
Unconfirmed 590661.crdownload
Unconfirmed 60042.crdownload
MSI8BED.tmp
MSI90E6.tmp
MSI9155.tmp
MSI9487.tmp
QICY7Iox.vbe
RfOoYslo.bat
Serverfontsaves.exe
file.vbs
memory/212-2266-0x0000026705420000-0x0000026705421000-memory.dmp
memory/640-2792-0x0000000001290000-0x00000000012A2000-memory.dmp
memory/704-4884-0x000000001B060000-0x000000001B072000-memory.dmp
memory/752-2255-0x0000000000400000-0x000000000041F000-memory.dmp
memory/980-5375-0x0000000000D80000-0x0000000003A61000-memory.dmp
memory/980-5423-0x0000000000D80000-0x0000000003A61000-memory.dmp
memory/1812-2660-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1980-2670-0x0000020DE1940000-0x0000020DE1941000-memory.dmp
memory/2364-4999-0x0000000002AD0000-0x0000000002B26000-memory.dmp
memory/2412-4846-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2820-4830-0x000000001C000000-0x000000001C012000-memory.dmp
memory/3080-2755-0x0000000002E80000-0x0000000002E92000-memory.dmp
memory/3176-181-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-184-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-183-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-180-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-182-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-173-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-175-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-174-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-179-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3176-185-0x00000199CE480000-0x00000199CE481000-memory.dmp
memory/3416-1445-0x00000000017D0000-0x00000000017DE000-memory.dmp
memory/3416-1446-0x000000001BB10000-0x000000001BB2C000-memory.dmp
memory/3416-1448-0x000000001BB30000-0x000000001BB46000-memory.dmp
memory/3416-1449-0x000000001C280000-0x000000001C2D6000-memory.dmp
memory/3416-1450-0x00000000017E0000-0x00000000017EC000-memory.dmp
memory/3416-1454-0x000000001C340000-0x000000001C396000-memory.dmp
memory/3416-1451-0x000000001BB50000-0x000000001BB62000-memory.dmp
memory/3416-1455-0x000000001C390000-0x000000001C39A000-memory.dmp
memory/3416-1460-0x000000001C3E0000-0x000000001C3E8000-memory.dmp
memory/3416-1452-0x000000001C870000-0x000000001CD98000-memory.dmp
memory/3416-1457-0x000000001C3B0000-0x000000001C3BE000-memory.dmp
memory/3416-1447-0x000000001C2D0000-0x000000001C320000-memory.dmp
memory/3416-1461-0x000000001C3F0000-0x000000001C3FC000-memory.dmp
memory/3416-1444-0x0000000000C40000-0x0000000000FEA000-memory.dmp
memory/3416-1458-0x000000001C3C0000-0x000000001C3C8000-memory.dmp
memory/3416-1459-0x000000001C3D0000-0x000000001C3DC000-memory.dmp
memory/3416-1456-0x000000001C3A0000-0x000000001C3AE000-memory.dmp
memory/3416-1453-0x000000001BB60000-0x000000001BB6C000-memory.dmp
memory/3480-5419-0x0000000000D80000-0x0000000003A61000-memory.dmp
memory/3480-5373-0x0000000000D80000-0x0000000003A61000-memory.dmp
memory/3660-2648-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3752-4959-0x0000000003210000-0x0000000003222000-memory.dmp
memory/3864-1397-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3996-656-0x0000000000400000-0x000000000064A000-memory.dmp
memory/3996-659-0x0000000000400000-0x000000000064A000-memory.dmp
memory/3996-662-0x0000000000400000-0x000000000064A000-memory.dmp
memory/4176-1491-0x0000022D22A00000-0x0000022D22A22000-memory.dmp
memory/4188-4792-0x0000000002600000-0x0000000002612000-memory.dmp
memory/4224-534-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-535-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-528-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-526-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-536-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-538-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-537-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-533-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4224-527-0x0000014B1E1A0000-0x0000014B1E1A1000-memory.dmp
memory/4228-2747-0x000000001BBF0000-0x000000001BC46000-memory.dmp
memory/4280-4958-0x0000000000400000-0x0000000000415000-memory.dmp
memory/4280-4975-0x0000000000400000-0x0000000000415000-memory.dmp
memory/4280-660-0x0000000000400000-0x00000000005D7000-memory.dmp
memory/4540-4984-0x0000000002620000-0x0000000002676000-memory.dmp
memory/4556-966-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-970-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-973-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-974-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-975-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-971-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-967-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-972-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4556-965-0x0000024B93D20000-0x0000024B93D21000-memory.dmp
memory/4928-4938-0x0000000000D60000-0x0000000000D72000-memory.dmp
memory/4992-1420-0x0000013A37F70000-0x0000013A37F71000-memory.dmp
memory/5328-5079-0x0000000003300000-0x0000000003312000-memory.dmp
memory/5672-2734-0x000000001B1C0000-0x000000001B1D2000-memory.dmp
memory/5876-4838-0x000000001BE90000-0x000000001BEA2000-memory.dmp
memory/5900-4781-0x00000000048B0000-0x000000000492A000-memory.dmp
memory/5900-4780-0x0000000000050000-0x0000000000058000-memory.dmp
memory/5988-2905-0x000000001C5F0000-0x000000001C602000-memory.dmp
memory/6104-1637-0x0000000001010000-0x0000000001022000-memory.dmp
memory/6116-1787-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1789-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1791-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1792-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1793-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1794-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1785-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1786-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6116-1790-0x000001CEC3150000-0x000001CEC3151000-memory.dmp
memory/6288-2826-0x000000001C3F0000-0x000000001C402000-memory.dmp
memory/6304-4506-0x0000000008F70000-0x0000000008FA8000-memory.dmp
memory/6304-4501-0x0000000006150000-0x000000000619A000-memory.dmp
memory/6304-4502-0x000000000C670000-0x000000000D2EE000-memory.dmp
memory/6304-4503-0x0000000008C10000-0x0000000008C2C000-memory.dmp
memory/6304-4504-0x0000000008CD0000-0x0000000008D62000-memory.dmp
memory/6304-4505-0x0000000008C00000-0x0000000008C08000-memory.dmp
memory/6304-4500-0x0000000006880000-0x0000000006E24000-memory.dmp
memory/6304-4499-0x0000000000D50000-0x0000000001786000-memory.dmp
memory/6304-4507-0x0000000008C80000-0x0000000008C8E000-memory.dmp
memory/6612-4407-0x000000001D7F0000-0x000000001D802000-memory.dmp
memory/6868-5031-0x0000000002EC0000-0x0000000002ED2000-memory.dmp
memory/6884-5046-0x00000000026E0000-0x00000000026F2000-memory.dmp
memory/6928-5007-0x000000001BA50000-0x000000001BA62000-memory.dmp
memory/6936-2659-0x000001D3CB000000-0x000001D3CB001000-memory.dmp
memory/7104-2678-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2681-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2677-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2676-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2672-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2674-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2680-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2673-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7104-2679-0x000002152E730000-0x000002152E731000-memory.dmp
memory/7116-4976-0x000000001B390000-0x000000001B3E6000-memory.dmp